The Rise of Embedded Apps and Their Security Risks

Why we should be focusing on embedded app security

A collaboration app can bring project records, approvals or customer information into Teams or Slack. The value is easy to see. The permissions, identity flows and external connections behind that workflow deserve a separate review. Slack Trello 3CX

Integrations can take several forms, including tabs, bots and connectors. Four questions can make their risks easier to assess.

1. What business task does the app perform, and who owns it?

2. Which teams use it, and what information do they share through it?

3. Who can install or approve the app? Teams administrators can manage app availability, and Slack workspace owners can require approval before installation.

4. Which permissions, identities and external services does the workflow depend on?

Record the answers before approval and revisit them when the publisher, permissions, configuration or intended use changes.

What Microsoft’s app assurance signals tell you

Publisher Attestation is a developer’s self-assessment. Microsoft 365 Certification involves independent assessment against security controls. Check which evidence a specific app provides and whether it covers the service and permissions you intend to use.

Microsoft 365 apps

Word, Excel, PowerPoint and OneNote can support collaboration inside Teams. Check how the relevant sharing and tenant settings apply to the workflow.

Other Microsoft integrations

An integration with Dynamics 365 or SharePoint can connect business records to a Teams workflow. Review the data and identities involved.

Third-party applications

Examine the publisher, declared permissions, external destinations and available assurance evidence before approving a third-party integration.

Custom applications

For an internally developed app, identify the development owner, deployment process and evidence for the APIs and services it calls.

These are examples of application sources, rather than Microsoft trust levels. Decide what additional evidence your organisation needs for each integration.

How OpenGates reviews Microsoft Teams apps

Installing an app can add a permission or a data pathway. Compare the requested access with the app’s purpose, and check what has already been approved in your tenant.

Third-party libraries and services may change independently of the integration. Ask the publisher who maintains them and how it communicates changes.

OpenGates evaluates Teams app manifests, requested permissions and declared external domains. Use the results to decide what to allow, investigate or restrict.

1. Manifest and configuration analysis

• Review the external domains declared by the app and the context for each destination. Confirm runtime behaviour and data residency separately where those factors affect approval.

2.Insecure data handling

• Check for sensitive data in URL query strings. Such data can enter browser histories, application logs or proxy logs, depending on configuration.

3.Permission scope alignment

• Compare requested permissions with the business task. A meeting-notes app that requests broad access to files needs a documented reason for that access.
• Flag permissions that do not fit the stated purpose, such as a request for location or contact details from an app intended only to record meetings. An analyst or administrator should decide whether the access is justified.

4.Continuous monitoring

• Monitor for changes to the manifests and permissions in scope. Decide who will review a change and when the existing approval should be reopened.
• Use the dashboard to review findings for the assessed apps and record the next decision.

The value of embedded app security and how to get started

Many organisations are still in the very early stages of understanding just how significant the real-world threats are from these small embedded applications.

Common review questions include configuration mistakes, unsupported components and unnecessary data access. A manifest alone cannot establish everything an app does at runtime.

OpenGates supplies assessment evidence. Administrators apply restrictions in Teams and review the outcome against the organisation’s policy.

How to get started with OpenGates embedded app security

For an app running inside Teams or Slack, review the embedded app’s permissions and data access. If you own the application and can authorise testing, agree a scope for the web application or its API.

Ask the team what a demonstration or evaluation covers, what information is needed and how findings will be presented.

What the Teams app review can examine

• Rapid discovery and risk scoring of installed embedded apps within Teams.
• Deep configuration analysis of manifests, URL scopes, and permissions.
• Indicators of potentially unsafe data handling, with follow-up checks where runtime evidence is needed.
• Clear, human-readable risk narratives tailored to app purpose and business context.
• Actionable recommendations for configuration changes, usage restrictions, and policy templates.
• A dashboard showing findings for the embedded applications that have been assessed.