Skip to main content
Version: 3.0.0-preview

CIS.M365.8.4.1 - (L1) Ensure app permission policies are configured

Henrik PiechaMerill FernandoMarco Janse-Mynster
Contributed by Henrik Piecha with 3 co-contributorsAll contributors →

Overview​

8.4.1 (L1) Ensure app permission policies are configured

This policy setting controls which class of apps are available for users to install.

Rationale​

Allowing users to install third-party or unverified apps poses a potential risk of introducing malicious software to the environment.

Impact​

Users will only be able to install approved classes of apps.

Remediation action​

  1. Navigate to Microsoft Teams Admin Center.
  2. Click to expand Teams apps, then select Permission policies.
  3. Select the Global (Org-wide default) policy.
  4. Under Third-party apps, set to Block all apps (or Allow specific apps and block all others).
  5. Under Custom apps, set to Block all apps (or Allow specific apps and block all others).
  6. Click Save.
PowerShell​
  1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
  2. Run the following command to block all third-party and custom apps:
Set-CsTeamsAppPermissionPolicy -Identity Global -GlobalCatalogAppsType AllowedAppList -GlobalCatalogApps @() -PrivateCatalogAppsType AllowedAppList -PrivateCatalogApps @()

Test Metadata​

FieldValue
Test IDCIS.M365.8.4.1
SeverityMedium
SuiteCIS
ProductTeams
FeatureApps
AreaApplications and workload identities
Resource typeTenant
User impactMedium
Implementation costMedium
MITRE ATT&CKT1195 Supply Chain Compromise, T1671 Cloud Application Integration
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.4.1
Benchmark levelL1
Benchmark profilesE3 Level 1
Supports controlscis-m365:8.4.1, nist-800-53-r5:CM-7
PowerShell testTest-MtCisThirdPartyAndCustomApps
ServicesTeams

Source​