How to Give Permission to Install TeamsWork Apps in Microsoft Teams
Updated: Oct 7
Are you facing difficulties installing TeamsWork Apps in Microsoft Teams?
We have compiled the permission issues you might face and their solutions. Many users encounter these issues, and the most common reason is that their Teams administrator, often from the IT department, needs to approve the app first.
There are two moments where Microsoft Teams may ask for administrator approval. You may see one or both.
1. You cannot install the app
Your administrator has restricted app installations in Microsoft Teams. This is often in place to maintain security and to ensure that only approved apps are installed in the organization's Teams environment.
2. The app asks for permissions, but it needs admin approval
The app is installed, but it needs permissions that only an administrator can grant. You will see a screen titled Need admin approval.
For the app to work inside Microsoft Teams, it needs a small number of permissions, such as:
Signing you in and reading your basic profile information
Reading the members of the Teams and channels where the app is used
Sending you notifications in Teams
We request only the permissions the app needs to run. Nothing more, nothing less. The full list, with Microsoft's own description of each one, is published on the Microsoft 365 App Certification page: Ticketing as a Service CRM as a Service
In both cases the app is not blocked permanently. Your Teams administrator needs to approve it once, and then everyone in your organization can use it.
If you are not a Teams administrator
Contact your Teams administrator or your IT helpdesk and ask them to approve the app. It helps to tell them which app you need and to share the link to this page, so they can see the approval steps.
If your IT team has questions about the app, the permissions it requests, privacy or compliance, we are happy to speak with them directly. Contact us.
If you are a Teams administrator
Depending on what your users are seeing, you may need to:
To improve discovery of the App to your users, you can also:
e) Pre-Install the App to a Channel from the Teams Admin Page If you use the email-to-ticket feature and cannot grant permission from the app, you can grant it directly from Azure:
a) Unblock the TeamsWork App:
As a Teams administrator, visit Teams Admin center page: https://admin.teams.microsoft.com/policies/manage-apps/, and search for the TeamsWork App.
If the App status is Blocked
Click the app to open its settings and select Unblock App.
Or click the ellipsis (three dots), go to Actions, and select Unblock App.
If you want to remove or block an app instead, visit this tutorial: how to remove and block an app.
b) Make the app available to your target audience:
Open the app's settings. Scroll to the bottom and locate the Users and Groups section.
Update the availability settings to include the group of users authorized to install the app.
Note: These changes may take some time to propagate.
c) Grant the app the permissions it needs
To work inside Microsoft Teams, the app requires a small set of permissions, including access to the members of the Teams or channels where it is used. This allows the app to assign work to the right people, display the correct names, and send notifications.
The full list of permissions, with Microsoft's description and justification for each, is on the Microsoft 365 App Certification page for each app, linked at the top of this page.
There are two ways to grant these permissions:
Option 1: Admin Consent (Recommended)
You grant consent on behalf of the entire organization. After that, all users can use the app without any further prompts. From the Teams admin page, open the Permissions tab and click Grant admin consent.
Option 2: Individual User Consent
Each user grants permission themselves the first time they use the app. Every user will have to do it, and some organizations disable individual user consent by policy. If yours does, use Option 1.
This is the step that resolves the Need admin approval screen your users may be seeing.
d) Whitelist IPs
Some users may still experience problems when accessing the app, such as connection errors. One possible reason is that their firewall is blocking Azure Front Door’s IP addresses. Since Azure’s IP ranges change over time, firewalls that restrict inbound or outbound traffic may unintentionally block legitimate requests, leading to disruptions.
To ensure smooth connectivity, follow these steps:
Step 1: Download the Latest IP List
Since TeamsWork Apps operates on Microsoft Azure Cloud Services, it utilizes multiple dynamic IP addresses. To prevent connectivity issues, users must whitelist all relevant Azure IP ranges.
Step 2: Search AzureFrontDoor IPs
Once you have the IP list:
Open the downloaded file.
Search for "AzureFrontDoor.Frontend".
Under "addressPrefixes", you'll find the list of IPs you need to whitelist.
By completing these steps, you ensure TeamsWork Apps can function seamlessly within your network environment.
e) Pre-Install the App to a Channel from the Teams Admin Page
(Applicable for Ticketing and Checklist App only)
While waiting for the availability settings to take effect, you can install the app to a Channel from the Teams Admin page.
Select the app using the option button on the left and click Add to Team.
On the right-hand panel, select the Teams channel where you want to install the app.
At this stage, you are only allowing the app to be added to this Teams channel. To effectively add the app to this Teams channel:
Open Microsoft Teams and navigate to the Teams channel you selected earlier.
Select the option to Add a Tab (or App).
Search for the TeamsWork App and add it to the channel.
And voilà! You’ve successfully added the app to the channel.
If you're unsure how to proceed or need assistance with the installation process, don't hesitate to reach out to us. For more information please read this Microsoft documentation.
f) Grant admin permission for the Mail Sync app
(Applicable for Ticketing App only)
Go to the Azure portal at:
In the search bar, type Ticketing As A Service - Mail Sync Service
(Note: The app name might vary slightly depending on the region/version installed.)
Click on the Mail Sync Service app from the list.
Navigate to Security > Permissions.
Click the Grant admin consent button to approve the required permissions.
Once completed, the Mail Sync Service plugin will have the necessary access to support mail-to-ticket creation and email notifications.
Committed to Secure & Transparent Permissions
We are committed to user privacy and security, so we request only the permissions the app needs to work. Nothing more, nothing less.
Ticketing as a Service is Microsoft 365 Certified, which means Microsoft has independently reviewed the permissions we request and how we handle data.
Still not working?
If you are still facing issues, or have any questions about permissions, privacy or compliance, please contact us. We are happy to speak with your IT team directly and help with the installation.
Comments