What this check looks at
Checks the Teams app permission policies: whether third-party and custom apps are limited to an approved list, rather than every app allowed unless blocked.
Teams app permission policies decide which apps people can add to chats, meetings and teams, in three groups: Microsoft apps, third-party apps from the Teams store, and custom apps built for or uploaded to your organisation. For each group a policy can allow all apps, allow only specific apps, block specific apps and allow the rest, or block all. Microsoft’s Global (Org-wide default) policy allows every app in all three groups.
The check reads the app permission policies. It fails when the Global policy leaves third-party or custom apps open, that is set to block specific apps and allow all others (BlockedAppList). It warns when Global is limited but a custom app permission policy still leaves them open, naming those policies. Microsoft apps are not tested. Tenants moved to app-centric management also set each app’s availability in Manage apps, which an application cannot read, so the check sees only the permission policies.
An app added to a team can be given access to the team’s messages, files and members, and a bot receives what is posted where it is installed. With third-party apps open, anyone can add an app from any publisher, and with it a flow of business data to a company nobody has assessed. Custom apps can be anything at all, including one built to look like an internal tool.
Why it matters
A Teams app can read the chats and files of the teams it is added to. With every third-party and custom app allowed, anyone can add one, and with it a data flow to a vendor nobody reviewed.
A typical case: a project team adds a free meeting-notes bot from the store to its channel. It records and transcribes every call and keeps the text on the vendor’s servers abroad. Nobody read the vendor’s terms or checked where the data goes, and when a client asks whether their information has been shared with any third party, the honest answer is that nobody knows.
That is a UK GDPR problem as much as a security one: a new processor of personal data needs a contract and an assessment, and the ICO expects a controller to know who processes its data. It is also the kind of supplier risk NCSC’s supply chain guidance asks businesses to manage.
CIS Microsoft 365 Foundations Benchmark 8.4.1 asks for app permission policies to be configured, and CISA SCuBA MS.TEAMS.5.2v2 and MS.TEAMS.5.3v2 ask that only approved third-party and custom apps can be installed. An allow list keeps the useful apps and stops the unknown ones.
How to fix it
Where: Teams admin centre → Teams apps → Permission policies
Before you start
- Export the apps in use (Teams admin centre → Teams apps → Manage apps, sorted by users) and agree with each owner which are approved.
- Add the approved third-party and custom apps to the allow list before switching it on.
Step by step
- See which apps are in use. In the Teams admin centre, go to Analytics & reports > Usage reports and run the Apps usage report for the last 90 days. Also open Teams apps > Manage apps and filter on third-party and custom apps. Note each app with active users and who uses it.
- Agree the approved list. Go through the list with the business: keep apps with a clear owner and purpose, and check each third-party vendor’s data handling for anything that reads chats or files. Everything else is left off the list.
- Limit third-party and custom apps in the Global policy. In the Teams admin centre, go to Teams apps > Permission policies and select Global (Org-wide default). Under Third-party apps, choose "Allow specific apps and block all others", select Allow apps and add each approved app. Under Custom apps, do the same, or choose "Block all apps" if none is approved. Leave Microsoft apps as they are and select Save.
- Fix each custom permission policy. Open each custom app permission policy named in the evidence and make the same change, or, if it is no longer needed, remove it from the people it is assigned to (Users > Manage users > the user > Policies) and delete it.
- Set availability too if the tenant uses app-centric management. If Teams apps shows that your organisation uses app-centric management, open Teams apps > Manage apps, and for each third-party and custom app that is not approved, edit its availability to No one. Under Actions > Org-wide app settings, stop new third-party apps from becoming available to everyone automatically where the option is offered.
- Confirm the change. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsAppPermissionPolicy | Select-Object Identity, GlobalCatalogAppsType, PrivateCatalogAppsType: Global and every custom policy should show AllowedAppList for both. Signed in as an ordinary user, an app that is not on the list shows as blocked by your admin in the Teams store.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsAppPermissionPolicy -Identity Global -GlobalCatalogAppsType AllowedAppList -PrivateCatalogAppsType AllowedAppList
What users will notice
People can only add the apps on the allow list. Apps already added that are not on it stop being available to them.
How to confirm it worked
Get-CsTeamsAppPermissionPolicy | Select-Object Identity, GlobalCatalogAppsType, PrivateCatalogAppsType shows AllowedAppList (or BlockAllApps) for every policy.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB4.b Secure configuration |
| DSPT | Standard 10: Accountable suppliers |
| DORA | Art. 28 Management of ICT third-party risk |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| NIST SP 800-171 | 3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | CM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.5.19 Information security in supplier relationshipsA.8.9 Configuration management |
| CISA SCuBA | MS.TEAMS.5.2v2 Only approved third-party apps can be installedMS.TEAMS.5.3v2 Only approved custom apps can be installed |
| CIS M365 | 8.4.1 Ensure app permission policies are configured |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configurationSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage app permission policies in Teams (Microsoft Learn)