Slack admins can approve an app for the whole organization after reviewing its scopes, or restrict it so it cannot be installed anywhere. Restricting does not remove existing installs. Per Slack's help page, these org level controls are available only on Enterprise subscriptions, so smaller plans rely on workspace level settings.
Who can do this
Org owners, org admins and members with the integrations admin role manage apps from the Integrations section of the admin dashboard. Slack states this is only available on Enterprise subscriptions. Check your plan before building a process around it.
Approve, restrict, or let workspaces decide
- Approve: the app can then be added to any workspace. You can undo this by unapproving it.
- Restrict: the app cannot be installed in any workspace in the org. Restricting does not uninstall existing copies. A workspace owner or app manager must remove them.
- Set by workspace: individual workspace owners approve or restrict the app instead.
The third option is convenient and also the weakest. Use it for low risk apps only.
Install centrally
Admins can install an app at the org level and then add it to chosen workspaces, or make it a default for future workspaces. One detail deserves attention: apps using the admin, Discovery or SCIM APIs can access org data once installed at org level, even without being added to any workspace. Review those with extra care.
Who can use an app and where
On an app's Member Permissions tab you can set who may interact with it: everyone, no one, or chosen people and groups, including identity provider groups. Slack notes channel controls, which limit where an app appears, are rolling out gradually.
Scope changes
If a developer changes an approved or restricted app's scopes, members must request it again. You can approve or restrict the new scopes from the notification or the Requests tab. Restricting the new scopes leaves the existing version usable and blocks the updated one.
Reviewing what is installed
The Installed apps view shows where each app is installed, its source (Slack Marketplace, Internal or Distributed), its access level (Organization or Workspace) and its status. You can export the list as CSV. Apps installed only at workspace level cannot be removed from the admin dashboard.
A review routine
- Export the installed apps list monthly.
- Compare scopes to what the app's job needs.
- Restrict anything unowned.
- Ask each owner to confirm they still use it.
Safeguard's asset discovery can sit alongside that export as a wider inventory of SaaS you have to track.
Quick check
If I restrict an app, is it removed from workspaces?
No. A workspace owner or app manager must remove existing installations.
Is this available on every Slack plan?
Slack's page says it is available only on Enterprise subscriptions.
Sources
Last reviewed: 19 October 2026.
