SharePoint apps: working with the app web, and why you should

Disclaimer: Just because I’m writing about apps, doesn’t mean I think everything in SP2013 should be developed as an app! I’m focusing on apps simply because it’s a deep area with lots to learn.

1. SharePoint 2013 apps – architecture, capability and UX considerations
2. Getting started – creating lists, content types, fields etc. within a SharePoint app (provisioning)
3. Working with data in the app web, and why you should [this article]
4. Access end-user data (in the host web) from a SharePoint 2013 app
5. Rolling out SharePoint 2013 apps to the enterprise - tenant scope and PowerShell installs
6. Azure is the new SharePoint ‘_layouts’ directory
7. “Host web apps” – provisioning files (e.g. master pages) to the host web
8. ““Host web apps” – provisioning fields and content types
9. Deploying SP2013 provider-hosted apps/Remote Event Receivers to Azure Websites (for Office 365 apps)
10. Working with web parts within a SharePoint app

The app web is the default

You might already have come across the idea that SharePoint 2013 apps which host SharePoint components (e.g. lists, content types etc.) put these into an isolated area called the app web. If not, my previous article Creating lists, content types and fields within a SharePoint app (provisioning) provides some details, including some explanation around the diagram below, which summarises an app I’m building:

The main thing to consider about the app web is that it is the default – if you write some Client Object Model (CSOM) code (remember that SharePoint server-side code is forbidden within an app), perhaps to find a list and retrieve the items, in the standard app arrangement it is the app web you are working with. This is because, by default, you’ll be in a page within the app web – meaning your context is the app web, and that’s what is reflected in the ClientContext object you’ll be working with in your code. What happens is that when you go through an app’s “front door” in the Site Contents area, you are redirected to a page in the app web – and the ClientContext object in the CSOM is simply doing what it always does i.e. obtaining the current web as per the URL in the browser address bar.

Consequently, there is nothing special needed to ‘get a reference’ to the app web in your code. As a separate topic, the same cannot be said of the “host web” (the “real” SharePoint site where the app was installed) – in a best practice configuration which has the app domain on a completely separate URL domain to team sites/My Sites etc. (e.g. “http://myCorp-apps.com” vs. “http://myCorp.com” ), you’ll need to use the SP.RequestExecutor cross-domain library which Microsoft supply to access the host web. More on this in the "Working with data in the host web” article later in this series.

Getting the URLs for the app web and host web (within an app)

Within an app, the developer needs to know the URL for the app web and the host web where the app is installed.  The relevant URLs for the app web and the host web are passed as querystring parameters in the URL through to the first page load of your app, when the user arrives there from the app entry point in the Site Contents area. In fact, any time the user hits the home page of your app (e.g. by clicking the breadcrumb link within the app itself), you’ll see them in the browser address bar. So, it’s simply a matter of reading these URL  parameters – there are lots of ways to do this in JavaScript, I use the following jQuery plugin but anything similar will be fine; simply ensure it’s in a JavaScript file referenced by your app pages:

// jQuery plugin for fetching querystring parameters..

jQuery.extend({

    getUrlVars: function () {

        var vars = [], hash;

        var hashes = window.location.href.slice(window.location.href.indexOf('?') + 1).split('&');

        for (var i = 0; i < hashes.length; i++) {

            hash = hashes[i].split('=');

            vars.push(hash[0]);

            vars[hash[0]] = hash[1];

        }

        return vars;

    },

    getUrlVar: function (name) {

        return jQuery.getUrlVars()[name];

    }

});

Then to grab the app web/host web URLs, you would do:

// retrieve passed app web/host web URLs..

hostweburl = decodeURIComponent($.getUrlVar("SPHostUrl"));

appweburl = decodeURIComponent($.getUrlVar("SPAppWebUrl"));

BEWARE: bug in SharePoint 2013 Preview around the host web URL

One thing I notice in the current build (Preview), is that the host web URL only comes through on the first-time page load (app entry) from the host web. When the user is navigating around any pages you create in the app web, if they click on the breadcrumb link to go to the app’s default page, the URL parameter is present but has an incorrect value. It now has the URL  of the app web, instead of the host web. Consequently if you’re trying to look up something in the host web, this code will fail at this point. I’m assuming this has to be a bug, and will file it on Connect very soon (it hadn’t already been logged when I checked).

As a temporary workaround, I’m persisting the value in a cookie on first-time entry, then fetching it from there as needed. This works fine, I’d be happy to share my code if useful to anyone (just leave me a comment below), but it’s not particularly complex and I’m sure you can imagine what it does.

Common tasks with the app web

So if it’s just standard Client Object Model code and nothing special is required to ‘get a reference’ to the app web, then standard JavaScript CSOM code samples are all you need to help you along. As such, a previous article of mine has some basic JavaScript CSOM examples that I often find myself referring to when I can’t remember syntax and whatnot:

• Fetching the title of the current web
• Fetching items from a list/library
• Fetching list items with query (type-ahead)
• Add new list items to a list

Other good sources are:

• MSDN: SharePoint Client Object Model Data Retrieval (skip to the JavaScript parts)
• Vesa Juvonen: How to – SharePoint 2010 – JS client object model and UI advancements

Remember that the JavaScript version of the Client Object Model (which I’m discussing here) is what you’d use in a web page, but if you were in server-side code of some sort (Windows desktop app/Windows Phone app, WCF service, PowerShell script, console app etc.) then you could use the .NET Managed Client Object Model and code in C# for example.

Using the app web vs. the host web

So, working with the app web is pretty simple. In security terms, the app principal (the identity of the app – this is a fully-fledged security identity) has Full Control permission of the app web, so you can accomplish anything you need to, so long as it can be done with client-side code. However, as I pointed out last time, the app web is pretty sparse by default – there’s no real navigation, many of the SharePoint system pages cannot be used (e.g. the Site Contents page, /_layouts/viewlsts.aspx) and obviously there’s a separation between the app and the end-user’s collaboration stuff (lists and libraries) which is back in the host web. Obviously you could customise heavily and maybe even get to something like that feels like a team site, but it would be quite a lot of work – it’s not permitted to actually use a template such as a team site (STS#0) for an app web. Here’s a reminder of what that default user experience looks like:

 

If this isolation of the app doesn’t really suit the requirements, an alternative arrangement could be for the app to provision it’s lists/pages/etc. into the host web. To be clear, this is actually isn’t possible in many scenarios for two main reasons:

• Security – the app cannot mess around with the host web; by default it has very limited read permissions only. This, of course, is the whole point of the isolation and a key benefit of apps for whoever has to plan, maintain and upgrade the SharePoint deployment
• Provisioning model – if you add a Feature to your Visual Studio project to create, for example, a list – then this list gets created in the app web. It is simply not possible to use traditional provisioning approaches against the host web from within an app

However, there is a combination of circumstances where it is possible:

• The app comes with a permission request for Full Control to the host web (which must be granted by the user installing the app for the app to install)
• Provisioning is implemented via the Client Object Model (CSOM)

These constraints mean it might not always be possible to use this approach. For example, Microsoft is unlikely to ever approve an app which requires Full Control of the host web for use in Office 365/SharePoint Online. Similarly, SharePoint administrators deciding whether a publicly-available app is safe to be added their organisation’s App Catalog would most likely take the same view. BUT, it might make sense to fulfil a particular client requirement – if a client wants a certain set of functionality and wants it implemented as an app, then this might be the way.

Doug Ware, a fellow SharePoint MVP and true “developer’s developer”, is doing a lot of thought leadership in this area. The links at the bottom of this article are to his posts, which I think are required reading if you believe this approach is relevant to you. To build an app of this type, it quickly becomes obvious that a library of CSOM provisioning methods (e.g. createField(), createContentType(), createList(), addListItem(), addFile() and so on) is necessary, and Doug is starting a blog series on this topic.

However, I don’t believe this approach is a panacea for challenges around the app model. Here’s why…

…implementing an app in the host web might not be a good idea

So we’ve already covered the constraints which could mean it’s not possible in the first place (the need for Full Control permissions in the host web). I also think that:

• The host web approach partly defeats the purpose of apps (a very specific piece of functionality, which runs isolated from the SharePoint environment so there’s no negative impact to platform stability, any future upgrades and user data) 
  • If the app is just for one client, I feel like the benefits of apps are eroded so much you may as well build a farm solution. It will be way quicker, no matter how good you are with JavaScript and the CSOM.
• For many requirements, putting the artifacts in the app web should actually work just fine. If you need to store some list/library data and provide some pages for a front-end, then the fact that this is somewhat separate from the end user’s core data doesn’t really matter.
  • For example, in the somewhat contrived time-tracking app that I’m building, so long as the user interface makes it quick and easy to see how many hours the current user has logged this week, and what his/her target is - I don’t think he/she would care whether the data was coming from a list in the app or host web.
• I’m convinced Microsoft don’t want you to build apps in the host web. I’m mainly basing this on the following observations:
  • The provisioning model is all around the app web
  • It’s not possible to set the app’s start page to be a page in the host web. Notably, all the URL tokens which can be used at the beginning of the start page URL are for the app web (or remote app web in the case of an externally-hosted app). See the MSDN page URL strings and tokens in apps for SharePoint and note the “This token cannot be used in the StartPage element of an app manifest…” statements next to each token which refers to a host web item
  • No SDK samples use this approach
  • No MSDN documentation discusses it (at the time of writing at least)
  • Many of their design goals of the app web would not be met (security, reduction in upgrade complexity for customized environments, etc.)

Effectively, I almost see the idea of an app requesting Full Control permission and then provisioning there as a LOOPHOLE.

Summary

So does that mean that we should never use this approach (and that Doug is wrong)? Do I think that we have to build solutions exactly as Microsoft envisage? Hell no! For starters, Microsoft say that every customization should be built as an app in SharePoint 2013, and as my disclaimer at the beginning of these articles says, I personally don’t agree with that. 

But I do think you should think long and hard before using the “exploitable loophole” of building in the host web. Too many devs fail to see the full Total Cost of Ownership of their solutions - around maintainability (and skills/experience/capability required), long-term stability, performance, re-work required during upgrade and so on - because they’ve long since moved onto the next project/client. I’ve seen extremely impressive solutions (created by very talented devs) slide from being absolutely loved to being a big organizational headache within months. Of course, the original dev wasn’t around to see this – if he was, he probably could have managed perceptions, minimized the problem and perhaps learnt a lesson - but he wasn’t. It’s hard to accept, but some of my solutions have probably gone in this direction too. Now I’m not suggesting Doug is guilty of this – I’m sure someone of that brainpower is able to look after his SharePoint clients’ best interests very well – but there is a  long-term impact around SharePoint dev work which implementers should consider. And I feel that if the app model is suitable in the first place, then implementing an app in the host web (rather than the app web) may be part of the problem, rather than part of the solution.

All this isn’t to say it never makes sense though – as I said earlier, some situations where the SharePoint moving pieces really have to sit next to the other lists/libraries/pages the end user has would be examples. I think Doug is actually saying as much when he talks about Building Traditional SharePoint Collaboration Solutions with the App Model – it’s just that I might be more optimistic that the isolated model works for more scenarios than he is. Time will tell.

Further reading:

• Doug Ware: Building Traditional SharePoint Collaboration Solutions with the App Model
• Doug Ware: Provisioning with the Client Object Model Part 1 – Introduction

Create lists, content types, fields etc. within a SharePoint 2013 app

Disclaimer: Just because I’m writing about apps, doesn’t mean I think everything in SP2013 should be developed as an app! I’m focusing on apps simply because it’s a deep area with lots to learn.

Recently I’ve been building a SharePoint 2013 app to help me learn the framework – specifically an on-premises app which has some SharePoint components, rather than a purely remote app. This series is based on some scenarios which I think are key building blocks for apps – for a given set of requirements, you’ll likely need to do one or more of these things. Frankly,you might need to do 100 other things too, but these are certainly common. Here’s a rough outline for the series (which I’ll probably tweak, and will definitely add to):

1. SharePoint 2013 apps – architecture, capability and UX considerations
2. Getting started – creating lists, content types, fields etc. within a SharePoint app (provisioning) [this article]
3. Working with data in the app web, and why you should
4. Access end-user data (in the host web) from a SharePoint 2013 app
5. Rolling out SharePoint 2013 apps to the enterprise - tenant scope and PowerShell installs
6. Azure is the new SharePoint ‘_layouts’ directory
7. “Host web apps” – provisioning files (e.g. master pages) to the host web
8. “Host web apps” – provisioning fields and content types
9. Deploying SP2013 provider-hosted apps/Remote Event Receivers to Azure Websites (for Office 365 apps)
10. Working with web parts within a SharePoint app

You’ll notice that I’m skipping setting up a SharePoint 2013 dev environment for developing apps. I think other folks have done a good job here – here are some good sources:

• How to: Set up an on-premises development environment for apps for SharePoint (MSDN)
• Setting up your App domain for SharePoint 2013 (Mirjam van Olst)

Before we start – understanding the ‘app web’ and security model

If you’re getting into developing apps for SharePoint, then I’m assuming you know something about the separation of apps and host webs. In a nutshell, apps are kept separate from ‘real’ end-user SharePoint sites – any lists and document libraries created by the app, any files and web pages, all live in a separate web application to the host site. When a user clicks on the app, they leave the host site behind and get redirected to a web which was created when the app was installed for this site. Effectively an ‘app web’ gets created for every site the app is installed to, in a structure which mirrors the host sites themselves.

Security is the primary driver behind this architecture – the app itself has Full Control over this specially-created site, but no rights (by default) to host sites. Clearly if a malicious app could delete end-user data, that would be A Very Bad Thing. Microsoft would not want that to happen, and so we have this separation. Additionally, it also serves to provide protection against cross-site scripting (IF the web application created for apps does not use the same domain or a subdomain – it should not), and allows SharePoint to identify the caller for Client Object Model calls.

UPDATE 17 Sept 2012: Actually there are circumstances where the developer *can* choose to have the lists/files/web pages etc. created in the host web rather than the app web. See the second half of the next article in this series Working with the app web, and why you should for discussion of this.

If you need more detail this host/app web split, then Ted Pattison has a nice post (in a great series) at SharePoint apps are isolated with respect to request processing and storage. You might not need to understand everything about this right now, but you shouldn’t ignore it.

Getting started– creating your first SharePoint-hosted app

Nothing too complex here – just fire up Visual Studio 2012 and create a project from the ‘App for SharePoint 2013’ project template:

You’ll then be asked to specify some settings for the app – here we need to tell Visual Studio which local site we’ll be developing against/deploying to, and that we are creating a SharePoint-hosted app:

The project is created, and you’ll see that a bunch of files are added automatically – this is effectively a “Hello World” sample which is useful to get you started. jQuery is referenced, a Default.aspx page is added to the app, and this references a CSS file (App.css) and a JavaScript file (App.js) – the JavaScript file has some CSOM code to fetch the current user’s name and put it in a DIV on the page:

If you hit F5 to deploy this, you’ll see that the result is a pretty empty page which shows your app’s title (not yet converted to a user-friendly name in my case), and after a second or so for the AJAX call to complete, shows your username:

At this point, it’s interesting to consider what this sample page does NOT have:

• Any form of left-navigation/quick launch
• Top navigation (although the more global strip in the chrome across the top exists)
• Breadcrumb (although note the single link back to the host web, ‘Team 2’)
• A Site Actions menu
• A link to a Site Contents page (N.B. this page cannot be viewed in an app – if you try, you’ll get something like “The endpoint /team2/cobsharepointappsmyfirstapp/_layouts/15/viewlsts.aspx is not accessible in the context of a SharePoint App.”

So, it’s a pretty “bare bones” starting point. Now let’s take this towards something a bit more like a real-life app.

The concept - my "learner” time-recording sample app

To help us understand the app framework, let’s say we have to build some kind of time-recording app. Lots of us work in utilization-focused consulting organisations, so the concept of a timesheet is usually all too familiar.  The app I’m going to show won’t win any awards for functionality or design – and it definitely doesn’t provide enough end-user value to consider submitting it to the app store :) It’s purely to help me learn about apps, and I’d rather explore different areas even if the design is impractical or doesn’t really make sense.

Here’s what it currently looks like, though I’ll probably add bits to it over the course of this article series:

 

 

App implementation

In terms of artifacts, some fundamental pieces of the app include:

• Projects list
• Logged time list
  • Uses TrackedTime content type – this defines 4 fields, including a lookup to Projects and a Person/Group field for employee
• Utilisation targets (per employee) list
• Default page
• “My time summary” page – this is effectively a navigation-free version of Default.aspx
• App part (ClientWebPart) to display “My time summary” page in host web

As I discussed in SharePoint 2013 apps – architecture, capability and UX considerations, it’s important to understand (or remember) is that with a couple of exceptions, a SharePoint-hosted app can only provision things into the automatically-created “app web”. This lives under the “apps” web application which must be created in an on-premises scenario. The diagram below tries to illustrate the breakdown between host site and app web – importantly, note that the “Utilisation targets” list in the host web was manually created outside of the app – purely because I wanted my app to include the scenario of working with data in the host web. In other words, you cannot usually get your app to provision a list in the host web. The only exception to this is if the app has Full Control to the host web, and some CSOM code runs to create this list - see Working with the app web, and why you should for discussion of this scenario. Note you can click on the image below to see a larger version:

 

Provisioning lists, content types, site columns etc. within a SharePoint-hosted app

So the good news here is that there isn’t a huge amount of change if you’ve done these commonplace tasks in SharePoint 2010/Visual Studio 2010. That said, there are a couple of things which can throw you off track if you weren’t expecting them. The main difference of course, is that you’re not creating things in the actual site itself – and in the initial stages it’s tricky to know whether your artifacts are being provisioning successfully.

I’m not going to show the beginning-to-end process of deploying the above artifacts, but let’s look the outline. Depending on how you like to work, you might want to start with things like:

• Rename ‘Feature1’ which was automatically added to your VS project, add a description etc.
• Create some folders in your project if you prefer more structure than the default

Creating fields and content types

I created a TrackedTime content type with 4 fields. For my Projects list I didn’t actually define a custom content type – a simple list purely with a Title field sufficed.

1. Right-click on the project in Solution Explorer, then select Add > New Item…
2. From the Office/SharePoint category, select Site Column and name the item accordingly:
   
    
   
3. Visual Studio will add some default XML for you. To define the 4 fields needed by my TrackedTime content type, I ended up with the following XML – note the lookup to the Projects list which is accomplished purely with declarative XML courtesy of the “List=’Lists/Projects’” on the 3rd field:

      1: <?xml version="1.0" encoding="utf-8"?>

      2: <Elements xmlns="http://schemas.microsoft.com/sharepoint/">

      3:   <Field

      4:        ID="{ac8a5625-8769-4ed5-bfce-5ced1bfda792}"

      5:        Name="TimeTrackingEmployee"

      6:        DisplayName="Employee"

      7:        Type="User"

      8:        List="UserInfo"

      9:        Required="TRUE"

     10:        ShowField="ImnName" 

     11:        UserSelectionMode="PeopleOnly"

     12:        UserSelectionScope="0" 

     13:        Group="COB time-tracking site columns" />

     14:   <Field

     15:        ID="{CA358CA2-ED71-49D9-A05F-51C92B504062}"

     16:        Name="TimeTrackingDate"

     17:        DisplayName="Date"

     18:        Type="DateTime"

     19:        Format="DateOnly"

     20:        Required="TRUE"

     21:        Group="COB time-tracking site columns" />

     22:   <Field

     23:        ID="{ED1B7F0F-CACA-45A1-A0DD-8D0E6E604C5C}"

     24:        Name="TimeTrackingProjectName"

     25:        DisplayName="Project/task"

     26:        Type="Lookup"

     27:        List="Lists/Projects"

     28:        ShowField="Title"

     29:        Required="TRUE"

     30:        Group="COB time-tracking site columns" />

     31:   <Field

     32:        ID="{62D635BE-6481-4E2A-A6B6-4CDA40EAFB00}"

     33:        Name="TimeTrackingDuration"

     34:        DisplayName="Duration (hours)"

     35:        Type="Number"

     36:        Decimals="1"

     37:        Required="TRUE"

     38:        Group="COB time-tracking site columns" />

     39: </Elements>

4. To make a content type using these fields, I then selected Add > New Item… and selected Content Type and named appropriately:
   
   
   
    
5. The next step is to add the fields we created to the content type. Visual Studio 2012 has a cool new Content Type Designer which appears here – simply start typing the name of the field, and VS scans fields from the SharePoint site it is connected to PLUS fields defined in the VS solution:
   
   
   Any fields added here will then be referenced as FieldRef elements in the content type XML behind the designer.
   
   
6. Now we’re ready to provision a list based on this content type/set of fields. The initial steps are the same as you might be used to, but again we have a handy VS designer to help. Firstly we need to do an Add > New Item… and select List, then name appropriately:
   
   
    
7. Now we see the new List Designer – if we wanted to add fields directly to the list rather than add a content type, we could use the main area of the Columns tab, but usually we’ll want to hit the ‘Content Types’ button:
    
8. In here, we can type the name of a content type already in the SharePoint site or within our VS solution:
   
   
   
9. Usually we’d also want to delete the Item and Folder content types, to leave just our custom content type with the fields:
   
   
   
10. The ‘Views’ tab within the list designer can then be used to add any custom views – in my case, I added one called ‘By employee’:
    
     
    N.B.  Unfortunately the designer doesn’t support all the things you might want to do, so in my case I had edit the XML by hand (the horror!) to actually implement the grouping. Still, this is all WAY better than we had before with SharePoint 2010 development.
    
    
11. The final step is to ensure we’re happy with the top-level properties for the list, such as the title and URL. Take note of the URL the list will be provisioned to, you’ll need this soon:
    
     
12. If we’re happy with the list, we can then test our app by hitting F5. When we click through to the app from the Site Contents page, we’ll be back here:
    
    
    At this point, the big question is…

“Where’s my list?!”

Of course, since there’s no default navigation in an app, it’s not immediately obvious if the list has been provisioned or not. However, if you’ve done the right things you’ll find your list is actually there. It’s tempting of course to try typing /_layouts/viewlsts.aspx in the URL bar, but as I mentioned earlier that’s not a page which can be used in an app.

Instead, just paste the URL of the list directly into the browser address bar after the app URL and you should be taken to your newly-provisioned list:

If you do not wish the list to be “hidden” (i.e. you want users to use it as a regular list), your next step will be to think about navigation – and what you’ll add to that default page so that users can get to the list.

Summary

So we now have a list which our app could use to store data. We could either allow end-users to access the list through the UI, use CSOM to read/write to it, or a combination of both. If you’ve created lists, content types etc. from Visual Studio in SharePoint 2010, you should find the process almost exactly the same – the main differences are the new VS designers and the fact that we’re provisioning to the app web.

Next time we’ll look at working with data in the app web.

SharePoint 2013 apps – architecture, capability and UX considerations

UPDATE: this article turned into part 1 of a series on SharePoint apps - here's the table of contents:

1. SharePoint 2013 apps – architecture, capability and UX considerations [this article]
2. Getting started – creating lists, content types, fields etc. within a SharePoint app (provisioning)
3. Working with data in the app web, and why you should
4. Access end-user data (in the host web) from a SharePoint 2013 app
5. Rolling out SharePoint 2013 apps to the enterprise - tenant scope and PowerShell installs
6. Azure is the new SharePoint ‘_layouts’ directory
7. “Host web apps” – provisioning files (e.g. master pages) to the host web
8. “Host web apps” – provisioning fields and content types
9. Deploying SP2013 provider-hosted apps/Remote Event Receivers to Azure Websites (for Office 365 apps)
10. Working with web parts within a SharePoint app

SharePoint 2013 brings the “app” framework and the Office/SharePoint app store - and whenever a new version of SharePoint brings a new development approach, developers often leap on it as some internal challenge which they have to conquer (sometimes at the expense of actual client requirements). Other bloggers have published similar “when to build apps” articles as this one, but I noticed I’d perhaps come at it from a different angle. Specifically, after I had built my first “hello world” SharePoint 2013 app, the internal question I wanted to prepare myself for was:

“Should I develop the feature my client is asking for as an app? The client has no strong opinions on the matter (they do not know the app framework well) and are looking for guidance from me/my company.”

Initially I wanted to focus on the user experience of using a piece of functionality developed as an app. Most folks who have had direct experience of SharePoint users would agree this is definitely a key consideration. So, the last half of this article is dedicated to UX.  However, it’s fair to say that there are potentially bigger aspects to think about too – after all, it might not even be possible to create the desired functionality as an app. So let’s start with app architecture and capability considerations.
One final thing - to frame this discussion, consider that Microsoft say “develop an app where you can” (although their motives may not be the same as you/your client – I’ll come back to this point in the closing summary).
Disclaimer July 31 2012 – SharePoint 2013 is in preview at this stage, so some specifics and user experiences may change slightly between now and release time.

Architecture considerations

Guided by MSDN (see reading list at the end of this article), when considering app development my summarized checklist here would be:

• From the 3 hosting options, which are available to me?
  • SharePoint-hosted – [this one is a given since you have a SharePoint environment]
  • Externally hosted (to the SharePoint farm)
    • Do we have some non-SharePoint servers which could host this app, or could some be created?
    • Assuming resilience is required, is there a load-balancing/failover solution in place?
    • How much effort would be required to give them the same business continuity (DR, backup/restore) as the SharePoint servers?
    • Is capacity planning required around processing power, memory usage, network latency/throughput, disk performance and data storage?
    • If we want do develop in .Net, do they run IIS?
    • If the app(s) need to store data, where would this be?
  • Auto-hosted (SharePoint Online + Azure)
    • Does the client’s web application where the app(s) would be deployed run in SharePoint Online (since Azure auto-hosting is only available to apps deployed to SharePoint Online)?
    • Does the client have an Azure subscription?
    • Has Azure capacity planning been done? Is any more CPU/memory/disk needed for the new app(s)?
    • Can we accurately estimate how much the Azure costs will be each month?
    • Do we have the skills to develop in Azure, or can the devs learn on the project?
• Is a combined app hosting approach appropriate? (e.g. some SharePoint artifacts, and some external to SharePoint)
• Does the selected app hosting model fit with business and I.T. strategy?

With these points in mind, I wonder if purely SharePoint-hosted apps could be easier to achieve than externally-hosted apps for some non-Office 365/SPO clients. I’ve seen some organizations take months to provision servers, so even in this virtualized world standing up some .Net servers to support a SharePoint app might not be the easiest thing. But, SharePoint-hosted apps do not have the same capability as apps with an external component, so let’s think about that for a second..

Capability considerations

The key question here is:- can the functionality be built using the app hosting options I have available to me? Consider the following:

• An app cannot have any server-side SharePoint code – all code must use client APIs such as CSOM, the REST API and web services
• By default, any SharePoint artifacts provisioned (lists, web parts, content types, site columns, master pages, content pages, other files) do not get provisioned in the site end user browses –  rather, they get created in a special “app web” on a special URL which is isolated from the original SharePoint web. This could be particularly relevant if, for example, if there needed to be some kind of aggregation or link between user content and content related to the app.
• Unless the app requests special permissions (which must be agreed to at install time), an app does not have permission to talk to the parent site or site collection – furthermore, there is no permission possible which allows the client APIs talk to the parent web application or farm. [See Working with the app web, and why you should for more info on these points.]
• Deep changes to the user site are not possible with an app – site definitions, branding, themes, most types of ribbon customization or link changes which would require a CustomAction are examples
• Timer jobs are not possible within an app – within a SharePoint-hosted app, it’s difficult to see how any “scheduled processing” could ever be implemented. This is a key difference to an Azure or externally-hosted app (or single app component), which could either use the Azure Service Bus or even a scheduled task on a non-SharePoint server which calls into SharePoint using a client API
• Custom field types are not possible within an app

User experience considerations

• How will users obtain the app?
  • Will it be rolled out to all/selected sites automatically?
  • Will site owners/users with Full Control be responsible for obtaining the app from the App Catalog? (for this discussion we’ll assume the app will not be pushed to the public store)
• For apps not automatically rolled out, could the app’s trust/capability requirements alarm some site owners and cause them to cancel app installation? (see later screenshots). If we haven’t educated them about this process, could it result in helpdesk calls?
• Which of the user experience options will the app make use of?
  • Navigation to separate SharePoint app web?
  • Navigation to external site which uses the chrome control? (note that this is only applicable if any app UI components are hosted externally to SharePoint)
  • App parts (ClientWebPart) which use an IFrame to bring app content into the host web ?
  • Navigation through a list item’s dropdown (Edit Control Block [ECB]) links, ribbon customizations
• Does the separation of app and other site content work?
  • Could users be confused that (e.g.) a document library provisioned by your app cannot be found next to their other document libraries? (Remember that to find the app’s document library, they have to “enter” the app and be taken to the separate app web which contains it’s data/artifacts.)

With the above points in mind, let’s take a look at the user experience for site owners and end users.

The site owner experience – adding a SharePoint app

Apps can only be added by users with Full Control permission to the site (typically site owners only), so this process only applies to them. We’ll show obtaining an app from the App Catalog here, but remember site owners may also be able to purchase from the public store, if so configured.

1. A site owner would navigate to the app “area” (‘Your Apps’) which shows apps published to the App Catalog and has a link to the public SharePoint Store. A site owner can get there either by using the link on the Site Actions menu:
   
   
   ..or the link in the Site Contents page:
   
   
2. In ‘Your Apps’, the site owner would then find an app..
   
    
3. .. and optionally click the ‘App Details’ link to see more about the app. As you might expect, this page has some blurb from the publisher and some screenshots of the app in action:
   
    
4. If the site owner is happy with this, they can click the ‘Add it’ button – at this point, they are presented with some permission requirements the app has. This could be to SharePoint content such as lists/libraries, but also other items such as calling into a service application. Remember that an app can run with different permission levels than the actual person using it (e.g. an app could be allowed to delete documents where the user cannot directly), and this step ensures someone responsible for the site grants the required access. This is known as an app permission request.
   
   
   
   (As a sidenote, it will be more normal to see an app requesting to work with a specific list, rather than the site owner selecting a list from a dropdown – the image above shows the result of me specifying that the app requires ‘Manage list’ rights, but not specifying a particular list that this applies to).
   
5. If the permission request is granted, then the app is added to the site and is then accessible from the ‘Site Contents’ area:
   
   

At this point, the app is now usable by regular site users.

The end-user experience – using an app

Actually you just saw it. For ‘full page’ apps, users will access apps from the ‘Site Contents’ area as shown in the last image. Here they can also find other apps, lists, document libraries and so on. When the app icon is clicked, the user will be redirected to the start page for the app (as defined in the ‘StartPage’ property in AppManifest.xml). In the SharePoint-hosted example I showed in my last post, this could be a page provisioned to the app web:
 
Regardless of where the user goes within the app, the header maintains a simple breadcrumb link back to the host web (where the app was accessed from).
Note that apps can also be surfaced in other ways than the full page model – if a web part is effectively all that’s needed, then SharePoint 2013 provides ‘app parts’ (aka ClientWebPart) which is an IFrame-wrapper to bring the UI of an app into the host web. In the case of a SharePoint-hosted app, this could be a page provisioned into the app web (as shown above), or if the app has external components it could be a page hosted on some external servers.

The site owner experience – adding from the public SharePoint Store

In case you’re wondering, the experience of using the public app store is not hugely dissimilar to using the internal App Catalog. Some bits are not live yet (e.g. the financial transaction bit), but effectively there’s a big categorized list of apps to pick from:

The site owner experience – where app feature/capability requirements are not met

Regardless of where the app comes from, in addition to permission requests (which the site owner must acknowledge when trusting the app during installation), apps can also specify prerequisites in terms of SharePoint features. After all, if an app is dependent on say, the SharePoint 2013 social features, it would clearly fall over in a heap if that service isn’t available in an environment where the app is being installed. So, the app framework does not allow installation of an app if these prerequisites are not met – the site owner will see a message stating that the app cannot be added:

In this scenario, the ‘app details’ page lists the reasons why the app cannot be added:


The important thing here though is that there is no magic - SharePoint is not doing some inspection of every line of code behind the app to work out what it needs. Instead, it’s up to the app developer to specify all prerequisites (including permissions requests) before the app is packaged – this info goes into the AppManifest.xml file, but there is a handy designer in Visual Studio 2013:

Other user experiences e.g. SharePoint administrator

In addition to the site owner ‘app install’ experience and the end-user ‘app usage’ experience, there are other stakeholders to consider too. Administrators will want to know things like:

• Which apps are in use where
• If any apps are currently experiencing problems
• Which apps in the public SharePoint Store are the top requested apps – this applies in the scenario where site owners are not allowed to directly obtain apps from the public SharePoint store, but are allowed to log an ‘app request’

A series of screens in Central Administration supports these administrator needs, but I’ll save that for another post.

Summary

The SharePoint 2013 app framework is a fairly radical departure in the world of SharePoint development, and when formulating SharePoint strategy it’s important to understand when apps are appropriate and when they are not. A piece of functionality can now effectively be rolled out to SharePoint in three different ways:

• Farm solution
• Sandboxed solution
• SharePoint app (which as discussed above, could be a purely SharePoint-hosted app, an app hosted on non-SharePoint hardware [possibly by a vendor] or an Azure auto-provisioned app – my intro post also has more details)

Microsoft guidance says “develop an app wherever you can”, but consider that they may not have the same goals as your project/environment. Personally, I buy into the idea that a key MS driver for apps was to reduce SharePoint upgrade complexity and therefore maintain the license income stream. If you have evaluated your development/customization strategy and are of the view that upgrade to whatever the next version of SharePoint will be is entirely manageable, then I wouldn’t necessarily conclude that apps are in any way mandatory.
In that case, the question might then be “do the semantics and user experience of the app model give me something over and above other customization approaches?”. Some examples of this could be the App Catalog experience, or perhaps keeping in line with the way other customizations have been developed – either way, there might be fewer things to consider if you aren’t constrained by upgrade/architecture concerns.

Further reading

• MSDN: Apps for SharePoint compared with SharePoint solutions
• MSDN: Hosting options for apps for SharePoint
• MSDN: Apps for SharePoint UX design guidelines