CIS.M365.8.4.1 - (L1) Ensure app permission policies are configured

+1

Contributed by Henrik Piecha with 6 co-contributorsAll contributors →

Overview

8.4.1 (L1) Ensure app permission policies are configured

This policy setting controls which class of apps are available for users to install.

Rationale

Allowing users to install third-party or unverified apps poses a potential risk of introducing malicious software to the environment.

Impact

Users will only be able to install approved classes of apps.

Remediation action

1. Navigate to Microsoft Teams Admin Center.
2. Click to expand Teams apps, then select Permission policies.
3. Select the Global (Org-wide default) policy.
4. Under Third-party apps, set to Block all apps (or Allow specific apps and block all others).
5. Under Custom apps, set to Block all apps (or Allow specific apps and block all others).
6. Click Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command to block all third-party and custom apps:

Set-CsTeamsAppPermissionPolicy -Identity Global -GlobalCatalogAppsType AllowedAppList -GlobalCatalogApps @() -PrivateCatalogAppsType AllowedAppList -PrivateCatalogApps @()

Related links

• Microsoft Teams Admin Center.
• Manage app permission policies in Microsoft Teams
• Set-CsTeamsAppPermissionPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 526

Test Metadata

Field	Value
Test ID	CIS.M365.8.4.1
Severity	High
Suite	CIS
Category	CIS E3 Level 1
PowerShell test	Test-MtCisThirdPartyAndCustomApps
Tags	CIS, CIS E3 Level 1, CIS M365 v7.0.0, CIS.M365.8.4.1

Source

• Pester test: tests/cis/Test-MtCisThirdPartyAndCustomApps.Tests.ps1
• PowerShell source: powershell/public/cis/Test-MtCisThirdPartyAndCustomApps.ps1