Apps must be supported in Office 365 and in on-premises farms.
App code never runs within the SharePoint host environment.
App code programs against SharePoint sites by using web service entry points to minimize version-specific dependencies.
App code is authenticated and runs under a distinct identity.
App permissions can be configured independently of user permissions.
Apps are deployed by using a publishing scheme based on app catalogs.
Apps that are published in a catalog are easier to discover, install, and upgrade.