Filtering Blocked or Unblocked Apps

After writing about the Teams Application-Centric Management (ACM) model that replaces app permission policies for Teams apps, I received this question:

One shortcoming of this new model is that it isn’t clear/easy to see what apps you’ve approved or blocked in the manage apps section. You can sort by App status which gets you part of the way there, but it would be really nice if you could filter by app status, do you know if that will be forthcoming?

As I don’t work for Microsoft, I have no idea what the Teams development group is working on to make app status a filterable field in the Teams admin center. Certainly, introducing a filter that can highlight blocked or approved apps seems like a good idea. With over 2,500 apps to manage (Figure 1), any change that helps administrators to focus is appreciated.

When a tenant switches to ACM, the Available to property controls whether an app is blocked or available. The “No one” permission shown in Figure 1 is the same as an app blocked status used by app permission policies. In any case, ACM doesn’t matter because a filter isn’t available for the Available to property either.

Filtering Apps with PowerShell

Given that Teams boasts a comprehensive PowerShell module in addition to Teams cmdlets in the Microsoft Graph PowerShell SDK, there surely must be a way to retrieve apps from the Teams app catalog to report app details using whatever filter is required? Alas, this doesn’t seem to be possible because the cmdlets (and the underlying Graph API requests) return details of the apps known within a tenant. There doesn’t appear to be a cmdlet to return all 2,500-plus apps, even if these are listed in the Teams admin center.

For example, the Get-TeamsApp cmdlet from the Teams PowerShell module returns app information from the tenant app store:

[array]$Apps = Get-TeamsApp

In my tenant, the cmdlet returned 67 apps, including some duplicates such as the Activity app:

Id                                                       DisplayName
--                                                       -----------
69a8054f-7aeb-4e25-a0c5-1837c1a22446                     Activity
14d6962d-6eeb-4f48-8890-de55454bb136                     Activity

Teams is an app built from apps and some of the apps have been redesigned over time, so it’s unsurprising to find multiple entries for some apps. As we’ll see later, this is exactly what happens. The apps have different versions.

The Graph PowerShell SDK Alternative

According to the documentation for the List apps request, the Get-MgAppCatalogTeamApp cmdlet (from the Graph {PowerShell SDK) lists apps from the Microsoft Teams app catalog. This includes apps from the Microsoft Teams store and apps from your organization’s app catalog (the tenant app catalog). Running the cmdlet produced 68 apps.

The Queues (preview) and Dataverse Chat Sync apps are not reported by Get-TeamsApp. The queues app is a new Teams Premium feature for customer call management described in message center notification MC814579 (Microsoft 365 roadmap item 379980). Following its deprecation, the Viva Topics app is now considered as specific to the tenant rather than a Microsoft app included in the app catalog:

Get-MgAppCatalogTeamApp -Filter "distributionMethod eq 'organization'"

Id                                   DisplayName DistributionMethod ExternalId
--                                   ----------- ------------------ ----------
8905c282-649c-44fc-8795-70ec764137c0 Viva Topics organization       f7df4001-86d8-4235-af76-2e7e97f1eaca

The SDK cmdlet returns more information about apps. However, it doesn’t reveal any details about app permissions (ACM) or a blocked/unblocked status. Instead, the details are limited to descriptions and information about when an app was last modified (which isn’t populated for most apps). Here’s a quick script to extract and report some details about apps:

Connect-MgGraph -NoWelcome -Scopes AppCatalog.Read.All
$Report = [System.Collections.Generic.List[Object]]::new()
[array]$TeamsApps = Get-MgAppCatalogTeamApp -ExpandProperty AppDefinitions | Sort-Object DisplayName

ForEach ($App in $TeamsApps) {
    $ReportLine = [PSCustomObject] @{ 
        DisplayName     = $App.DisplayName
        Version         = $App.AppDefinitions.Version
        Id              = $App.id
        Description     = $App.AppDefinitions.Description
        LastModified    = $App.AppDefinitions.LastModifiedDateTime
    }
    $Report.Add($ReportLine)
}
$Report | Out-GridView -Title 'Teams App Details'

Figure 2 shows the output. As you can see, the two entries for the Activity app have differet version numbers and descriptions:

More Information Needed about Teams Apps

Maybe I am missing something fundamental, but I came up blank after spending a couple of days poking around to see if I can find better information. What’s for sure is that better programmatic access to the full Teams app catalog would be appreciated along with better filtering capabilities in the Teams admin center. Is that too much to ask?

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.