CIS.M365.8.4.1: Ensure app permission policies are configured

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.8.4.1
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Teams
Feature	Apps
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 8.4.1 (L1, E3 Level 1)
Framework controls	cis-m365:8.4.1 nist-800-53-r5:CM-7 Least Functionality
MITRE ATT&CK	T1195, T1671
Reads from	Microsoft Teams

What this checks and how to fix it

8.4.1 (L1) Ensure app permission policies are configured

This policy setting controls which class of apps are available for users to install.

Rationale

Allowing users to install third-party or unverified apps poses a potential risk of introducing malicious software to the environment.

Impact

Users will only be able to install approved classes of apps.

Remediation action

1. Navigate to Microsoft Teams Admin Center.
2. Click to expand Teams apps, then select Permission policies.
3. Select the Global (Org-wide default) policy.
4. Under Third-party apps, set to Block all apps (or Allow specific apps and block all others).
5. Under Custom apps, set to Block all apps (or Allow specific apps and block all others).
6. Click Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command to block all third-party and custom apps:

Set-CsTeamsAppPermissionPolicy -Identity Global -GlobalCatalogAppsType AllowedAppList -GlobalCatalogApps @() -PrivateCatalogAppsType AllowedAppList -PrivateCatalogApps @()

Related links

• Microsoft Teams Admin Center.
• Manage app permission policies in Microsoft Teams
• Set-CsTeamsAppPermissionPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 526

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: HenrikPiecha; contributors: merill, MarcoJanse, Mynster9361. Open-source licences.