This topic contains explanations about the required app permissions in SharePoint.
- Read: documents and lists so they can be sent to extraction.
- Full Control: for registering custom rendering script.
- Access: to basic information about users. This is needed to check if a user can work with an application.
- Read: user profiles. This permission is automatically requested for apps in SharePoint.
- Access: or modify the Enterprise Managed Metadata if you want to synchronize and use Term Store.