I'm a Sharepoint Farm Admin, and am in charge of permission reviews for requested Sharepoint add-ins. In the past, we have judged certain app requests as too permissive and denied them based on the description-only from the request itself.

My issue is our group does not fully agree upon what each description means. Therefore our assessments are inconsistent.

Example 1: "Let it access basic information about the users of this site"

(1) What basic information? userid, displayname, email, but not what...manager?

(2) Microsoft loosely switches between calling site collections "sites" and site/subsite "webs". So will that mean users of the site collection or the subsite level?

I understand about policies UserOnly AppOnly, User+App; but since we only have access to the text description in the App Store, when is which policy applied?

Example 2: "Let it create or delete document libraries and lists in this site collection." (DOCUSIGN FOR SHAREPOINT)

The implication is that is User+App based on other "Let it..." permissions. But because it is for signing documents, doesn't feel right that it would require the USER to have list management rights to function as expected.

1 Answer 1


This is a great question and I feel your pain. I don't have a complete answer but maybe I can get you part way there.

First, Apps/Addins always operate at the web/subsite level.

As far permissions go, in an App they're declared in an XML file called a manifest, the documentation of which you can find here. I don't have the tech-to-English conversions of these but hopefully that'll be pretty straightforward to figure out.

It's also helpful to understand that the scopes do not stack: What I mean by that is that they do not infer lower-level access. For example, FullControl on a tenant will allow creation of site collections but will not allow writing to lists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.