Agency-reported issue: MS.TEAMS.5.1v1 displays warning for Microsoft apps

[mitchelbaker-cisa]

🐛 Summary

MS.TEAMS.5.1v1 states the following, "Agencies SHOULD only allow installation of Microsoft apps approved by the agency."

We received a public report that M365-Teams-App-Permission and M365-Teams-ThirdParty-App-Permission may be incorrect in the report output. Determine if the Rego for this policy needs to be tweaked.

To reproduce

Steps to reproduce the behavior:

1. Recommend going into the respective admin console for Teams to see how we can best replicate this scenario. MS.TEAMS.5.1v1 implementation instructions.

Expected behavior

• MS.TEAMS.5.1v1 should report specifically on Microsoft applications
• MS.TEAMS.5.2v1 should report specifically on third-party applications
• MS.TEAMS.5.3v1 should report specifically on custom applications

[mitchelbaker-cisa]

@nanda-katikaneni First let's speak with the agency POC to determine if the policy can be configured correctly on their end. Based on their screenshot M365-Teams-App-Permission seems like a Microsoft-specific policy, whereas M365-Teams-ThirdParty-App-Permission is applicable to third-party applications. This may simply be a misconfiguration on the agency's part and may not require code changes. If true then we can close as not implemented.

[nanda-katikaneni]

Emailed the agency POC and waiting for the response (02/13).