Article 27 from 30 : updating an app

This post is article 27 from the 30 Articles App series for SharePoint

When an app is installed, the SharePoint host environment records the version number for the installed app instance. App catalog sites always track their version number with the Office Store and detect if there is any update is available or not. The upgrade process by the SharePoint app model provides user-friendly experience which looks like below steps.

The app tile you will show “An update for this app is available” approx. 24hrs after an app update is published to the app store.


By default, SharePoint checks every 24 hours for updates to installed apps. A farm administrator can change this value to whichever is suitable.  SharePoint Management Shell command, where h is the number of hours between checks.

Set-SPInternalAppStateUpdateInterval -AppStateSyncHours h

If you need to run this update immediately then you can click on “About” from the app tile – > get it and trust it to update the app.


Make sure you do not change the ProductID number.

Major steps that may be needed when you create an update for an app for SharePoint :

  • Raise the Version number in the App element of the appmanifest.xml file. (MUST BE DONE)
  • Change the AppPermissionRequests and AppPrerequisites section of the appmanifest.xml file.
  • If your updating app-web components then Add any new components to the Feature exactly as you would if you were creating a new app for SharePoint project. Change existing files as needed. Open the Feature XML for editing, Increment the Version attribute of the Feature element.
  • Updating host-web components – custom actions and app parts is easier than in the app web. You don’t need any update semantics. Just add/change the custom actions and app parts. When the app for SharePoint is updated, SharePoint always applies any new element manifest files and reapplies any changed element manifest files with the most recent version. When you update an app part, SharePoint replaces the old version with the new version in the Web Part gallery. Be sure to change the Name property of the ClientWebPart object when you update an app part. Doing this ensures that, when the app is updated, SharePoint will remove the old version of the app part (which is no longer part of the app) from all pages to which it was added. Users will need to re-add the new version to pages.

You can also deploy web components programmatically using a remote event receiver, which I will cover in next article.

Article 26 from 30 : App authorization

This post is article 26 from the 30 Articles App series for SharePoint

In this article I will be discussing about app authorization policies.

Like users and groups, an app has its own identity in SharePoint. The authorization process verifies that an authenticated user and/or app has permission to perform certain operations or to access specific resources. The authenticated identities can be user identity only, user + app identities, or app identity only. Correspondingly three authorization policy are as following :

  • User-only policy— In this policy, the authorization checks take into account only the user identity. When a user is accessing SharePoint resources directly without using any app this policy is enforced.
  • User + app policy—In this policy, the authorization checks take into account both the user identity and the app identity.  An authorization checks succeed only if both the current user and the app have sufficient permissions to perform the action in question. This policy is used when a Office Store app, which does not run in SharePoint Server , wants to act on behalf of the user to get access to the user’s resources.
  • App only policy—In this policy, the authorization checks take into account only the app identity.  An authorization checks succeed only if the current app has sufficient permissions to perform the action , regardless of the permissions of the current user.  This policy is enforced is when the app is not acting on behalf of the user. In this policy, the person who installs the app has the rights that the app needs, even though users who actually use the app might not have those rights.

To request an app to use App-only policy your app needs to add attribute called “AllowAppOnlyPolicy” in tag node of AppPermissionRequests with value = ‘true”. User must be Site Collection Administrator to allow use of the app-only policy.

<AppPermissionRequests AllowAppOnlyPolicy="true">

App- Only Policy can only be used for Auto Hosted Apps or Provider Hosted Apps.

Hope that helps..!!

Article 25 from 30 : App permissions – II

This post is article 25 from the 30 Articles App series for SharePoint

In this article, I will discuss more on scope and a few examples for app permissions.

an app can have these rights : Read , Write, Manage, FullControl. These rights correspond to the default permission levels: Reader, Contributor, Designer, and Full Control. For more information about user permission levels, see User permissions and permission levels.

Permission request scopes for other (other than sitecollection, website, list ) SharePoint features

Scope URI Available Rights More Info
http://sharepoint/bcs/connection Read Business Connectivity Services in SharePoint 2013
http://sharepoint/search QueryAsUserIgnoreAppPrincipal Search in SharePoint 2013
http://sharepoint/taxonomy Read, Write taxonomy
http://sharepoint/social/tenant Read, Write, Manage, FullControl  social
http://sharepoint/social/core Read, Write, Manage, FullControl  social
http://sharepoint/social/microfeed Read, Write, Manage, FullControl  social
http://sharepoint/projectserver Manage  projectserver
http://sharepoint/projectserver/projects Read, Write  projectserver
http://sharepoint/projectserver/projects/project Read, Write  projectserver
http://sharepoint/projectserver/enterpriseresources Read, Write  projectserver
http://sharepoint/projectserver/statusing SubmitStatus  projectserver
http://sharepoint/projectserver/reporting Read  projectserver
http://sharepoint/projectserver/workflow Elevate  projectserver

Only Read, Write, and Manage rights are allowed for Office Store apps. If you try to submit an app to the Office Store that requires FullControl rights, your app is blocked from submission. However apps that request more than Manage permissions can still be deployed through the app catalog.

Below are some example code for AppManifest file with different scope and rights of App permission

Request Read access to the web scope and the list scope.

  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/>
  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Read"/>

Request Write access to the list scope.

  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Write"/>

The list permission request scope has an additional optional property. BaseTemplateId, and an integer value corresponding with a list base template, which filters the available lists down to the set of lists that match what is specified by the BaseTemplateId property.

<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Write">
    <Property Name="BaseTemplateId" Value="101"/>

Request access to all user profiles. ( This app must be installed by a tenant administrator. )

<AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="Read">

Request user’s feed or the team feed. This scope applies to personal sites that support microblogging or to team sites where the Site Feed feature is activated. If the app installs on any other type of site, use the Tenant scope.

<AppPermissionRequest Scope="http://sharepoint/social/microfeed" Right="Read">


Hope that helps..!!