App permission and setup policies

The three layers

1. Org-wide app settings + catalog (TAC > Manage apps): the tenant verdict per app — allowed/blocked, and the master switches (third-party apps allowed, custom app upload). Blocked here = gone for everyone, end of story.
2. App PERMISSION policies: per-population allow/block — allow-list mode (only-these) or block-list mode per app class (Microsoft / third-party / custom). The user who "can't see the app in the store" lives here.
3. App SETUP policies: the experience — pinned apps and their rail order, pre-INSTALLED apps, and whether users may pin for themselves. The user who "can see it but it isn't on my sidebar" lives here.

Evaluation intuition: layer 1 gates existence, layer 2 gates access, layer 3 arranges furniture. A rollout is all three in order: unblock -> permit -> pin.

Governance realities

• Consent is Entra's, not TAC's: an app needing Graph permissions still crosses Entra admin-consent territory; TAC "allowed" plus Entra "unconsented" = installs then fails. Review both surfaces for any app that touches data.
• RSC (resource-specific consent) lets team owners grant an app powers over ONE team — check the RSC settings stance before assuming central control is total.
• The custom-upload switch is the shadow-IT valve: developer convenience in dev tenants, tightly scoped population in prod.
• Purview's app-governance add-on watches the Graph-permission behaviour of installed apps — the detective control to TAC's preventive ones.

What to watch (proofs)

• The three layers for one app/user: TAC app detail (org state) + Get-CsTeamsAppPermissionPolicy and Get-CsTeamsAppSetupPolicy instances with the user's assignment (Get-CsUserPolicyAssignment) — walk them in order and the "can't see it" ticket self-resolves.
• Both policy families live in the nightly serv365 scan — a changed pin list or a widened permission policy is a drift event with before/after.
• Consent state: Entra > Enterprise applications > the app > permissions — granted vs pending; correlate with "app opens then errors" reports.
• Install telemetry: TAC usage per app — the adoption curve after a rollout, or the popularity of something you meant to retire.