Detections
Analytics

MS.TEAMS.5.3v2 - Agencies SHOULD only allow installation of custom apps approved by the agency.

Information

Allowing custom apps integration can expose the agency to potential vulnerabilities present in an app not managed by the agency. By allowing only specific apps approved by the agency and blocking all others, the agency can limit its exposure to custom app vulnerabilities.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Sign in to the Microsoft Teams admin center.

2. Select Teams apps > Manage apps.

3. In the upper right-hand corner select Actions

4. Select Org-wide app settings.

5. Under Custom apps > Select Off

6. Click Save.

 NOTE: This will make Custom apps in the application list available to "No one." If adjustments are needed follow the remaining instructions

7. Select Teams apps > Manage apps.

8. Select each individual app.

9. Select Users and groups > Edit availability

10. Change Available to to the appropriate setting for your organization. (Everyone, Specific users or groups, or No one)

11. Repeat steps 7 to 10 for each application

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-11

Plugin: microsoft_azure

Control ID: 3bda31dbe3b56ea0962fd31b0f37d7cd2078d9575d4c583a071b3d584aba5862