M365TEAMS-007: App permission policies
- Platform
- Entra ID / M365
- Category
- Microsoft Teams Security
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Teams app permission policies control which third-party and custom applications can be installed and used within the Teams environment. Unrestricted app installation allows users to add third-party applications that may request excessive permissions, access corporate data, or introduce security vulnerabilities. App governance policies must balance user productivity with security by curating the available application catalog.
Recommended value
Third-party apps restricted to an approved list; custom app uploads restricted to authorized developers; app permission requests reviewed by administrators
Remediation
Configure the Teams app permission policy to block all third-party apps by default and selectively allow only approved applications that have been vetted by the security team. Restrict custom app sideloading to authorized developers and require all custom apps to go through an approval process before publication. Review the list of currently installed third-party apps, remove any that are unapproved or no longer needed, and audit the permissions each app has been granted.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.TEAMS.5.1v2, MS.TEAMS.5.2v2, MS.TEAMS.5.3v2
- NIST SP 800-53
- CM-7
- CIS M365 Benchmark
- 8.6.1, 8.4.1