@pnp/cli-microsoft365 11.9.0-beta.8c1ee05 → 11.9.0-beta.f8dc984

package/dist/m365/spo/commands/folder/folder-archive.js

@@ -0,0 +1,89 @@
+import commands from '../../commands.js';
+import SpoCommand from '../../../base/SpoCommand.js';
+import { globalOptionsZod } from '../../../../Command.js';
+import { z } from 'zod';
+import { validation } from '../../../../utils/validation.js';
+import { cli } from '../../../../cli/cli.js';
+import { urlUtil } from '../../../../utils/urlUtil.js';
+import request from '../../../../request.js';
+import { formatting } from '../../../../utils/formatting.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    webUrl: z.string()
+        .refine(url => validation.isValidSharePointUrl(url) === true, {
+        error: e => `'${e.input}' is not a valid SharePoint Online site URL.`
+    })
+        .alias('u'),
+    url: z.string().optional(),
+    id: z.uuid().optional().alias('i'),
+    force: z.boolean().optional().alias('f')
+});
+class SpoFolderArchiveCommand extends SpoCommand {
+    get name() {
+        return commands.FOLDER_ARCHIVE;
+    }
+    get description() {
+        return 'Archives a folder';
+    }
+    get schema() {
+        return options;
+    }
+    getRefinedSchema(schema) {
+        return schema
+            .refine(options => [options.url, options.id].filter(o => o !== undefined).length === 1, {
+            error: `Specify 'url' or 'id', but not both.`
+        });
+    }
+    getExcludedOptionsWithUrls() {
+        return ['url'];
+    }
+    async commandAction(logger, args) {
+        const { webUrl, url, id, force } = args.options;
+        if (!force) {
+            const result = await cli.promptForConfirmation({ message: `Are you sure you would like to archive this item? You will be able to reactivate it instantly for the first 7 days. After that, it will take up to 24 hours to reactivate.` });
+            if (!result) {
+                return;
+            }
+        }
+        try {
+            if (this.verbose) {
+                await logger.logToStderr(`Archiving folder ${url || id} at site ${webUrl}...`);
+            }
+            let requestUrl = `${webUrl}/_api/web`;
+            if (id) {
+                requestUrl += `/GetFolderById('${formatting.encodeQueryParameter(id)}')`;
+            }
+            else if (url) {
+                const serverRelativePath = urlUtil.getServerRelativePath(webUrl, url);
+                requestUrl += `/GetFolderByServerRelativePath(DecodedUrl='${formatting.encodeQueryParameter(serverRelativePath)}')`;
+            }
+            requestUrl += '?$select=Exists,ListItemAllFields/Id,ListItemAllFields/ParentList/Id&$expand=ListItemAllFields,ListItemAllFields/ParentList';
+            const folderInfo = await request.get({
+                url: requestUrl,
+                headers: {
+                    accept: 'application/json;odata=nometadata'
+                },
+                responseType: 'json'
+            });
+            if (!folderInfo.Exists) {
+                throw `The folder '${url || id}' does not exist.`;
+            }
+            if (!folderInfo.ListItemAllFields?.ParentList) {
+                throw `The folder '${url || id}' is the root folder of a document library and cannot be archived. Archive a subfolder instead.`;
+            }
+            const requestOptions = {
+                url: `${webUrl}/_api/Lists(guid'${folderInfo.ListItemAllFields.ParentList.Id}')/items(${folderInfo.ListItemAllFields.Id})/Archive`,
+                headers: {
+                    accept: 'application/json;odata=nometadata'
+                },
+                responseType: 'json'
+            };
+            await request.post(requestOptions);
+        }
+        catch (err) {
+            this.handleRejectedODataJsonPromise(err);
+        }
+    }
+}
+export default new SpoFolderArchiveCommand();
+//# sourceMappingURL=folder-archive.js.map

package/dist/m365/spo/commands/list/list-sensitivitylabel-remove.js

@@ -0,0 +1,83 @@
+import { z } from 'zod';
+import { globalOptionsZod } from '../../../../Command.js';
+import request from '../../../../request.js';
+import { formatting } from '../../../../utils/formatting.js';
+import { urlUtil } from '../../../../utils/urlUtil.js';
+import { validation } from '../../../../utils/validation.js';
+import SpoCommand from '../../../base/SpoCommand.js';
+import commands from '../../commands.js';
+import { cli } from '../../../../cli/cli.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    webUrl: z.string()
+        .refine(url => validation.isValidSharePointUrl(url) === true, {
+        error: 'Specify a valid SharePoint site URL.'
+    })
+        .alias('u'),
+    listTitle: z.string().optional().alias('t'),
+    listId: z.uuid().optional().alias('l'),
+    listUrl: z.string().optional(),
+    force: z.boolean().optional().alias('f')
+});
+class SpoListSensitivityLabelRemoveCommand extends SpoCommand {
+    get name() {
+        return commands.LIST_SENSITIVITYLABEL_REMOVE;
+    }
+    get description() {
+        return 'Clears a default sensitivity label from a document library';
+    }
+    get schema() {
+        return options;
+    }
+    getRefinedSchema(schema) {
+        return schema
+            .refine(options => [options.listId, options.listTitle, options.listUrl].filter(o => o !== undefined).length === 1, {
+            error: 'Use one of the following options: listId, listTitle, or listUrl.'
+        });
+    }
+    async commandAction(logger, args) {
+        const removeSensitivityLabel = async () => {
+            try {
+                if (this.verbose) {
+                    await logger.logToStderr(`Removing the sensitivity label from list '${args.options.listId || args.options.listTitle || args.options.listUrl}' in site at ${args.options.webUrl}...`);
+                }
+                let requestUrl = `${args.options.webUrl}/_api/web`;
+                if (args.options.listId) {
+                    requestUrl += `/lists(guid'${formatting.encodeQueryParameter(args.options.listId)}')`;
+                }
+                else if (args.options.listTitle) {
+                    requestUrl += `/lists/getByTitle('${formatting.encodeQueryParameter(args.options.listTitle)}')`;
+                }
+                else if (args.options.listUrl) {
+                    const listServerRelativeUrl = urlUtil.getServerRelativePath(args.options.webUrl, args.options.listUrl);
+                    requestUrl += `/GetList('${formatting.encodeQueryParameter(listServerRelativeUrl)}')`;
+                }
+                const requestOptions = {
+                    url: requestUrl,
+                    headers: {
+                        accept: 'application/json;odata=nometadata',
+                        'content-type': 'application/json;odata=nometadata',
+                        'if-match': '*'
+                    },
+                    data: { 'DefaultSensitivityLabelForLibrary': '' },
+                    responseType: 'json'
+                };
+                await request.patch(requestOptions);
+            }
+            catch (err) {
+                this.handleRejectedODataJsonPromise(err);
+            }
+        };
+        if (args.options.force) {
+            await removeSensitivityLabel();
+        }
+        else {
+            const result = await cli.promptForConfirmation({ message: `Are you sure you want to remove the sensitivity label from list '${args.options.listId || args.options.listTitle || args.options.listUrl}'?` });
+            if (result) {
+                await removeSensitivityLabel();
+            }
+        }
+    }
+}
+export default new SpoListSensitivityLabelRemoveCommand();
+//# sourceMappingURL=list-sensitivitylabel-remove.js.map

package/dist/m365/spo/commands.js

@@ -85,6 +85,7 @@ export default {
     FILE_SHARINGLINK_LIST: `${prefix} file sharinglink list`,
     FILE_SHARINGLINK_REMOVE: `${prefix} file sharinglink remove`,
     FILE_SHARINGLINK_SET: `${prefix} file sharinglink set`,
+    FILE_UNARCHIVE: `${prefix} file unarchive`,
     FILE_VERSION_CLEAR: `${prefix} file version clear`,
     FILE_VERSION_GET: `${prefix} file version get`,
     FILE_VERSION_KEEP: `${prefix} file version keep`,
@@ -92,6 +93,7 @@ export default {
     FILE_VERSION_REMOVE: `${prefix} file version remove`,
     FILE_VERSION_RESTORE: `${prefix} file version restore`,
     FOLDER_ADD: `${prefix} folder add`,
+    FOLDER_ARCHIVE: `${prefix} folder archive`,
     FOLDER_COPY: `${prefix} folder copy`,
     FOLDER_GET: `${prefix} folder get`,
     FOLDER_LIST: `${prefix} folder list`,
@@ -160,6 +162,7 @@ export default {
     LIST_ROLEINHERITANCE_BREAK: `${prefix} list roleinheritance break`,
     LIST_ROLEINHERITANCE_RESET: `${prefix} list roleinheritance reset`,
     LIST_SENSITIVITYLABEL_ENSURE: `${prefix} list sensitivitylabel ensure`,
+    LIST_SENSITIVITYLABEL_REMOVE: `${prefix} list sensitivitylabel remove`,
     LIST_SET: `${prefix} list set`,
     LIST_SITESCRIPT_GET: `${prefix} list sitescript get`,
     LIST_VIEW_ADD: `${prefix} list view add`,

package/dist/m365/viva/commands/engage/engage-role-member-add.js

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import { globalOptionsZod } from '../../../../Command.js';
+import GraphCommand from '../../../base/GraphCommand.js';
+import commands from '../../commands.js';
+import { vivaEngage } from '../../../../utils/vivaEngage.js';
+import { entraUser } from '../../../../utils/entraUser.js';
+import request from '../../../../request.js';
+import { validation } from '../../../../utils/validation.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    roleId: z.uuid().optional().refine(id => validation.isValidGuid(id), {
+        error: e => `'${e.input}' is not a valid GUID.`
+    }),
+    roleName: z.string().optional(),
+    userId: z.uuid().optional().refine(id => validation.isValidGuid(id), {
+        error: e => `'${e.input}' is not a valid GUID.`
+    }),
+    userName: z.string().refine(upn => validation.isValidUserPrincipalName(upn), {
+        error: e => `'${e.input}' is not a valid UPN.`
+    }).optional()
+});
+class VivaEngageRoleMemberAddCommand extends GraphCommand {
+    get name() {
+        return commands.ENGAGE_ROLE_MEMBER_ADD;
+    }
+    get description() {
+        return 'Assign a Viva Engage role to a user';
+    }
+    get schema() {
+        return options;
+    }
+    getRefinedSchema(schema) {
+        return schema
+            .refine(options => [options.roleId, options.roleName].filter(x => x !== undefined).length === 1, {
+            error: 'Specify either roleId, or roleName, but not both.'
+        })
+            .refine(options => [options.userId, options.userName].filter(x => x !== undefined).length === 1, {
+            error: 'Specify either userId, or userName, but not both.'
+        });
+    }
+    async commandAction(logger, args) {
+        try {
+            let roleId = args.options.roleId;
+            let userId = args.options.userId;
+            if (args.options.roleName) {
+                if (this.verbose) {
+                    await logger.logToStderr(`Retrieving Viva Engage role ID for role name '${args.options.roleName}'...`);
+                }
+                roleId = await vivaEngage.getRoleIdByName(args.options.roleName);
+            }
+            if (args.options.userName) {
+                if (this.verbose) {
+                    await logger.logToStderr(`Retrieving Viva Engage user ID for user name '${args.options.userName}'...`);
+                }
+                userId = await entraUser.getUserIdByUpn(args.options.userName);
+            }
+            if (this.verbose) {
+                await logger.logToStderr(`Assigning user ${userId} to a Viva Engage role ${roleId}...`);
+            }
+            const requestOptions = {
+                url: `${this.resource}/beta/employeeExperience/roles/${roleId}/members`,
+                headers: {
+                    'content-type': 'application/json;odata=nometadata',
+                    'accept': 'application/json;odata.metadata=none'
+                },
+                responseType: 'json',
+                data: {
+                    'user@odata.bind': `${this.resource}/beta/users('${userId}')`
+                }
+            };
+            await request.post(requestOptions);
+        }
+        catch (err) {
+            this.handleRejectedODataJsonPromise(err);
+        }
+    }
+}
+export default new VivaEngageRoleMemberAddCommand();
+//# sourceMappingURL=engage-role-member-add.js.map

package/dist/m365/viva/commands.js

@@ -25,6 +25,7 @@ export default {
     ENGAGE_REPORT_GROUPSACTIVITYDETAIL: `${prefix} engage report groupsactivitydetail`,
     ENGAGE_REPORT_GROUPSACTIVITYGROUPCOUNTS: `${prefix} engage report groupsactivitygroupcounts`,
     ENGAGE_ROLE_LIST: `${prefix} engage role list`,
+    ENGAGE_ROLE_MEMBER_ADD: `${prefix} engage role member add`,
     ENGAGE_ROLE_MEMBER_LIST: `${prefix} engage role member list`,
     ENGAGE_ROLE_MEMBER_REMOVE: `${prefix} engage role member remove`,
     ENGAGE_SEARCH: `${prefix} engage search`,

package/docs/docs/cmd/outlook/calendar/calendar-get.mdx

@@ -41,16 +41,16 @@ m365 outlook calendar get [options]
 <Tabs>
   <TabItem value="Delegated">
 
-  | Resource        | Permissions        |
-  |-----------------|--------------------|
-  | Microsoft Graph | Calendar.ReadBasic |
+  | Resource        | Permissions    |
+  |-----------------|----------------|
+  | Microsoft Graph | Calendars.Read |
 
   </TabItem>
   <TabItem value="Application">
 
-  | Resource        | Permissions        |
-  |-----------------|--------------------|
-  | Microsoft Graph | Calendar.ReadBasic |
+  | Resource        | Permissions    |
+  |-----------------|----------------|
+  | Microsoft Graph | Calendars.Read |
 
   </TabItem>
 </Tabs>
@@ -162,4 +162,4 @@ m365 outlook calendar get --userId b743445a-112c-4fda-9afd-05943f9c7b36 --calend
   ```
 
   </TabItem>
-</Tabs>
+</Tabs>

package/docs/docs/cmd/spe/container/container-get.mdx

@@ -15,8 +15,17 @@ m365 spe container get [options]
 ## Options
 
 ```md definition-list
-`-i, --id <id>`
-: The Id of the container instance.
+`-i, --id [id]`
+: The Id of the container instance. Specify either `id` or `name` but not both.
+
+`-n, --name [name]`
+: Display name of the container. Specify either `id` or `name` but not both.
+
+`--containerTypeId [containerTypeId]`
+: The container type ID of the container instance. Specify either `containerTypeId` or `containerTypeName` when using `name` but not both.
+
+`--containerTypeName [containerTypeName]`
+: The container type name of the container instance. Specify either `containerTypeId` or `containerTypeName` when using `name` but not both.
 ```
 
 <Global />
@@ -42,12 +51,24 @@ m365 spe container get [options]
 
 ## Examples
 
-Gets a container of a specific type.
+Gets a container of a specific type by id.
 
 ```sh
 m365 spe container get --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z"
 ```
 
+Gets a container of a specific type by display name.
+
+```sh
+m365 spe container get --name "My Application Storage Container" --containerTypeId "91710488-5756-407f-9046-fbe5f0b4de73"
+```
+
+Gets container by using its name and container type name.
+
+```sh
+m365 spe container get --name "Invoices" --containerTypeName "My container type name"
+```
+
 ## Response
 
 <Tabs>

package/docs/docs/cmd/spe/container/container-permission-list.mdx

@@ -15,8 +15,17 @@ m365 spe container permission list [options]
 ## Options
 
 ```md definition-list
-`-i, --containerId <id>`
-: The ID of the SharePoint Embedded Container.
+`-i, --containerId [id]`
+: The ID of the SharePoint Embedded Container. Specify either `containerId` or `containerName` but not both.
+
+`-n, --containerName [containerName]`
+: Display name of the SharePoint Embedded Container. Specify either `containerId` or `containerName` but not both.
+
+`--containerTypeId [containerTypeId]`
+: The container type ID of the container instance. Specify either `containerTypeId` or `containerTypeName` when using `containerName` but not both.
+
+`--containerTypeName [containerTypeName]`
+: The container type name of the container instance. Specify either `containerTypeId` or `containerTypeName` when using `containerName` but not both.
 ```
 
 <Global />
@@ -42,12 +51,24 @@ m365 spe container permission list [options]
 
 ## Examples
 
-Lists Container permissions.
+Lists Container permissions by id.
 
 ```sh
 m365 spe container permission list --containerId "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z"
 ```
 
+Lists Container permissions by display name.
+
+```sh
+m365 spe container permission list --containerName "My Application Storage Container" --containerTypeId "91710488-5756-407f-9046-fbe5f0b4de73"
+```
+
+Lists Container permissions by display name and container type name.
+
+```sh
+m365 spe container permission list --containerName "My Application Storage Container"  --containerTypeName "My container type name"
+```
+
 ## Response
 
 <Tabs>

package/docs/docs/cmd/spe/container/container-set.mdx

@@ -0,0 +1,160 @@
+import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# spe container set
+
+Updates a SharePoint Embedded container
+
+## Usage
+
+```sh
+m365 spe container set [options]
+```
+
+## Options
+
+```md definition-list
+`-i, --id <id>`
+: The Id of the container.
+
+`--newName [newName]`
+: New display name for the container.
+
+`--description [description]`
+: Description of the container.
+
+`--isOcrEnabled [isOcrEnabled]`
+: Indicates whether OCR is enabled for the container. Possible values: `true`, `false`.
+
+`--isItemVersioningEnabled [isItemVersioningEnabled]`
+: Indicates whether item versioning is enabled. Possible values: `true`, `false`.
+
+`--itemMajorVersionLimit [itemMajorVersionLimit]`
+: Maximum number of major versions to keep. Requires versioning to be enabled.
+```
+
+<Global />
+
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource        | Permissions                   |
+  |-----------------|-------------------------------|
+  | Microsoft Graph | FileStorageContainer.Selected |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource        | Permissions                   |
+  |-----------------|-------------------------------|
+  | Microsoft Graph | FileStorageContainer.Selected |
+
+  </TabItem>
+</Tabs>
+
+## Remarks
+
+In addition to Graph permissions, the app/user must have container-type level permission for the respective container type. The caller must have write access to the container (for example, writer, manager, or owner role) to update metadata/settings.
+
+## Examples
+
+Update the container display name by Id.
+
+```sh
+m365 spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --newName "Contoso Project A"
+```
+
+Update description only.
+
+```sh
+m365 spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --description "Files for the Contoso Project A team"
+```
+
+Disable OCR for a container.
+
+```sh
+m365 spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --isOcrEnabled false
+```
+
+Enable versioning and set the major version limit.
+
+```sh
+m365 spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --isItemVersioningEnabled true --itemMajorVersionLimit 100
+```
+
+Update name, description, and settings together.
+
+```sh
+m365 spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --newName "Contoso Project A - Phase 2" --description "Phase 2 workspace" --isOcrEnabled true --isItemVersioningEnabled true --itemMajorVersionLimit 50
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  {
+    "id": "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z",
+    "displayName": "Contoso Project A",
+    "description": "Files for the Contoso Project A team",
+    "containerTypeId": "91710488-5756-407f-9046-fbe5f0b4de73",
+    "status": "active",
+    "createdDateTime": "2021-11-24T15:41:52.347Z",
+    "lockState": "unlocked",
+    "settings": {
+      "isOcrEnabled": false,
+      "itemMajorVersionLimit": 50,
+      "isItemVersioningEnabled": true
+    }
+  }
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  containerTypeId: 91710488-5756-407f-9046-fbe5f0b4de73
+  createdDateTime: 2021-11-24T15:41:52.347Z
+  description    : Files for the Contoso Project A team
+  displayName    : Contoso Project A
+  id             : b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z
+  lockState      : unlocked
+  settings       : {"isOcrEnabled":false,"itemMajorVersionLimit":50,"isItemVersioningEnabled":true}
+  status         : active
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,displayName,description,containerTypeId,status,createdDateTime,lockState
+  b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z,Contoso Project A,Files for the Contoso Project A team,91710488-5756-407f-9046-fbe5f0b4de73,active,2021-11-24T15:41:52.347Z,unlocked
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # spe container set --id "b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z" --newName "Contoso Project A"
+
+  Date: 07/04/2026
+
+  ## Contoso Project A (b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z)
+
+  Property | Value
+  ---------|-------
+  id | b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z
+  displayName | Contoso Project A
+  description | Files for the Contoso Project A team
+  containerTypeId | 91710488-5756-407f-9046-fbe5f0b4de73
+  status | active
+  createdDateTime | 2021-11-24T15:41:52.347Z
+  lockState | unlocked
+  ```
+
+  </TabItem>
+</Tabs>

package/docs/docs/cmd/spo/app/app-add.mdx

@@ -40,6 +40,25 @@ When specifying site collection app catalog, you can specify the URL either with
 
 If you try to upload a package that already exists in the app catalog without specifying the `--overwrite` option, the command will fail with an error stating that the specified package already exists.
 
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource   | Permissions          |
+  |------------|----------------------|
+  | SharePoint | AllSites.FullControl |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource   | Permissions           |
+  |------------|-----------------------|
+  | SharePoint | Sites.FullControl.All |
+
+  </TabItem>
+</Tabs>
+
 ## Examples
 
 Add the package to the tenant app catalog.

package/docs/docs/cmd/spo/app/app-deploy.mdx

@@ -1,4 +1,6 @@
 import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
 
 # spo app deploy
 
@@ -39,6 +41,25 @@ When specifying site collection app catalog, you can specify the URL either with
 
 If the app with the specified ID doesn't exist in the app catalog, the command will fail with an error. Before you can deploy an app, you have to add it to the app catalog first using the [spo app add](./app-add.mdx) command.
 
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource   | Permissions          |
+  |------------|----------------------|
+  | SharePoint | AllSites.FullControl |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource   | Permissions           |
+  |------------|-----------------------|
+  | SharePoint | Sites.FullControl.All |
+
+  </TabItem>
+</Tabs>
+
 ## Examples
 
 Deploy the specified app in the tenant app catalog. Try to resolve the URL of the tenant app catalog automatically.

package/docs/docs/cmd/spo/app/app-get.mdx

@@ -36,6 +36,25 @@ When getting information about an app from the tenant app catalog, it's not nece
 
 When specifying site collection app catalog, you can specify the URL either with our without the _AppCatalog_ part, for example `https://contoso.sharepoint.com/sites/team-a/AppCatalog` or `https://contoso.sharepoint.com/sites/team-a`. CLI will accept both formats.
 
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource   | Permissions   |
+  |------------|---------------|
+  | SharePoint | AllSites.Read |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource   | Permissions    |
+  |------------|----------------|
+  | SharePoint | Sites.Read.All |
+
+  </TabItem>
+</Tabs>
+
 ## Examples
 
 Return details about the app with the specified ID available in the tenant app catalog.