Teams Third-Party App Security Review: 4 Checks
TL;DR · the short version
Third-party apps in Microsoft Teams can access messages, files, channels and user data, so an over-permissioned or malicious app is a real data-exposure risk. Before granting access, review the permissions it requests versus what it needs, the publisher's reputation and verification status, and whether it fits your governance and compliance needs. At the org level, govern Teams apps with an allowlist of approved apps, limits on who can add apps, and periodic review - the same least-privilege discipline you apply to any third-party access.
What security review does a third-party tool need before it gets access to Teams data?
Microsoft's guidance is built around the consent decision. Before granting tenant-wide admin consent, confirm you trust the app and its publisher for the level of access requested, understand every permission, and check the permissions match the features you expect from the app. Microsoft says not to grant consent if you are not confident who controls the app or why it is requesting the permissions. Then check the publisher's verification and any Microsoft 365 certification or publisher attestation, read the developer's privacy statement and terms (linked from each app page in the Teams admin center), and approve through admin-managed policy rather than a user's one-click install.
What is the difference between delegated and application permissions?
Per Microsoft, delegated permissions let an app act on behalf of a user who is signed in to it, while application permissions let the app access data for the entire organization without any user interaction. Application permissions therefore deserve the closest scrutiny in a review. Microsoft's example of what to refuse: an app that offers site management would not necessarily need full access to all mailboxes or full impersonation in the directory.
What does a verified publisher badge tell me about a Teams app?
It tells you Microsoft has verified the organization that publishes the app as authentic, using a verified Microsoft AI Cloud Partner Program account. It does not indicate quality criteria such as certifications, compliance with industry standards or best practices, and Microsoft calls it one of several criteria to weigh. For security and data-handling evidence, look at Publisher Attestation (a developer self-assessment) or Microsoft 365 App Certification (an assessment plus an analyst's review), which the Teams admin center surfaces on each app's details page.
How do I control which third-party apps Teams users can install?
In the Teams admin center, Manage apps lets you allow or block individual apps, and Org-wide app settings has a single control for third-party apps in bulk. Per-user access is handled through app-centric management, and Microsoft notes the older app permission policies are deprecated. Users can also request an app from within Teams, and admins are notified. In Microsoft Entra, Microsoft recommends restricting user consent to verified publishers and permissions you select, and enabling the admin consent workflow so users can request approval.
How do I keep an eye on a Teams app after approving it?
App governance in Microsoft Defender for Cloud Apps covers OAuth-enabled apps registered in Microsoft Entra ID, Google and Salesforce. Per Microsoft it shows which user-installed OAuth apps have access to Microsoft 365 data, what permissions they hold and which users granted access, and it raises alerts on anomalous or risky app activity. Microsoft also advises auditing apps and consented permissions already in your tenant.
Sources (accessed 2026-11-03): Microsoft Entra: user and admin consent overview; Microsoft Entra: evaluate a request for tenant-wide admin consent; Microsoft identity platform: publisher verification overview; Microsoft Teams: Microsoft 365 app compliance program for Teams apps; Microsoft Teams: manage apps in the Teams admin center; Microsoft Defender for Cloud Apps: app governance
"What security review does a third-party tool need before we grant it access to our Teams data?" is a question every organisation using Microsoft Teams eventually faces — often after someone has already one-click-installed an app that requested access to every message and file. Teams apps run inside your collaboration platform, so granting one access is a real third-party data-access decision.
Useful next, if this was relevant to you
The short answer: before a third-party tool gets access to Teams data, check four things and record the decision. Compare the permissions it requests with what its function needs, and refuse anything broader such as read-all-messages or tenant-wide file access. Confirm the publisher is verified and reputable, find out where your data goes and how the vendor stores it, and check it meets your privacy, data-residency and compliance rules. Then approve it through admin-managed app policies and an allowlist, not an individual user’s one-click install.
Why Teams apps are a risk
Third-party apps and integrations can request access to messages, files, channels and user data. An over-permissioned app can read or exfiltrate sensitive conversations and documents; a poorly-secured or malicious one becomes a path to that data. The one-click install can quietly bypass the vendor-risk scrutiny the same access would get anywhere else — and a trusted vendor app is no exception, as the ConnectWise Cloud Backup (SkyKick) compromise of 100+ Microsoft 365 tenants showed when its consented OAuth app became a cross-tenant skeleton key.
The review to run before granting access
- Permissions vs need: does it request only what its function requires? A narrowly-useful app wanting sweeping access is a red flag.
- Publisher reputation: is it a verified/publisher-attested app from a reputable vendor?
- Data flow: where does your data go, and how is it stored and handled?
- Governance fit: does it meet your privacy, data-residency and compliance requirements?
Govern apps across the organisation
Do not rely on individual users. Use Teams admin controls to maintain an allowlist of approved apps and block the rest, restrict who can add apps, require review before approving a new one, and re-review periodically. This is least-privilege and vendor-risk discipline applied at scale.
Run a structured third-party review with the Vendor Risk tool →, see the wider hardening steps in Microsoft Teams security best practices, and govern agent/tool access with MCP Guard.
Frequently asked questions
What review does a Teams app need? Permissions vs need, publisher reputation/verification, data flow, and governance/compliance fit.
Why are Teams apps risky? They run inside your platform and can access messages/files/data; one-click install can bypass vendor scrutiny.
How to govern at scale? Allowlist approved apps, restrict who can add them, require review, and re-review periodically.
Which permissions concern? Broad read-all-messages / all-files / tenant-wide access that exceeds the app's purpose.
Frequently asked questions
Why are Teams apps a security risk?
Because they run inside your collaboration platform and can request access to messages, files, channels and user data. An app with broad permissions can read or exfiltrate sensitive conversations and documents, and a poorly-secured or malicious app becomes a path to that data. The convenience of one-click install can bypass the vendor-risk scrutiny the same data access would get through any other channel.
How do I govern Teams apps across the organisation?
Use Teams admin controls: maintain an allowlist of approved apps and block the rest, restrict who can add or install apps (so it is not a free-for-all), require review before a new app is approved, and periodically re-review approved apps. This applies least-privilege and vendor-risk discipline at scale rather than relying on individual users to make good decisions.
What permissions should raise concern in a Teams app?
Broad permissions to read all messages, access all files, or act across the whole tenant warrant scrutiny — especially when they exceed what the app's stated function needs. As with browser extensions, the test is permissions-versus-purpose: a narrowly-useful app requesting sweeping access to your Teams data is a red flag worth investigating before approval.
How do I stop teams from building ungoverned tools in random apps?
Govern it at the platform, not person by person. Restrict who can add or install third-party apps and integrations, maintain an allowlist of approved apps and block the rest, require a review step before a new app is approved, and re-review approved apps periodically. That turns "anyone can wire up a random app" into a controlled, least-privilege process — the same vendor-risk discipline you apply to any third-party data access, and it is how you keep ungoverned, over-permissioned tools out of your messages and files.