Teams App Permission Policy: Global Allow Overridden by Per‑User Block in Production

Answer to the Core Question

Yes – a per‑user block policy always overrides a global allow for the same Teams app. The precedence rule is independent of how the policy was assigned; the most restrictive setting wins.

Why Per‑User Block Overrides Global Allow

• The Teams app‑permission framework evaluates policies in a hierarchy: global → group → user. A user‑level block supersedes a global allow.
• Microsoft Graph’s /teamsAppPolicies/{policyId}/assignments endpoint returns the effective assignment, reflecting per‑user blocks even when the global policy permits the app.
• UI caching in the Teams Admin Center can delay the visibility of recent per‑user changes, creating the impression that the global policy is still in effect.

How to Verify the Effective Policy

Use Microsoft Graph or PowerShell to query the user‑specific assignment for the app. The response will indicate whether the app is allowed or blocked for that user.

Graph API Call

GET https://graph.microsoft.com/v1.0/teamsAppPolicies/{policyId}/assignments?\n    filter=appId eq '{appId}' and userId eq '{userId}'

Example response showing a block:

{\n  "value": [\n    {\n      "id": "assignmentId",\n      "appId": "{appId}",\n      "userId": "{userId}",\n      "allow": false\n    }\n  ]\n}

PowerShell (Microsoft.Graph module)

Install-Module -Name Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "TeamsAppPolicy.Read.All"
$policyId = "{policyId}"
$appId    = "{appId}"
$userId   = "{userId}"
$assignment = Get-MgTeamsAppPolicyAssignment -PolicyId $policyId -Filter "appId eq '$appId' and userId eq '$userId'"
$assignment | Format-Table id, appId, userId, allow

Cross‑Check by Installing the App

Log into Teams as the user and attempt to add the app. If the install dialog is suppressed or a “blocked” message appears, the per‑user block is in effect.

Limitations of the Teams Admin Center

• The Admin Center only displays the global policy for an app.
• It does not surface per‑user or group overrides, so the effective state is not visible there.
• There is currently no supported UI feature to simulate or preview the effective policy per user.

Practical Steps for Administrators

1. Identify the policyId for the Teams app permission policy you want to inspect.
2. Determine the appId of the Teams app (available in the app manifest or via GET /teamsApps).
3. Use the Graph API or PowerShell query above to retrieve assignments for the target user.
4. If the response shows allow: false for that user, the per‑user block overrides the global allow.
5. Optionally, perform a test install in a sandbox Teams client to confirm the Graph result.

Summary

Per‑user block policies are the most restrictive level in Teams app‑permission evaluation. They always win over a global allow, regardless of assignment method. The Teams Admin Center cannot display the effective policy, so administrators must rely on Microsoft Graph or a direct install test to verify the final state before rolling out changes to production.