Hello,
our development department is constantly extending teams with new apps that should follow a staged roll-out deployment.
First only an inner ring (developers) should be able to use the developed app, followed by a pilot-user ring. Finally when everything works as expected the app should be made available to all users.
I wonder if there is a preferred way to design the app permission policies to achive that?
Please correct me if I'm wrong, but AFAIK permission policies don't accumulate each other, meaning custom policies don't include the allowed (or block excluded) apps from the global (org-wide) policy, which would help in that case.
As this seems not to be the case, we currently have 3 permission policies (Dev, Pilot-User, Global) for that single purpose. What should we do in the future, if we have multiple apps (either self-developed, Microsoft, or Third-party) that should follow our ring approach as well? We can only assign 1 policy to a user at any point, so it would get quite complicated keeping the "approved" and globally rolled out apps in sync with the custom apps.
Maybe I missed any essential point here but if not I would really welcome any other views on that.
