Teams App Inventory

The question it answers: Which apps are installed in which teams, which were sideloaded and which third-party apps hold team permissions?

Every app added to a team can read that team’s messages, files or members through the permissions it requested. Sideloaded apps bypassed the org catalogue entirely; third-party store apps with resource-specific permissions can read team data without a tenant-wide admin consent.

Note

One scan fills both Teams Apps and Shared Channels: two to four Graph calls per team, six teams at a time. Large tenants take several minutes. Apps installed only in personal scope or in chats are not included.

At a glance

Where in the app	Tenant › Teams App Inventory
Workload	Teams and collaboration
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Teams.
Report id (API and MCP)	tenant.teams.apps

Columns

Column	Key	Type
App	Name	Text
Source	Source	Status
Team permissions (RSC)	Permissions	Text
Teams	TeamCount	Text
Installed in	Teams	Text
Version	Versions	Text
App id	AppId	Text

Filters

Filter	Key (API)	On when the page opens
Hide apps that look like Microsoft’s	hide-microsoft	Yes

What it needs

Licence: Microsoft Teams.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
Organization.Read.All	Microsoft Graph	Read organization information
TeamsAppInstallation.ReadForTeam.All	Microsoft Graph	Read installed Teams apps for all teams
Channel.ReadBasic.All	Microsoft Graph	Read the names and descriptions of all channels
ChannelMember.Read.All	Microsoft Graph	Read the members of all channels

Data sources it reads

• GET /v1.0/groups?$filter=resourceProvisioningOptions/Any(x:x eq 'Team')
• GET /v1.0/teams/{id}/installedApps?$expand=teamsApp,teamsAppDefinition
• GET /v1.0/teams/{id}/channels?$filter=membershipType eq 'shared'
• GET /v1.0/teams/{id}/channels/{id}/sharedWithTeams
• GET /v1.0/teams/{id}/channels/{id}/members

Through the API and MCP

GET /ir-api/v1/reports/tenant.teams.apps?size=100
GET /ir-api/v1/reports/tenant.teams.apps?filter=hide-microsoft
POST /ir-api/v1/reports/tenant.teams.apps/scan

An AI assistant reads it with the MCP tool get_report and the id tenant.teams.apps. The client needs the Run scan grant for Teams and collaboration. See Using the API.