What permissions are needed to Create Groups and Add users to Groups?

Question

I am currently developing a SharePoint Provider-hosted-Add-In which should be run on O365.

I added FullControl to the SiteCollection and Web and everything worked fine. FullControl is not allowed, though.

So I tried Managed instead of FullControl, but that gave me an access denied when creating the Groups.

So my questions are:

• What are the minimum requirements to create groups in O365?
• Are there other (less) permissions needed to add users to an existing group?
• As the groups only have to be created after installation: Can the app have low permissions but use the Administrators level to create those groups?

I already tried SharePointContextProvider.CreateUserClientContextForSPHost() but still got an access denied, even though the user can create groups manually.

Answer 1

Answers of your questions:

1. You will need FullControl permission to create group.
2. No. You can take reference from here.
3. No. SharePoint uses an App Only context it really doesn’t matter what rights the end user has on the content – all that matters is what rights have been granted to the App. Because the App can effectively run with elevated privileges (i.e. more rights than the user might have), it requires you to be a Site Collection Administrator to install. App Only permissions don’t use the permissions of the current user, it just uses the App permissions.

References:

• https://samlman.wordpress.com/2015/03/02/security-in-sharepoint-apps-part-6/
• https://msdn.microsoft.com/en-us/library/office/fp142383.aspx