Managing Microsoft Teams App Permissions: Blocking, Allowing, and Controlling Access
Managing which apps users can install or access in Microsoft Teams is an important part of maintaining security and compliance. As an administrator, you may need to restrict certain apps while allowing others—especially when dealing with third-party integrations or sensitive data.
In this post, we’ll walk through a scenario using Microsoft Teams Org-wide app settings, App permission policies, and App setup policies. We’ll also explain how these affect what users can actually do inside Teams.
Org-wide App Settings
In the Org-wide app settings, administrators can:
- Control third-party apps – In our scenario, third-party apps are blocked.
- Allow custom apps – Users can interact with custom apps, such as internal tools developed and uploaded by the organization.
- Block specific apps – Microsoft Planner is explicitly listed in the blocked apps list.
This means that even if Planner is a Microsoft app, it won’t be available to end users because it was intentionally blocked.
Global App Permission Policy
The global app permission policy defines what categories of apps are available to users:
- Microsoft apps: Allowed
- Third-party apps: Blocked
- Tenant apps (custom apps): Allowed
This aligns with the Org-wide settings—users can access Microsoft and custom apps, but not third-party apps.
Global App Setup Policy
The setup policy defines which apps are pinned by default in Teams for all users. In our case, the pinned apps include core Microsoft apps like:
- Activity
- Chat
- Teams
- Calendar
- Calls
- Files
No additional apps are pinned here.
What This Means for Users
Based on these settings, here’s what users can and cannot do:
- Can team members upload apps from the Teams client?
- No. Uploading apps is blocked at the org level.
- Can all team members add the Microsoft Flow app to a team?
- Yes. Flow (Power Automate) is a Microsoft app, and Microsoft apps are allowed.
- Can all team members add the Microsoft Planner app to a team?
- No. Planner is a Microsoft app, but it was explicitly blocked in the Org-wide settings.
Key Takeaways
- Org-wide app settings take priority for blocking or allowing apps.
- App permission policies let you manage categories (Microsoft, third-party, custom).
- App setup policies determine what apps are pre-pinned for users.
- Blocking an app in Org-wide settings (like Planner in this example) overrides its default availability, even if it’s a Microsoft app.
This layered approach gives administrators flexibility: you can allow Microsoft apps broadly but block specific ones that don’t fit your organizational policies.
