Permission XML for SharePoint Add-in

In this article, we will be discussing the permission XMLs, which are used to provide permission to SharePoint add-in. Permission XML for the SharePoint app.

You can set the App only permission, by setting "true" or "false" in AllowAppOnlyPolicy=“true” in these permission XMLs.

If add-in granted permission to tenant scope, It includes all children in scope.

Before granting access to the app, need to register an app. Follow this link for step by step guide to How to register an app/add-in in SharePoint

Providing access to add-in at tenant level:

To provide access at tenant level user must have the tenant admin level permission. To grant this permission tenant admin can use this URL

https://tenantName-admin.sharepoint.com/_layouts/appinv.aspx

Search the App Id (Client ID) and it will fetch all the information which you provide at time of registration of app.

Assign full control at tenant level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/tenant" 
 Right="FullControl" />

</AppPermissionRequests>

Assign manage control at tenant level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/tenant" 
     Right="Manage" />
</AppPermissionRequests>

Assign write control at tenant level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/tenant" 
     Right="Write" />
</AppPermissionRequests>

Assign read control at tenant level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/tenant" 
     Right="Read" />
</AppPermissionRequests>

Providing access to add-in at Site collection level:

To provide access at site collection level user must have the site collection admin level permission. To grant this permission site collection admin can use this URL

https://tenantName.sharepoint.com/sites/siteName/_layouts/appinv.aspx

Replace the tenantName with your SharePoint tenant name and siteName with your site name on which you want to grant access

Assign full control at site collection level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/sitecollection" 
 Right="FullControl" />

</AppPermissionRequests>

Assign manage control at site collection level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/sitecollection" 
     Right="Manage" />
</AppPermissionRequests>

Assign write control at site collection level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/sitecollection" 
     Right="Write" />
</AppPermissionRequests>

Assign read control at site collection level :

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest

Scope="http://sharepoint/content/sitecollection" 
     Right="Read" />
</AppPermissionRequests>

Providing access to access User profile properties:

In some scenarios, when we want to access and update the user profile properties and if we want to perform the operation using the SharePoint add-in we need to give this permission to the add-in.