What storages Teams Apps are using

[Petri-X]

Hi,

Does anybody have a good idea into where those apps in Teams are storing data and who is controlling the encryption level on those? We are using our own encryption keys, but how could we be sure that those apps are following same rules? We already noticed issues with Power Apps on these. I believe Microsoft's own apps should be pretty controlled, but how about third part apps?

[#2]

@Petri-X Apps in Teams pretty much fall into two main camps: Bots, and Tabs (even things like Message Extensions and outgoing webhooks often basically take one of these forms). Bots are essentially just remote web services (HTTP POST endpoints) and Tabs are basically just 'iframed' webpages. As a result, in this context, you're pretty much totally reliant on the app developer and how they've chosen to design + implement their app.

That said, Microsoft do offer an "App Compliance" program (see more at https://docs.microsoft.com/en-us/microsoft-365-app-certification/overview), where an app can achieve various levels of increased trust and verification. Follow the links to some of the sub pages to see more about the program's goals and approach.

[#3]

Hi @Hilton Giesenow 

Not sure do we speak about the same item...? I meant those apps which are listed on:

Teams Admin center / Teams Apps / Manage Apps

On there we have Microsoft apps, but also third part  apps.

In case our users are asking to allow application XYZ, I was hoping easily to see what it store and where it store the information.

[#4]

Yes, we're talking about the same thing - I mean any 3rd party app in Teams - there's no way for you to know for sure where/how it's storing it's data behind the scenes. I would guess it's one of the main reasons exactly why Microsoft introduced the Compliance program I mentioned - there is a lot involved in that around storage/encryption/GDPR/etc. etc. in terms of how the app vendor stores, secures and manages customer and user data

[#5]

@Hilton Giesenow 

You wrote: 

"there's no way for you to know for sure where/how it's storing it's data behind the scenes. "

Really? Is it only me who is wondering how bad this sounds. How anybody can trust those apps then? 

Need to read more about link you shared.

[#6]

While I don't disagree with you, this is hardly a "Teams App" issue - it's true for ANY SaaS system you use. Certainly a smaller/lesser known vendor, and even true for the larger/bigger names. While the larger ones might have more to lose (reputation-wise) for anything malicious, they're also very prone to breaches, as we've seen time and again. As a result, there's a certain level of trust that we're either assuming or granting to -any- 'cloud' product. This certification, while hardly faultless, at least aims to make the vendor think about (and hopefully implement) certain practices. In addition, it's of course recommended to review the vendor's privacy policy/terms of use/etc.

[#7]

@Hilton Giesenow 

On the other hand, we are their customers. If we do not care, nothing will change. Some of us might have some legal requirements for certain level of encryption and other storage related topics. Customers should actively challenging

At least Microsoft should be able to provide information if application is able to following tenant level settings. As on some level Microsoft has accepted the application to become apps list on Teams.

[#8]

Like I said, definitely not disagreeing with you :-). Just being realistic and practical - this reality goes beyond Microsoft and beyond Teams.

[#9 · Accepted solution]

@Petri-X Microsoft offers a Microsoft 365 App Certification to resolve the issues you are facing when looking to enable 3rd party apps. In order to complete the Certification and get a badge next to their app in the Teams IT Admin portal and in AppSource an app developer must demonstrate that they meet specific criteria. To better understand what that criteria is please refer to our Certification Submission Guide.