{
  "id": "CB-M365-COLLAB-022",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-022",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-022.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-022.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-022",
    "title": "Require approval before Teams apps are available to users",
    "finding": {
      "title": "Users can install Teams apps that nobody approved",
      "description": "Third-party and custom apps can be added to chats, teams and meetings and receive access to their content without review."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "third-party-apps",
      "app-governance"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Teams apps are available to users only after the organization approves them:\n\n- third-party apps and custom apps are not available by default; each approved app is made available\n  individually (to everyone or to specific users or groups);\n- Microsoft apps that the organization has not approved are blocked;\n- uploading custom app packages (sideloading) is off in app setup policies, except for developers in\n  a dedicated policy;\n- users can request an app, and requests reach an administrator.\n\nThe tenant uses app-centric management (**Manage apps** with per-app availability). Tenants still on\napp permission policies apply the same rule through the Global and custom permission policies.\n",
    "rationale": "Teams apps receive tokens and resource-specific consent to read messages, files and meeting content,\nand can push messages and links to users. An unvetted app is a supply chain and data exposure risk,\nand malicious or compromised publishers have used app integrations to reach users. An approval step\nlets the organization review publisher, permissions and data handling first.\n",
    "impact": "Users must request apps instead of adding them, and someone must process requests. Apps already\ninstalled but no longer available stop working for users. Developers need a custom setup policy to\ntest their own packages.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Teams apps** > **Manage apps** > **Actions** > **Org-wide app settings**. Check that\n   **Third-party apps** and **Custom apps** are not available by default and that user requests are\n   enabled.\n3. In **Manage apps**, filter on third-party and custom apps with availability **Everyone** or\n   **Specific users or groups** and check each against the approved app list. Do the same for\n   Microsoft apps that should be blocked.\n4. Browse to **Teams apps** > **Setup policies** and check that **Upload custom apps** is **Off** in\n   the Global policy and in every policy except the developer one.\n5. With Microsoft Teams PowerShell:\n   `Get-CsTeamsAppSetupPolicy | Select-Object Identity, AllowSideLoading` and, on tenants using\n   permission policies, `Get-CsTeamsAppPermissionPolicy`.\n6. Fail if third-party or custom apps are available by default, if an unapproved app is available,\n   or if custom app upload is on for all users.\n"
    },
    "remediation": {
      "manual": "1. Export the current app list and usage (**Manage apps** > **Export**, Teams app usage report) and\n   have each app in use approved or retired.\n2. In **Teams apps** > **Manage apps** > **Actions** > **Org-wide app settings**, turn off default\n   availability for **Third-party apps** and **Custom apps**, enable user requests, and **Save**.\n   Role: Teams Administrator.\n3. For each approved app, select it and **Edit availability** to **Everyone** or **Specific users or\n   groups**. Set unapproved Microsoft apps to **No one**.\n4. In **Teams apps** > **Setup policies** > **Global (Org-wide default)**, turn off **Upload custom\n   apps**; create a separate policy for developers. PowerShell equivalent:\n   `Set-CsTeamsAppSetupPolicy -Identity Global -AllowSideLoading $false`.\n"
    },
    "references": [
      {
        "title": "Manage apps in the Microsoft Teams admin center",
        "url": "https://learn.microsoft.com/microsoftteams/manage-apps",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage access to apps using app-centric management",
        "url": "https://learn.microsoft.com/microsoftteams/app-centric-management",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsAppSetupPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsappsetuppolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.5.1v2",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.5.2v2",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.5.3v2",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7(5)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1195"
      },
      {
        "framework": "mitre-attack",
        "id": "T1528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}