> ## Content Index > Fetch the complete content index at: https://seanshares.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Control Teams App Access Without Permission Policies - URL: https://seanshares.com/control-teams-app-access-without-permission-policies/ - Published: 2026-11-12T13:30:00.000Z - Updated: 2026-11-12T13:30:00.000Z - Description: Teams app permission policies have been replaced by app centric management. Here is how to control who can use each app, set org-wide defaults, and script it. - Author: Sean Shares - Tags: Teams, #admin If you go looking for app permission policies in the Teams admin center today, you won't find them. The page now says "Say goodbye to managing app access with permission policies" and points you to **Manage apps**. Microsoft moved every tenant to a per-app model called app centric management, and it changes how you allow, block and limit Teams apps. This guide covers what replaced permission policies, how to limit an app to a specific group, the org-wide settings that now control new apps, and the PowerShell that does it in bulk. Microsoft is also rolling out a new guided **Manage access** flow between mid-October and mid-November 2026, so I cover what that changes too. ## What Happened to Teams App Permission Policies For years you controlled Teams apps with app permission policies. You built a policy that allowed or blocked apps, then assigned it to users. It worked, but it got messy fast. As custom policies piled up, keeping track of what each one allowed and who it applied to could become a chore. Microsoft replaced that with app centric management. Instead of assigning policies to people, you now set access on the app itself. Each app answers two questions: who it's **Available to**, and who it's **Installed for**. Tenants that only used the global policy were moved automatically first. Everyone else was auto-migrated between April and June 2025 (Message Center MC688930). If you open **Teams apps** \> **Permission policies** now, this is what you get: ![Teams admin center Permission policies page showing the message Manage app availability from Manage apps and Say goodbye to managing app access with permission policies](https:///content/images/2026/10/teams-permission-policies-retired.png) There's no going back. Once a tenant is on app centric management, permission policies can't be viewed, edited or restored. ## What Users See When an App Isn't Available From the user's side, not much looks different. Blocked or unavailable apps still show up in the Teams app store, so people can read about them. Instead of an **Add** button, they see an option to request approval. That request lands in the Teams admin center. You will see it in the **Most requested app** card on **Manage apps** and on the app's **User requests** tab. When you approve a request, the user gets a Teams notification and the **Add** button appears for them. One catch: if the app itself is blocked, approving the request isn't enough. You have to pick **Approve and unblock** or the user still can't use it. App requests aren't supported for custom apps or in GCC, GCC High and DoD tenants. ## How App Availability Works Now Go to **Teams apps** \> **Manage apps**. The app list now has three columns that matter more than anything else on the page: ![Teams admin center Manage apps list with the Installed for and Available to columns highlighted, showing apps available to Everyone org-wide default](https:///content/images/2026/10/teams-manage-apps-availability-columns.png) - **Installed for**: who has the app installed for them by an admin. - **Available to**: who is allowed to install and use the app themselves. - **App status**: whether the app is blocked or unblocked for the whole tenant. Most apps in a fresh tenant show **Everyone (org-wide default)** under **Available to**. That label matters. It means you never set access for that app, so it follows your org-wide settings. Once you change an app's availability yourself, it stops following the org-wide default. ### The three availability options Every app gets one of these: ![Edit availability panel for the Bookings app with the Available to dropdown open showing Everyone, Specific users or groups, and No one](https:///content/images/2026/10/teams-edit-availability-options.png) - **Everyone**: anyone can install and use it, including guests and external users in your org. - **Specific users or groups**: only the people you pick. - **No one**: nobody can install or use it. If you migrated from permission policies, this is where the old blocks went. An app that a policy blocked now shows as **Unblocked** in **App status**, but it's available to **No one**. The result is the same, it just looks alarming the first time you see it. ## How to Limit a Teams App to a Specific Group This is the task that used to need a custom permission policy. Now it's done on the app: 1. In the [Teams admin center](https:///policies/manage-apps), go to **Teams apps** \> **Manage apps**. 2. Search for the app and select its name to open the details page. 3. Select the **Users and groups** tab. 4. In the dropdown under **Select to manage who this app is installed for or available to in your organization**, choose **Availability**. 5. Select **Edit availability**, choose **Specific users or groups**, add your users or groups, and select **Apply**. ![Bookings app Users and groups tab with the Availability view selected, showing Available to everyone org-wide default and the Edit availability button](https:///content/images/2026/10/teams-app-users-and-groups-availability.png) Switch the same dropdown to **Installs** to push the app to people instead of just allowing it. Installing an app for someone also makes it available to them, so you don't need to do both. Give it time. Microsoft says changes take up to 24 hours to reach users, and in rare cases up to six days. If someone says they still can't see an app the next morning, that's usually why. Use groups, not individual users. You can only add 99 users or groups at a time, and the search box only shows 20 results. A security group per app audience is much easier to live with than a list of names. ## Org-Wide App Settings Control Everything You Didn't Touch The org-wide settings decide what happens to new apps Microsoft adds to the store and to every app you never configured individually. Open them from **Manage apps** \> **Actions** \> **Org-wide app settings**. - **Microsoft apps**: a single toggle, **Let users install and use available apps by default**. Built-in Teams agents like Facilitator are no longer covered by this setting and have their own page. - **Third-party apps**: an **Availability options** dropdown (more on this below). - **Custom apps**: a toggle for apps your organization uploads, plus **Let users interact with custom apps in preview**. When I tested this in my test tenant, the third-party setting didn't match Microsoft's documentation. The docs describe a single on or off toggle. The tenant has a dropdown with three choices: ![Teams admin center Org-wide app settings panel with the third-party Availability options dropdown open showing All third-party apps available, All certified apps available, and Third-party apps not available](https:///content/images/2026/10/teams-third-party-availability-options.png) - **All third-party apps available** - **All certified apps available**, which only allows third-party apps with Microsoft 365 certification - **Third-party apps not available** That middle option is the one I would look at first. It's a reasonable default for a lot of organizations. It lets people use vetted apps without opening the door to every publisher in the store. Apps you have set individually keep their own settings no matter what you choose here. ## The New Manage Access Flow (Rolling Out Now) Message Center post MC1515931 announced a guided **Manage access** experience under **Teams apps** \> **Manage apps**. It pulls availability, installs, permission consent and allow or block into one flow, and it highlights the steps that need attention based on the app's current state. Rollout started in mid-October 2026 and should finish by mid-November. It doesn't change any existing settings. Nothing is applied until you review the configuration and select **Apply**. It wasn't in my test tenant yet when I wrote this, where the app's **Actions** menu still only offered **Block app**, so don't worry if you don't see it yet either. While you are on **Manage apps**, you may also see a banner offering **Move to unified app management**. That's a separate change that lets you manage Teams apps and Copilot agents from either the Teams admin center or the Microsoft 365 admin center. Read up on it before you click it, since it changes where app decisions live. ## Managing Teams App Availability with PowerShell The admin center can't change availability for many apps at once. PowerShell can. You need the MicrosoftTeams module and the Teams Administrator role. ```powershell # Connect to Teams Connect-MicrosoftTeams # List every app with its block state and availability Get-AllM365TeamsApps | Select-Object -Property Id, IsBlocked, AvailableTo -ExpandProperty AvailableTo # Check one app (the app ID is also in the URL of its details page) Get-M365TeamsApp -Id "" # Make an app available to everyone Update-M365TeamsApp -Id "" -AppAssignmentType Everyone # Make an app available only to one group Update-M365TeamsApp -Id "" -AppAssignmentType UsersAndGroups -OperationType Add -Groups "" # Block an app for the whole tenant ($false unblocks it) Update-M365TeamsApp -Id "" -IsBlocked $true ``` Be careful with the examples in Microsoft's cmdlet reference for `Update-M365TeamsApp`. A couple of them pass `-IsBlocked $true` while the description says the command unblocks the app. The parameter itself is the app's blocked state, so `$true` blocks and `$false` unblocks. Test on one app before you script it across hundreds. ## Limitations to Know About - **No rollback.** Once you are on app centric management, you can't return to permission policies. - **No bulk changes in the UI.** Use `Update-M365TeamsApp` for anything beyond a handful of apps. - **99 users or groups at a time**, and the picker only shows 20 search results. - **Slow to apply.** Up to 24 hours normally, and occasionally several days. - **Pinning is separate.** App setup policies still control which apps are pinned in the Teams app bar. - **Migration artifacts.** Auto-migration created one security group per old custom policy. Clean those up or rename them so the next admin knows what they are for. ## Frequently Asked Questions ### Where did Teams app permission policies go? They were replaced by app centric management. You now set who each app is available to on the app's **Users and groups** tab in **Manage apps**, instead of assigning policies to users. ### Can I go back to app permission policies? No. After a tenant moves to app centric management, permission policies can't be accessed or restored. ### Why does a blocked app now say Unblocked? Apps that a permission policy blocked were migrated as **Unblocked** but available to **No one**. Users still can't use them. ### How do I allow only Microsoft 365 Certified third-party apps? In **Org-wide app settings**, set the third-party **Availability options** to **All certified apps available**. Apps you configured individually keep their own settings. ### How long until users see an app change? Usually within 24 hours, but Microsoft says it can occasionally take up to six days. ## Final Thoughts App centric management is easier to reason about than permission policies ever were. The one thing to get right is the org-wide settings, because they quietly decide access for every app you haven't touched. Look at them first, then lock down the handful of apps that need a specific audience. If you are working through other Teams governance settings, my guides to the [Teams AI policy](https:///microsoft-teams-ai-policy-guide/) and [Facilitator admin controls](https:///what-is-microsoft-teams-facilitator-and-how-to-use-it/) pair well with this one. And if an app asks for Microsoft Graph permissions you don't recognize, the [Graph Permissions Lookup](https:///graph-permissions-lookup/) tool explains what each one allows. Sources: [Use app centric management to manage access to apps](https:///microsoftteams/app-centric-management), [Overview of agent and app management and governance in Teams admin center](https:///microsoftteams/manage-apps), [View and manage user requests](https:///microsoftteams/user-requests-approve-apps), [Update-M365TeamsApp](https:///powershell/module/teams/update-m365teamsapp).