What the install asks for, and why
Microsoft shows the permission list on a screen of its own, in its own wording. This page shows the same list in advance, with an explanation for each line, so it can be read before an install starts rather than during one.
Wide permissions, active only while you are signed in (4)
The wizard uses these permissions on your behalf while you are signed in. They do not exceed what you are already permitted to do as an administrator. They stop working when you close the browser, and the product does not use them after the install.
| What Microsoft calls it | Why it is needed | The detail, at Microsoft |
|---|---|---|
| Have full control of all site collections install only | Microsoft asks for this wide permission so we can give the service access to just one site. | Microsoft's page |
| Have full control of all site collections install only | This is what the wizard installs with: it creates the page and adds the app to the site you chose. | Microsoft's page |
| Read directory data install only | To check, before the install starts, that you hold the rights it needs. | Microsoft's page |
| Sign in and read user profile install only | To know who is signed in. | Microsoft's page |
Narrow permissions, active with nobody signed in (2)
This is the category worth checking. It holds access to one site, the one you select during the install. Our server does not reach other sites in your organisation, mailboxes or files. These are the only permissions that remain when the install ends.
| What Microsoft calls it | Why it is needed | The detail, at Microsoft |
|---|---|---|
| Access selected site collections for as long as the product runs | This is the access the product runs on: the one site you choose, and no other. | Microsoft's page |
| Access selected site collections for as long as the product runs | The same access to the same single site, through Microsoft other service. | Microsoft's page |