Overview of app management and governance in Teams admin center
You manage apps for your organization in Teams apps page in the Teams admin center portal. Use the Manage apps page to view and manage all Teams apps in your organization's app catalog, cater to prominent use cases for app management, define access to apps using policies, and more.
To manage apps, you use policies to control permissions for users, installation of apps, and upload of custom apps created within your organization. To understand policies, see Overview of app policies.
To use Teams admin center, you must have a Global Admin or Teams Administrator role. For details, see Teams administrator roles and Microsoft 365 administrator roles.
Note
The Manage apps page isn't available in Microsoft 365 Government Community Cloud High (GCCH) or Department of Defense (DoD) deployments of Teams.
App management use cases and the available interfaces
The options to accomplish most of app management use cases are available in Teams admin center. In addition, some options are available in other portals or different pages in the Teams admin center.
App management tasks that are supported in admin center are in the table below.
| App management use cases | Link to the interface | Documentation |
|---|---|---|
| Control which apps are available to users in your organization by allowing and blocking apps. You can also upload and approve custom apps. After managing apps on this page, you can use app permission and app setup policies to configure what apps are available for specific users in your organization's app store. | Manage apps in Teams admin center | Current article |
| App permission policies control what apps you want to make available to Teams users in your organization. You can use the Global (Org-wide) default policy and customize it, or you can create one or more policies to meet the needs of your organization. | Permission policies | Manage app permission policies |
| App setup policies control how apps are made available to a user with the Teams app. Use the Global (Org-wide default) policy and customize it or create custom policies and assign them to a set of users. | Setup policies | Manage app setup policies |
| You can develop and upload custom apps as app packages and make them available in your organization's app store. | Org-wide app settings in Manage apps | Manage policy setting for custom apps |
| You can customize the Teams app store with your organization's logo, custom background, or color. | Customize store | Customize your organization's app store |
| The Teams app usage report provides information about which apps in use, active users, and other app usage information. | Usage reports | Teams app usage report |
| Your users can add apps when they host meetings or chats with guests. They can also use apps shared by guests when they join meetings or chats hosted externally. The data policies of the hosting user's organization, and the data sharing practices of any third-party apps shared by that user's organization, are applied. | External access | App behavior depending on types of users |
| With guest access, you can provide access to applications and other Teams functionality to people outside your organization, while maintaining control over your corporate data. | Guest access | Guest access in Teams |
| Teams update policies are used to manage Teams and Office preview users who can see prerelease or preview features in the Teams app. | Teams update policies | Teams public preview |
App management tasks that are supported on other portals are in the table below.
| App management use cases | Link to the interface | Documentation |
|---|---|---|
| Manage licenses and subscriptions of third-party apps in Microsoft 365 admin center | Microsoft 365 admin center | Manage third-party app subscriptions |
| Audit Teams app events on Microsoft Purview compliance portal. | Audit | Teams activities |
| Applications can be granted permissions to your organization and its data by three methods: an admin consents to the application for all users, a user grants consent to the application, or an admin integrating an application and enabling self-service access or assigning users directly to the application. Verify the Graph permissions for apps. Verify the permissions that users provided or that the admins delegated. | Azure AD portal | Review permissions granted to applications |
Allow and block apps
As an admin, you control access to all types of apps that are used across all context by all your users. Teams provides granular controls to configure access for each app and for each user.
To allow an app, all the following settings must be done. To block an app, block it via any one of the following settings.
- Org-wide app settings: Use this setting to allow use of third-party apps in your org. You control the specific apps that are allowed and used.
- Allow an individual app: Use this setting to allow a specific app in your org. You control which users can use a specific app and which users can use apps.
- App permission policy: Use policies to allow all or allow specific users to use an app. You decide access on a per-user and per-app basis.
The Manage apps page is where you allow or block individual apps at the org level. The page displays all the available app and their current org-level app status. To allow or block an app, follow these steps:
- Sign in to the Teams admin center and access Teams apps > Manage apps.
- Select Org-wide app settings and allow the use of third-party apps.
- On the Manage apps page, locate an app and select it.
- Select Allow or Block option.
To allow an app for specific users, see app permission policies.
When a developer publishes an app to the Teams store, some apps may need an admin to configure the app. Before an admin allows such an app, it shows as Blocked by publisher in the admin center. After following the publisher's guidance to set up the app, you can make it available to users by allowing it.
Manage org-wide app settings
Use org-wide app settings to control whether users with an F license get the tailored frontline app experience, whether users can install third-party apps, and whether users can upload or interact with custom apps in your organization.
Note
To learn how to use org-wide app settings in Microsoft 365 Government - Government Community Cloud High GCCH and Department of Defense (DoD) deployments of Teams, see Manage app permission policies in Teams.
On Manage apps page, select Org-wide app settings. You can then configure the settings you want in the pane.
Under Tailored apps, turn off or turn on Show tailored apps. When this setting is on, users with an F license get the tailored frontline app experience. This experience pins the most relevant apps in Teams for frontline workers. To learn more, see Tailor Teams apps for your frontline workers.
This feature is available for F licenses. Other license types will be supported in the future.
Under Third-party apps, turn off or turn on these settings to control access to third-party apps in your organization:
Allow third-party apps: This setting controls whether users can use third-party apps. If you turn off this setting, your users won't be able to install or use any third-party apps and the app status of these apps is displayed as Blocked org-wide in the table.
Note
When Allow third-party apps is off, outgoing webhooks are still enabled for all users, but you can control them at the user level by allowing or blocking the Outgoing Webhook app through app permission policies. Note that if you have existing app permission policies for Microsoft apps that use the Allow specific apps and block all others setting, and you want to enable outgoing webhooks for users, add the Outgoing Webhook app to the list.
Note
Teams users can add apps when they host meetings or chats with people from other organizations. They can also use apps shared by people in other organizations when they join meetings or chats hosted by those organizations. The data policies of the hosting user's organization, as well as the data sharing practices of any third-party apps shared by that user's organization, are applied.
Allow any new third-party apps published to the store by default: This setting controls whether new third-party apps that are published to the Teams app store become automatically available in Teams. You can only set this option if you allow third-party apps.
Under Custom apps, turn off or turn on Allow interaction with custom apps option. This setting controls whether users can use custom apps or not. To learn more about custom apps, see how to manage custom apps.
Select Save. The settings take effect after a few hours.
Auto install approved apps based on admin approval
Auto install approved apps feature automatically adds approved apps in Teams client of the permitted users. The functionality respects all admin governance controls and only installs apps that the users have used although outside Teams. It reduces manual intervention to add an app and improves user productivity by preventing context-switching. To know more about the feature, see Auto install approved apps in Teams.
Manage org-wide app settings for Microsoft 365 Government
In a Microsoft 365 Government - GCC, GCCH and DoD deployment of Teams, all third-party apps are blocked by default. In GCCH and DOD clouds, the third-party apps aren't available. Additionally, in GCC, you see the following note about managing third-party apps on the app permission policies page in the Microsoft Teams admin center.
Use org-wide app settings to control whether users can install third-party apps. Org-wide app settings govern the behavior for all users and override any other app permission policies assigned to users.
For GCC clouds
On the Teams Apps > Manage apps page, select Org-wide app settings. You can then configure the settings you want in the panel.
Under Third-party apps, turn off or turn on these settings to control access to third-party apps:
- Allow third-party apps: This option controls whether users can use third-party apps. If you turn off this setting, your users won't be able to install or use any third-party apps. In a Microsoft 365 Government - GCCH and DoD deployment of Teams, this setting is off by default.
- Allow any new third-party apps published to the store by default: This option controls whether new third-party apps that are published to the Teams app store become automatically available in Teams. You can only set this option if you allow third-party apps.
Under Blocked apps, add the apps you want to block across your organization. In a Microsoft 365 Government - GCCH and DoD deployment of Teams, all third-party apps are added to this list by default. For any third-party app you want to allow in your organization, remove the app from this blocked apps list. When you block an app org-wide, the app is automatically blocked for all your users, regardless of whether it's allowed in any app permission policies.
Select Save for org-wide app settings to take effect.
To allow third-party apps, either edit and use the global (Org-wide default) policy or create and assign an admin-created policy.
For GCCH and DoD clouds
Sign in to the Teams admin center and access Teams Apps > Permission policies.
Select Org-wide app settings. Under Blocked apps, add the apps you want to block across your organization. In a Microsoft 365 Government - GCCH and DoD deployment of Teams, all third-party apps are added to this list by default. When you block an app org-wide, the app is automatically blocked for all your users, regardless of whether it's allowed in any app permission policies.
Select Save for org-wide app settings to take effect.
Support information for apps
You may have queries about admin settings or configuration, user flows and app features, app troubleshooting, and more. You receive support information about apps from the following two different sources:
Microsoft doesn't provide direct support for Teams apps but provides the following value adds for customers:
- Testing of all apps as part of its app validation program to ensure that all apps work as advertised.
- Certification to apps via its Microsoft 365 app compliance program to reassure that app are compliant with the industry-standard frameworks.
App developers provide customer support, updates to the apps, security and compliance information, bug fixes, and so on. The app security and compliance information are available in the admin center in app details page as mentioned above. App developers publish app updates, bug fixes, and vulnerability fixes as per their business requirements, issue severity, and service agreements. For direct support requests and inquiry about app updates, contact the app developer at their website address available at the following two places:
- App details page of the app in Manage apps page in Teams admin center.
- Details + support tab of the app's AppSource page.
Related article
Feedback
Submit and view feedback for