A common IT-admin question. To display files straight from SharePoint and Teams, an app needs delegated read access to those files. Nothing is transferred outside your tenant. Here is what each requested scope does and why. Ask below if your organization requires admin consent.