Forum Discussion
What storages Teams Apps are using
Petri-X Microsoft offers a Microsoft 365 App Certification to resolve the issues you are facing when looking to enable 3rd party apps. In order to complete the Certification and get a badge next to their app in the Teams IT Admin portal and in AppSource an app developer must demonstrate that they meet specific criteria. To better understand what that criteria is please refer to our Certification Submission Guide.
Petri-X Apps in Teams pretty much fall into two main camps: Bots, and Tabs (even things like Message Extensions and outgoing webhooks often basically take one of these forms). Bots are essentially just remote web services (HTTP POST endpoints) and Tabs are basically just 'iframed' webpages. As a result, in this context, you're pretty much totally reliant on the app developer and how they've chosen to design + implement their app.
That said, Microsoft do offer an "App Compliance" program (see more at https://docs.microsoft.com/en-us/microsoft-365-app-certification/overview), where an app can achieve various levels of increased trust and verification. Follow the links to some of the sub pages to see more about the program's goals and approach.
Not sure do we speak about the same item...? I meant those apps which are listed on:
Teams Admin center / Teams Apps / Manage Apps
On there we have Microsoft apps, but also third part apps.
In case our users are asking to allow application XYZ, I was hoping easily to see what it store and where it store the information.
- Yes, we're talking about the same thing - I mean any 3rd party app in Teams - there's no way for you to know for sure where/how it's storing it's data behind the scenes. I would guess it's one of the main reasons exactly why Microsoft introduced the Compliance program I mentioned - there is a lot involved in that around storage/encryption/GDPR/etc. etc. in terms of how the app vendor stores, secures and manages customer and user data
You wrote:
"there's no way for you to know for sure where/how it's storing it's data behind the scenes. "
Really? Is it only me who is wondering how bad this sounds. How anybody can trust those apps then?
Need to read more about link you shared.
- While I don't disagree with you, this is hardly a "Teams App" issue - it's true for ANY SaaS system you use. Certainly a smaller/lesser known vendor, and even true for the larger/bigger names. While the larger ones might have more to lose (reputation-wise) for anything malicious, they're also very prone to breaches, as we've seen time and again. As a result, there's a certain level of trust that we're either assuming or granting to -any- 'cloud' product. This certification, while hardly faultless, at least aims to make the vendor think about (and hopefully implement) certain practices. In addition, it's of course recommended to review the vendor's privacy policy/terms of use/etc.