Video Summary
Here are the key points from the video:
- Difference Between Policies: App permission policies control what apps users can install, while app setup policies manage the user experience in Teams, such as app layout and default apps.
- Custom App Uploads: You can allow or disallow users from uploading custom apps. For example, developers might have a policy that allows them to upload and test custom apps.
- Pinning Apps: Decide whether users can pin and unpin apps, and set the default order of pinned apps for a consistent user experience.
- Default Apps: Specify which apps are installed by default for all users, ensuring everyone has the necessary tools.
- Troubleshooting: If a user has trouble adding an app, check their assigned app permission policy to see if it’s being blocked.
For more information, read the transcript blog below, or watch the video above!
Video Transcript
Now that we have seen how to configure org-wide settings, let’s learn how to manage app permission policies. App permission policies control what apps you want to make available to Teams users inside your organization. As with the rest of the policies in Microsoft Teams, you can use the global or org-wide default policy and customize it, or you can create one or more policies to meet the needs of your organization. If we look more in detail at the different settings we have in-app permission policies, first we can decide which apps users can install, and we can apply different settings for Microsoft apps, third-party apps, and custom apps. The big advantage of app permission policies is that since it’s policy-based, it’s flexible, allowing it to apply different settings to different profiles for each of the three app categories. So, for Microsoft apps, third-party apps, and custom apps, you have four options, and again, they’re independent in each category. You can choose to allow all apps, allow specific apps and block all others, block specific apps and allow all others, or block all apps. As we have mentioned before, the org-wide settings really apply to all of the company, so if you block an app there, you cannot allow it in the app permission policies. You can see the Who app in this screenshot on the right has an exclamation sign next to it, and it’s a block sign because it was blocked in the org-wide settings. So even if I try to allow it in the app permission policies, it will not work because the org-wide settings override the app permission policy.
Now that we have seen the theory, let’s head over to the demo and see how we can create and manage app permission policies. We are now in the demo environment. Let me open up the browser here where I’m back in the Teams admin center. To manage app permission policies, on the left side navigation under the Teams apps categories, we can go to permission policies. Here is where you will see all of the different permission policies that exist in your organization. If you only have one, like I do right now, the global or org-wide default, it means the same permission policy applies to all of your users. You can go edit it, or we can create a new one. The experience will be the same. We can give it a name, for example, HR users, and then for the three categories we have, so Microsoft apps, third-party apps, and custom apps, we have four choices for each: either allow all apps, allow specific apps and block all others, block specific apps and allow all others, or block all apps. How you configure it really depends on your organizational requirements. You can, for example, allow all apps here for Microsoft apps. For third-party apps, you can block specific apps and allow all others, or allow specific apps and block all others. If you choose either one in the middle, you will need to select what apps you want to allow or block specifically. Let’s go do and select allow all apps. I can select, let’s say, I’ll select one here. Let me search for the other ones. This way, I add a few. I will click on allow. Really important again, if an app is blocked in the org-wide settings, it will not work anyway. You see this app here, the One-on-One Hub, it tells me that, hey, this app is blocked, and I have a warning sign over here as well that tells me, like, hey, there’s something wrong with this app. So again, very important, if an app is blocked at the tenant level in the org-wide settings, the policy doesn’t really matter. And then for custom apps, let’s say we a block all apps and then click on Save. Remember that policies are flexible, so you can have as many policies as you want. Until they’re assigned to a user, they don’t actually do anything.
Now, from a troubleshooting point of view, if, let’s say, a user tells you, hey, I cannot add this app to Teams, but my friend from the other department can, the first thing you have to do is you need to figure out what permission policy is assigned to this user. So I can go here under manage users. Let’s say the user with problems is Vanessa. Let me search here for Vanessa. I will pick Vanessa Lee, and then under policies, I can go and check, okay, for the app permission policy, which is the specific policy that is assigned to Vanessa. You click on it, and then you can check if the app that that user is having problems with is because of the app permission policy. Okay, this is it for this quick demo in which we have seen where to find app permission policies in the Teams admin center. We have done an overview of the settings available, as well as we have also seen how to go to a specific user and find what app permission policy is assigned to them, which is very useful if you want to troubleshoot why a user is having trouble adding or finding a specific app in Microsoft Teams. Now, let’s head back over to the slides and learn about app setup policies.
Now that we know how to manage app permission policies, let’s learn how to also manage app setup policies. App setup policies control how apps are made available to a user in the Teams app. You can use the global or org-wide default policy and customize it, or you can create custom policies and assign them to a set of users. With app setup policies, we can enable or disable apps being uploaded by users, which is also called side loading. You can also enable or disable the ability for users to pin or unpin Teams apps, and you can also decide the order of pinned apps. Finally, you can also decide what apps are already installed for your users. Because it’s policy-based, you can also be flexible in deciding who has what apps in their Teams app, therefore making sure that everyone is productive and has a personalized first experience.
Now that we have seen the theory, let’s head over to the lab and see how we can create and manage app setup policies. We are now in the lab environment. Let me open up the browser. We’re back in the Teams admin center, and set up policies are again under the Teams apps category. By default, every tenant should have two different policies: a first line worker or a global or org-wide default over here. You can, of course, add as many as you want, but again, as it’s a policy, creating a ton of them will not really take effect until you assign it to your users. So I’ll just go back to one of the existing ones here, the global or org-wide default, and let’s take a look at some of the settings. Really important to remember the difference as well between app permission policies and app setup policies. App permission policies are more about what a user is allowed to install. App setup policies, on the other hand, are more about the experience that a user will get in Teams. So our first setting is, do we want to allow a user to upload custom apps or not? So you can, for example, set it off for everybody, however, have a separate policy for developers in which they are allowed to upload custom apps and test them. You can also decide, do you want to allow users to pin and unpin their own apps? So do you want to allow them to change the layout of their personal apps on the left or not? Next up, you can decide what apps are there by default for all of your users, and which apps are installed. So let’s see, for example, I will go into add apps and something that is really cool, if you have, let’s say, an HR app permission policy and an HR app setup policy, you can actually search based on a specific app permission policy. This way, you make sure you don’t misconfigure something and try to install an app that would be blocked by the permission policy. So I’ll go under HR users here, then I can search by name, for example, and see the different apps that I have in there. But for this example, I’ll just search for everything. Let’s switch to approval apps by Microsoft, select it here, and click on Add. Now this app will be installed for all of the users that have this policy assigned. I can also modify the order in which apps are pinned in the Teams app bar. I can add, for example, the approvals app that I just added. Let me search for approvals here. I could add it, and let’s say I want it here, and I want to move it up a bit right under activity. This way, for again, all the users that have this policy, will be their default order of pinned apps. And of course, I can disable user pinning. This way, they’re not allowed to move it.
