Overall block of integrated apps but allow certain users to access specified app

Question

Hey!

We are currently blocking Microsoft Integrated Apps for our users. Now we are testing an integrated app that we have approved for certain people in the organisation but due to the overall policy the users are not allowed to use the app.

Is there a way to keep the organisation block but allow certain apps for certain people?

Thanks in advance!

Answer 1

Dear TheGoose123,

Thank you for clarifying the context and providing additional details! I understand now that you're referring to managing Integrated Apps specifically in the Microsoft 365 Admin Center under Settings > Integrated Apps, such as Microsoft Clarity.

To achieve your goal of blocking all integrated apps but allowing specific apps for certain users, you can manage user access to these apps directly in the admin center. Here are the steps:

1. Go to the Microsoft 365 admin center:

• Navigate to Settings > Integrated apps.

2. Select the App:

• Find the integrated app you want to allow for certain users (e.g., Microsoft Clarity).

3. Edit User Access:

• Click on the app and select Edit under the "Who has Access" section.
• Add the specific users or groups who should have access to the app.

4. Save Changes:

• Save the changes to apply the new access settings.

This way, you can maintain the organization-wide block on integrated apps while granting access to specific apps for designated users. For more information, please refer to this article: Manage add-ins in the admin center - Microsoft 365 admin | Microsoft Learn

Thank you for your patience, and I hope this clears up any confusion.

Best regards,

Community Moderator | Sophia

Answer 2

Hello!

Does anyone know, whether this user scoping tracks group membership changes?

For instance, I want to scope some Integrated App using DL or security group and it works, all good. Then, some time passes and group's membership changes, so will the app appear for new members of the security group (or DL) and disappear for those, who are removed from the group?

Answer 3

Hey Sophia!

Thanks for the response. However I belive we are on different pages. Below is the integrated apps I am refering to.

For example all apps should be blocked but allowed for certain users. I dont belive CA policys apply here?

Answer 4

Dear TheGoose123,

Thank you for reaching out!

To assit you more effeciently, could you please share how you performed the app block at the tenant level? This will help us understand if there is a way to whitelist certain users within the solution you used.

In general, you can achieve this by creating a security group and setting up a Conditional Access policy. Here are the detailed steps:

1. Create a Security Group:

• Go to the Azure portal.
• Navigate to Azure Active Directory > Groups > New Group.
• Create a new security group and add the users who need access to the approved app.

2. Configure Conditional Access Policy:

• In Microsoft Entra, go to Azure Active Directory > Protection> Conditional Access > New Policy.
• Name your policy and select All users to whom this policy will apply.
• Under "Exclude" tab, exclude the security group you created white list it.
• Under Cloud apps or actions, select the specific app you want to block.
• Configure the conditions and grant controls as needed.
• Enable the policy.

This way, you can maintain the organization-wide block on integrated apps while granting access to the approved app for specific users.

If you need further assistance, please let us know and share more details!

Thank you for your time and patience, and we hope you have a great day!

Best regards,

Community Moderator | Sophia