If the applications App_Data directory already exists, the web server account only requires read and write access to the ...

If the applications App_Data directory already exists, the web server account only requires read and write access to the applications App_Data directory.  This is necessary because the web server account will attempt to verify that the Sql Server Express database already exists within the applications App_Data directory.  Revoking read access on the App_Data directory from the web server account will prevent the provider from correctly determining if the Sql Server Express database already exists.  This will cause an error when the provider attempts to create a duplicate of an already existing database.  Write access is required because the web server accounts credentials are used when creating the new database.