See what an integration can access.
OpenGates helps teams review applications embedded in Microsoft Teams, including the permissions they request and the external domains they declare.
Does the integration need access to other messages?
A support integration posts a ticket summary into one project channel. Its requested permissions extend beyond that channel.
Illustrative permission review
- Request
- Compare the business task with the declared permissions, affected workspaces and data types.
- Review
- The service owner explains the need. A workspace administrator checks the supplier and whether the platform supports narrower permissions.
- Decision
- Record the approved scope and owner. Revisit the approval if the integration requests more access or is no longer used.
The OpenGates platform
OpenGates reviews evidence from Microsoft Teams app manifests.
A new integration can introduce a new recipient for data or a new permission request. List the apps in scope and identify who can approve access and review changes.
OpenGates examines the manifest, declared permissions and external domains, and flags findings for review. A manifest shows what the app declares; confirming runtime behaviour can require additional evidence.
- Manifest and configuration analysis
- Evidence of insecure data handling
- Permission scope alignment
- Continuous monitoring
The value of embedded application security
Use a concrete approval question: does this integration need the access it requests to perform its stated task?
Prioritise findings such as excessive permissions, unexpected external destinations and sensitive information exposed in a URL. Investigate the business impact before changing access.
OpenGates provides evidence for review. An administrator applies any approval, restriction or removal using the collaboration platform’s controls.
How to get started with OpenGates
Bring the app name, the workspace where it is used and a description of the permissions it requests. Discuss an application permissions review
Embedded Application Security FAQs
Why is it important to understand the risks associated with applications embedded within Teams or Slack?
A Teams or Slack integration can introduce new permissions, identities and data flows. Review what it can read or change, where the data goes and who can revoke access.
Do I still need embedded application security checks if Microsoft Teams or Slack have already approved their integrations?
Review the app listing, publisher evidence, requested permissions and your own tenant settings together. A platform listing does not determine whether a particular permission or use is appropriate for your organisation.
How long does it take to assess embedded applications for security weaknesses?
Timing depends on the number of applications, the review depth and the evidence available. Agree the scope and reporting date before the assessment begins.
How is an embedded-app review scoped?
Agree the Teams apps to review, how permissions and domains will be evaluated, and what decisions the report should support. Request pricing for the agreed scope.
Related governance and assurance services
Which Teams apps can access sensitive data in your organisation?
Discuss an application permissions review