I am building a Provider-Hosted SharePoint Add-in. Given a SharePoint Online tenant (account) where my add-in is installed, I want to get a list of their Site Collections

To get this done I am making a CSOM call that uses an add-in-only policy like so:

var tenantAdminUri = new Uri("https://<tenant_name>-admin.sharepoint.com/");

var realm = TokenHelper.GetRealmFromTargetUrl(tenantAdminUri);

var token = TokenHelper.GetAppOnlyAccessToken(

using (var clientContext = TokenHelper.GetClientContextWithAccessToken(targetUrl, token))
    var tenant = new Tenant(clientContext);

    var siteProperties = tenant.GetSiteProperties(0, true);



When I run this code an exception is thrown by the call to ExecuteQuery(). The error message is:

"Access denied. You do not have permission to perform this action or access this resource."

Which permission do I need to specify in my SharePoint Add-in's AppManifest.xml file to be able to get this working?

PS - In the Add-in's AppManifest.xml I've set the permission to "Tenant, Read" like so:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read" />

Now I'm getting an exception that says:

Current user is not a tenant admin.

Googling this sentence yields no results (!)

PPS - The Add-in has been installed into SharePoint Online tenant by a user with Site Administrator privileges.

2 Answers 2


The user who is installing the app that has tenant level permissions should be tenant administrator.

  • Thanks. I forgot to mention in my question that yes, the user who installed the Add-in into the tenant is indeed a Site Administrator.
    – urig
    Commented Apr 5, 2016 at 18:26

Turns out the code works if I set my Add-in to ask for "Tenant, Modify" permissions like so:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Manage" />

Credit goes to the kind people over at the "SharePoint 2013 - Development and Programming" forum over at the Office Dev Center.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.