11-25-2020 04:25 AM
11-25-2020 04:25 AM
Does anybody have a good idea into where those apps in Teams are storing data and who is controlling the encryption level on those? We are using our own encryption keys, but how could we be sure that those apps are following same rules? We already noticed issues with Power Apps on these. I believe Microsoft's own apps should be pretty controlled, but how about third part apps?
11-25-2020 05:47 AM
@Petri X Apps in Teams pretty much fall into two main camps: Bots, and Tabs (even things like Message Extensions and outgoing webhooks often basically take one of these forms). Bots are essentially just remote web services (HTTP POST endpoints) and Tabs are basically just 'iframed' webpages. As a result, in this context, you're pretty much totally reliant on the app developer and how they've chosen to design + implement their app.
That said, Microsoft do offer an "App Compliance" program (see more at https://docs.microsoft.com/en-us/microsoft-365-app-certification/overview), where an app can achieve various levels of increased trust and verification. Follow the links to some of the sub pages to see more about the program's goals and approach.
11-25-2020 11:23 AM
Not sure do we speak about the same item...? I meant those apps which are listed on:
Teams Admin center / Teams Apps / Manage Apps
On there we have Microsoft apps, but also third part apps.
In case our users are asking to allow application XYZ, I was hoping easily to see what it store and where it store the information.
11-26-2020 12:44 AM
11-26-2020 07:27 AM
"there's no way for you to know for sure where/how it's storing it's data behind the scenes. "
Really? Is it only me who is wondering how bad this sounds. How anybody can trust those apps then?
Need to read more about link you shared.
11-26-2020 08:06 AM
11-26-2020 09:41 AM
On the other hand, we are their customers. If we do not care, nothing will change. Some of us might have some legal requirements for certain level of encryption and other storage related topics. Customers should actively challenging
At least Microsoft should be able to provide information if application is able to following tenant level settings. As on some level Microsoft has accepted the application to become apps list on Teams.
11-26-2020 09:58 AM
12-16-2020 10:43 AMSolution
@Petri X Microsoft offers a Microsoft 365 App Certification to resolve the issues you are facing when looking to enable 3rd party apps. In order to complete the Certification and get a badge next to their app in the Teams IT Admin portal and in AppSource an app developer must demonstrate that they meet specific criteria. To better understand what that criteria is please refer to our Certification Submission Guide.