In the Teams admin center you control third-party apps at three levels: org-wide settings for all third-party and custom apps, per-app allow or block on the Manage apps page, and app permission policies that decide which users and groups can use which apps. Start with a deny-by-default posture and allow apps one by one.
The three layers
Microsoft's documentation describes these controls on the Manage apps page.
- Org-wide app settings. Under Actions, Org-wide app settings has one control for Microsoft apps, one for third-party apps and one for custom apps. The third-party control manages the bulk availability of both new and existing third-party apps. The documentation says changes take effect after a few hours.
- Per-app allow and block. You can review an app before allowing it, find its support information and control availability across the organization.
- Access by user or group. You can limit an app to specific users and groups. Supported group types include security groups, Microsoft 365 groups, dynamic membership groups, nested groups and distribution lists. Guest users cannot access the app, even if assigned.
You also decide whether users can install apps themselves or whether admins preinstall them for some or all users.
A sensible order of operations
| Step | Action | Why |
|---|---|---|
| 1 | Turn off bulk availability for third-party apps | New apps stop appearing by default |
| 2 | Review what is already installed using the usage report | You see which apps people actually use |
| 3 | Allow apps individually after review | Each approval has a reason |
| 4 | Scope each app to the groups that need it | Narrower exposure |
| 5 | Decide the policy for custom apps | Internal apps still need an owner |
| 6 | Revisit quarterly | Approvals go stale |
The usage report in step 2 is listed in the documentation as a way to see which apps are in use and how many users are active.
What to check before you allow an app
Use the Security and Compliance tab on the app's details page. It shows certification status and publisher attestation. Our post on Microsoft 365 Certified versus publisher attested apps explains how to weigh those.
Then ask three questions:
- What data can the app read in channels, chats and files?
- Where does that data go?
- Who in your company owns the relationship with the vendor?
Guests and external meetings
The documentation notes that users can add apps in meetings and chats with guests, and use apps shared by guests when they join externally hosted meetings. The data policies of the hosting user's organization apply. If your people join meetings hosted elsewhere, be aware that app behavior there follows the host's rules, not yours.
Government clouds
For Microsoft 365 Government GCC, GCCH and DoD deployments, the documentation says all third-party apps are blocked by default. If you run in one of those clouds, your starting point is already deny.
Keep a record
Record each allow decision with the approver, date, scope and evidence reviewed. Auditors tend to ask how you decide which third-party tools get access to company data. A simple register answers it. See how to answer how you manage third-party integrations.
Safeguard focuses on the software you build and ship, including asset discovery and dependency scanning. It does not manage Teams for you, but the same approval discipline applies to the packages and plugins your developers pull in.
Quick check
Can guests use an app that I allow for a group?
The documentation says guest users cannot access the app even if they are assigned to it.
How fast do org-wide app settings change take effect?
Microsoft's documentation says settings take effect after a few hours, so plan changes accordingly.
Sources
Last reviewed: 19 October 2026.
