Require approval before Teams apps are available to users

Description

Teams apps are available to users only after the organization approves them:

• third-party apps and custom apps are not available by default; each approved app is made available individually (to everyone or to specific users or groups);
• Microsoft apps that the organization has not approved are blocked;
• uploading custom app packages (sideloading) is off in app setup policies, except for developers in a dedicated policy;
• users can request an app, and requests reach an administrator.

The tenant uses app-centric management (Manage apps with per-app availability). Tenants still on app permission policies apply the same rule through the Global and custom permission policies.

Rationale

Teams apps receive tokens and resource-specific consent to read messages, files and meeting content, and can push messages and links to users. An unvetted app is a supply chain and data exposure risk, and malicious or compromised publishers have used app integrations to reach users. An approval step lets the organization review publisher, permissions and data handling first.

Impact

Users must request apps instead of adding them, and someone must process requests. Apps already installed but no longer available stop working for users. Developers need a custom setup policy to test their own packages.

Applies when

Requires: Microsoft Teams

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Teams apps > Manage apps > Actions > Org-wide app settings. Check that Third-party apps and Custom apps are not available by default and that user requests are enabled.
3. In Manage apps, filter on third-party and custom apps with availability Everyone or Specific users or groups and check each against the approved app list. Do the same for Microsoft apps that should be blocked.
4. Browse to Teams apps > Setup policies and check that Upload custom apps is Off in the Global policy and in every policy except the developer one.
5. With Microsoft Teams PowerShell: Get-CsTeamsAppSetupPolicy | Select-Object Identity, AllowSideLoading and, on tenants using permission policies, Get-CsTeamsAppPermissionPolicy.
6. Fail if third-party or custom apps are available by default, if an unapproved app is available, or if custom app upload is on for all users.

Remediation

1. Export the current app list and usage (Manage apps > Export, Teams app usage report) and have each app in use approved or retired.
2. In Teams apps > Manage apps > Actions > Org-wide app settings, turn off default availability for Third-party apps and Custom apps, enable user requests, and Save. Role: Teams Administrator.
3. For each approved app, select it and Edit availability to Everyone or Specific users or groups. Set unapproved Microsoft apps to No one.
4. In Teams apps > Setup policies > Global (Org-wide default), turn off Upload custom apps; create a separate policy for developers. PowerShell equivalent: Set-CsTeamsAppSetupPolicy -Identity Global -AllowSideLoading $false.

References

• Manage apps in the Microsoft Teams admin center Microsoft, vendor-doc, accessed 2026-10-24
• Manage access to apps using app-centric management Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsAppSetupPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-002 Restrict user consent to applications

People and lifecycle