New admin controls for apps in Teams
Published Aug 01 2017 09:17 AM 59.7K Views
Microsoft

Admin controls for Microsoft Teams AppsAdmin controls for Microsoft Teams Apps

Earlier this year, we introduced a rich platform for Microsoft Teams including bots, tabs, and connectors. We are now introducing a way for admins to control which third parties can integrate with Microsoft Teams. Third party services are building rich and super powerful experiences by extending Microsoft Teams in multiple ways. We're calling these experiences apps. For example, developers can implement an app with a bot and a tab, or an app with a tab and a connector, or an app with all three capabilities at once! And now as an IT admin you can have complete control over which apps are available to your end users. This functionality will be live in the next few days!

 

How does this work?

Put simply, there will be three new controls that will allow you to manage in detail which third party apps can be used in Microsoft Teams. As an admin, you can:

  1. Choose to allow or block all third-party apps.
  2. Individually choose which apps to allow or block.
  3. Choose what happens as new apps get submitted into the Microsoft Teams app catalog.

The first thing you’ll notice is we’ve renamed the “Tabs and Bots” section to read “Apps”. But don’t worry: all your existing settings have been migrated under the new name. So if, for example, tabs and bots were disabled, then apps will now be disabled. As explained in the introduction, this is part of a new and more convenient way to think about third party services integrating with Microsoft Teams. This means that when you're working with Apps settings, you're able to manage your tenant's app catablog all in one place:

New admin UI controls for third party apps in Microsoft TeamsNew admin UI controls for third party apps in Microsoft Teams

 

What are the new controls

 

Allow external apps in Microsoft Teams

With this control, an admin can either allow or block all third party apps in Microsoft Teams. Turning this control ”Off” blocks all tabs, bots, connectors, and any new capabilities we add in the future. Turning this control “On” allows admins to select which specific apps are enabled and disabled.

 

Enable new external apps by default

This control sets the default behavior for what happens to new apps after they’re submitted to the Microsoft Teams app catalog. If an admin wants new apps enabled automatically, set the control to “On”. Otherwise, set the control to “Off” to prevent all new third-party apps from being enabled.

 

Allow sideloading of external apps

Sideloading is the process of adding apps to Microsoft Teams by uploading a zip file directly to a team. It's useful because it allows users to test an app as it's being developed. Sideloading also lets you build an app for internal use only, so you can share it with your team without submitting it to the Teams app catalog.

 

Note that any existing settings around sideloading will persist. 

Edit: Note that if sideloading is on, you will not see granular app settings. All apps will be enabled

 

How will this affect my users?

In Microsoft Teams, your users will see a message letting them know some apps may be disallowed. So, for example, when a user tries to add a tab, bot, or connector, here’s what they’ll see:

 Microsoft Teams Bot Gallery with showing warning messageMicrosoft Teams Bot Gallery with showing warning messageMicrosoft Teams Connector Gallery with showing warning messageMicrosoft Teams Connector Gallery with showing warning messageMicrosoft Teams Tab Gallery with showing warning messageMicrosoft Teams Tab Gallery with showing warning message

 

What happens to old bot conversations?

If a user had an existing conversation with a bot, then all the contents of that conversation will stay intact. The only difference is that users won’t be able to interact with the bot, so no more sending or receiving messages.

 

What happens to old tabs?

When an app is disabled, all tab instances in the UI will disappear. If the app is re-enabled, then all pre-existing tab instances will reappear exactly as you left them.

 

What happens to configured connectors?

Important: Blocked apps with connectors won’t be able to send you messages anymore. If an app is re-enabled, then pre-existing configured connectors will be able to send messages again.

 

 

Note that when any settings are applied they’ll gradually roll out to all your users across their devices without any explicit action by them.

 

We hope these new controls allow you to more confidently manage your deployments of Microsoft Teams and in turn make your users better and more successful. Please let us know if you have any feedback or questions in the comments!

 

 

---

 

Additional information around practical guidance of Microsoft Teams can be found using the links below. This practical guidance was created to help you Plan, Deliver, and Operate Microsoft Teams.  We documented the key information that we hope you find useful during your project, including the accompanying workshop and decision summary materials.

 

Microsoft Teams Extensibility Practical Guidance

https://www.successwithteams.com/GetStartedSection?name=Extensibility

 

Practical Guidance for Microsoft Teams

https://www.successwithteams.com/GetStarted

28 Comments
Bronze Contributor

Very welcome new feature. 

 

How would this work with non-apps? Like the 3rd party storage that was added recently. If I have new apps disabled by default, would that have been disabled when rolled out, or not?

Microsoft

@Ed Hansberry this will not affect your storage providers

Microsoft

A very welcome new feature that will allow us to comfortably take advantage of some of these 3rd party apps. Thank you Luis!

Bronze Contributor

That wasn't what I asked...

Microsoft

 

 

@Ed Hansberry If I understand the question correctly: are 3rd party Teams Apps related to 3rd party storage providers?

 

The answer is not. You can think of the third party storage feature as something that is provided by the files app. (aka, the Files app on teams connecting to a third party, not the other way around)

 

A teams app consists of the Apps Tab, Bot, and Connector, these are the capabilities that would be affected by these changes in the admin portal. 

 

So, this feature does not affect integrations (and features) provided by 1st party Teams apps (Files, Chat, Teams, Meetings, etc). This means that the 3rd party storage feature that was shipped recently will not be affected if 3rd party apps are turned off.

Bronze Contributor

@Luis Carrasco - thanks. I understand nothign will change to 3rd party storage now. I was hoping this new control panel would prevent in the future what happend in June - which was a new feature was rolled out and on by default leaving admins scrambling to turn off the 3rd party storage feature.

 

I will be disabling new apps by default and turning then on after reviewing them, but it seems that there are still ways for things to just be on in the future as they don't fall under the definition of "apps." 

Very nice addition to control the 3rd party apps.

Steel Contributor

This is pure awesomeness! Finally - this will make Teams Apps more reachable by the end-users and not scare the IT Sec teams anymore.

#yoteams

Brass Contributor

Great feature, but the list needs to be alphabetized and also it would be nice to be able to differentiate between Connectors, Apps and Bots. 

Microsoft

@Frank Schvamberg thanks for your feedback! Happy to hear you find this useful. We'll been working on updating this feature continuosly to make it better and easier to use.

Steel Contributor

Great addition! Alphabetic order will be nice too. 

Bronze Contributor

Suggestion for improvement to this - a link to a "what is this app" page or popup, as well as an indicator if it is used in our tenant before we disable it. The app names are not helpful, so having to google just about every one of them to see if we want it or not.

Microsoft

@Ed Hansberry I gave that very suggestion directly to Luis and the team building these features the other day, along with the request for some sort of weekly update or something that outlines what new apps are newly available.

Microsoft

@Ed Hansberry@David Rosenthal. This is a great suggestion! We will be improving and iterating on this experience over the next few months. Thank you so much for the feedback.

Brass Contributor

Another suggestion... pass this along to the Yammer and Outlook teams as we need the same functionality there!

 

I'd recommend a common interface for Connectors for all MS Services where we can manage all in one place.

Copper Contributor

@Luis Carrasco, thank you for this post! Super helpful. In an effort to move from Slack to Teams, I'm very interested in getting Connectors enabled.

 

When I navigate to our Office Admin > Services & add-ins > Teams... and enable "Allow external apps in Microsoft Teams", I notice the list of apps shows up under "Allow sideloading of external apps" (see screenshot below).

 

The order does not align with the screenshot posted above in this article. It's a little confusing.

 

Services & Add-ins - Teams - Apps.png

Brass Contributor

This is great for tenant controls but what about if managed from SCCM? How would these settings apply if you install and manage the Teams Client from SCCM? Is it configurable?

 

 

Brass Contributor

Danea Galbraith, As per my understanding it is not yet configurable and cannot manage via SCCM. 

Its completely tenant wide setting not individual app wise. Once it turn on you can manually control application wise setting. Thanks.

 

Regards

Balu Ilag [MVP]

Copper Contributor

Suggestion for improvement to this - In the Microsoft Teams Connector Gallery, display the disabled connectors are grayed out so that users can see what would be possible if the administrators release it.

Copper Contributor

I would love to see the possibility to sideload an app right in the admin Center so that I can distribute an app within the Organisation without having to publish it in the store.

For example, I have created a powerapp and packaged it for Teams so that it can be used as a static tab within the personal scope. Unfortunately every single user has to sideloade the app manually in order to use it since there is no way of deploying it for the entire Organisation.

Microsoft

@Lukas Sauerwald, the ability to distribute an app within your organization is something we are currently investing in.

Brass Contributor

Give us the ability to turn on/off the Microsoft apps individually as well.  Our organization does not support them all so it's confusing to our users.  Thanks!

 

Brass Contributor

It's great that we can enable individual tabs, bots and connectors within Teams. But what about Office 365 Group Connectors? Is there a similar facility there too?

Brass Contributor

What Admin policies can be set with Teams?  The storage becomes part of the SharePoint tenant storage, correct?  What about the mail flow?  If someone posts an email into Teams, is it gone from their Outlook?  I understand it becomes part of MS Teams for as long as that project is active.

 

Brass Contributor

Do we have to allow bots?

 

Brass Contributor

Can we get notified when a Teams group has been inactive for some period of time?  I am assuming Teams is discoverable when necessary too.

Copper Contributor
As I understand this setting is on tennant level. Is it possible to dissable apps only for some Organisational Units? As we have OUs for our different international organisations there are different requirements for apps. In some we would even want to block apps completely? Is that possible?
Copper Contributor

@Luis Carrasco this article is outdated now as these settings moved into teams Admin portal. 

Version history
Last update:
‎Jan 26 2021 02:46 PM
Updated by: