Prevent users from adding apps from the SharePoint Store

Description

Users cannot get apps from the SharePoint Store (the public marketplace reachable from a site). The Baseline security mode setting Disable Access to Microsoft Store for SharePoint is on, which corresponds to DisableSharePointStoreAccess = True; in the classic store settings, App Purchases is No. Users can still browse the store and request an app; requests land in the App Requests list of the apps site, where an administrator decides.

Rationale

Store apps run with permissions granted on the site where they are added, and their publishers are outside the organization's supplier review. Letting site owners install them bypasses the application governance applied to Entra consent and Teams apps. Routing apps through requests keeps one decision point.

Impact

Site owners must request apps instead of installing them. Apps already installed keep working; review them in the apps site.

Setting

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader.
2. Browse to Settings > Org settings > Security and Privacy > Baseline Security Mode and check that Disable Access to Microsoft Store for SharePoint is on.
3. Alternatively, in the SharePoint admin center open More features > Apps > Open > Configure store settings and check that App Purchases is No.
4. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object DisableSharePointStoreAccess must return True.
5. Fail if users can get apps from the SharePoint Store.

Remediation

1. List apps already added from the store (apps site, Apps for SharePoint and App Requests) and decide which to keep.
2. In the Microsoft 365 admin center, browse to Settings > Org settings > Security and Privacy > Baseline Security Mode and turn on Disable Access to Microsoft Store for SharePoint. Role: SharePoint Administrator.
3. PowerShell equivalent: Set-SPOTenant -DisableSharePointStoreAccess $true. In the classic store settings, set App Purchases to No.
4. Assign someone to process the App Requests list.

References

• Configure settings for the SharePoint Store Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-013 Block new custom scripts on SharePoint and OneDrive sites

People and lifecycle