Detections
Analytics

MS.TEAMS.5.2v2 - Agencies SHOULD only allow installation of third-party apps approved by the agency.

Information

Allowing Teams integration with third-party apps can expose the agency to potential vulnerabilities present in an app not managed by the agency. By allowing only specific apps approved by the agency and blocking all others, the agency can limit its exposure to third-party app vulnerabilities.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Sign in to the Microsoft Teams admin center.

2. Select Teams apps > Manage apps.

3. In the upper right-hand corner select Actions

4. Select Org-wide app settings.

5. Under Third-party apps > Select Off

6. Click Save.

 NOTE: This will make third party apps in the application list available to "No one." If adjustments are needed follow the remaining instructions

7. Select Teams apps > Manage apps.

8. Select each individual app.

9. Select Users and groups > Edit availability

10. Change Available to to the appropriate setting for your organization. (Everyone, Specific users or groups, or No one)

11. Repeat steps 7 to 10 for each application

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-11

Plugin: microsoft_azure

Control ID: d86a21eb6a6f1ce4a7d7773a6b82255a444ff3d3c3b8b38029f36cc920ef00ba