Skip to content

Control 2.13: Plugin and Graph Connector Security — Troubleshooting

Common issues and resolution steps for plugin and connector security.

Common Issues

Issue 1: Approved Plugin Not Working After Policy Update

  • Symptoms: A previously approved plugin stops functioning after a Teams app permission policy update
  • Root Cause: Policy changes may inadvertently remove the plugin from the allowlist or change the policy assignment.
  • Resolution:
  • Verify the plugin is on the current allowlist in Teams Admin Center
  • Check the user's assigned app permission policy
  • Re-add the plugin to the allowlist if it was inadvertently removed
  • Allow 24 hours for policy propagation after changes

Issue 2: Graph Connector Returning Unauthorized Content

  • Symptoms: Users see content from Graph connectors that they should not have access to
  • Root Cause: ACL mapping may be incorrect, or the connector may not be enforcing ACLs properly.
  • Resolution:
  • Review the connector's ACL configuration
  • Verify the ACL mapping correctly translates source system permissions to Entra ID
  • Pause the connector, correct the ACL mapping, and re-crawl
  • Test with specific users to verify access restrictions
  • Symptoms: Users submit admin consent requests that go unreviewed, blocking business app usage
  • Root Cause: No dedicated approver or unclear ownership of the admin consent workflow.
  • Resolution:
  • Assign dedicated admin consent reviewers
  • Define SLAs for consent review (24 hours for standard, 4 hours for urgent)
  • Configure email notifications for pending consent requests
  • Pre-approve common low-risk Microsoft first-party apps

Issue 4: Plugin Security Assessment Blocking Business Adoption

  • Symptoms: Business teams report that the plugin approval process takes too long
  • Root Cause: Security assessment process may be too comprehensive for low-risk plugins.
  • Resolution:
  • Create tiered assessment levels based on plugin risk (data access scope, publisher reputation)
  • Fast-track Microsoft first-party and Microsoft-certified plugins
  • Use standardized assessment templates to streamline reviews
  • Maintain a pre-approved plugin catalog that does not require individual review

Diagnostic Steps

  1. Check plugin status: Verify plugin is on the Teams allowlist
  2. Review permissions: Run Script 1 for plugin permission audit
  3. Test connector ACLs: Verify access control on connector content
  4. Check consent policy: Run Script 3 to verify settings
  5. Review audit logs: Search for plugin-related events

Escalation

Severity Condition Escalation Path
Low Plugin approval delays Governance team process improvement
Medium Connector ACL misconfiguration Security Operations and connector admin
High Unauthorized content exposed through connector Security Operations and CISO
Critical Plugin data breach or unauthorized data exfiltration Incident response team immediately