+To share an app to the meeting stage, you must configure the context and resource-specific consent (RSC) permissions in the [app manifest](../resources/schem):

+1. For a video streaming app, a user might want to share content from a single content provider at a time (for example, YouTube) versus sharing an entire video catalog onto stage.

+|**appContentURL**| String | Yes | The URL that's shared on to the stage. |

+|**callback**| String | Yes | Callback contains two parameters, error and result. The *error* can contain either an error of type *SdkError* if there's an error or null when share is successful. The *result* can contain either an `IAppContentStageSharingState` object when share is successful or null if there's an error.|

+|**callback**| String | Yes | Callback contains two parameters, error and result. The *error* can contain either an error of type *SdkError* or null when share is successful. The result can contain either an `IAppContentStageSharingCapabilities` object, when share is successful or null if there's an error.|

+|Meeting stage sample | This sample app shows a tab in meeting stage for collaboration. This sample also uses Live Share SDK for collaborative Stageview. | [View](https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/meetings-stage-view/csharp) | [View](https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/meetings-stage-view/nodejs) | [View](https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/meetings-stage-view/csharp/demo-manifest) |

+| In-meeting document signing | This sample app shows how to implement a document signing Teams app. Includes sharing specific app content to stage, Teams single sign-on (SSO), and user specific Stageview. | [View](https://github.com/officedev/microsoft-teams-samples/tree/main/samples/meetings-share-to-stage-signing/csharp) | NA | NA |

+Prior to a meeting, your app's available to users in a tab. The following example shows a draft survey question that people can answer during the meeting:

+|2|**Share to meeting button**: The entry point to share the app to the meeting. For a consistent experience, always use the standard Teams share icon. **Share to meeting** is the recommended default text, but you can also customize it for your use cases. For example, **Play together** for a gaming app or **Watch together** for a video app. Either way, make it clear that the action creates a shared, interactive experience with everyone in the meeting.|

+> * The `GetParticipant` API is only supported for distributions lists or rosters with less than 350 participants.

+| `recipients` | List of user IDs. Get user IDs for meeting participants through [Get participant API](#get-participant-api). Get the entire list of chat roster using [Get members API](../bots/how-to/get-teams-context.md#fetch-the-roster-or-user-profile). An empty or null recipients list returns 400.|

+| `content.value.url` | **Optional**; URL to be rendered in the notification. Make sure the URL is part of `validDomains` in app manifest. If an empty string or no URL is provided, nothing is rendered on a meeting notification. |

+The meeting details API enables your app to get a meeting's static metadata. The metadata provides data points that don't change dynamically. The API is available through Bot Services. Both private scheduled or recurring meetings and channel scheduled or recurring meetings support API with different RSC permissions respectively.

+description: Learn more about Live Share SDK capabilities, RSC permissions, and live data structures.

+#### NPM

+#### Yarn

+That's all it took to set up your container and join the session mapped to the meeting, chat, or channel. Now, let's review the different types of _distributed data structures_ that you can use with the Live Share SDK.

+> Unlike `SharedMap`, the `state` value in `LiveState` is reset after all the users disconnect from a session.

+ // Update app to reflect that the user isn't following anyone and there is no presenter.

+ // Update app to reflect that the user isn't following anyone and there is no presenter.

+In `meetingStage` contexts, your users are collaborating and presenting synchronously to facilitate more productive discussions. When a user presents content to the meeting stage, you should call the `startPresenting()` API for the initial presenter. In `content` contexts like collaborative stageview, content is most commonly consumed asynchronously. In this case, it's best to let users opt into real-time collaboration, such as through a "Follow" button. Using the `teamsJs.app.getContext()` API in the Teams JavaScript SDK, you can easily adjust your functionality accordingly.

+ // isShareInitiator isn't declared in the typedocs in the SDK, so we cast as any

+ // isShareInitiator isn't declared in the typedocs in the SDK, so we cast as any

+- Use any feature of Fluid Framework, such as `SharedMap` and `SharedString`.

+When collaborating in real time, it's essential for users to be able to point out and emphasize content on the screen. Live Share canvas makes it easy to add inking, laser pointers, and cursors to your app for seamless collaboration.

+While most of you find it preferable to use our free hosted service, there are still situations where it's beneficial to use your own Azure Fluid Relay service for your Live Share app.

+As we've mentioned earlier, there are two meeting contexts: `meetingStage` and `sidePanel`. In the following section, explore how to optimize these contexts to enhance the user experience.

+The `meetingStage` context allows users to share your app content to the meeting stage for participants in the meeting. In this context, users typically expect to collaborate in real time. Unlike when loading a collaborative app like Microsoft Loop or Word in a web browser, presenters usually expect to have more control of the experience. For example, in PowerPoint Live, presenters expect to have control over which PowerPoint slide is visible to attendees by default, even if attendees can choose to stop following them temporarily.

+- Configuration settings before sharing content to the meeting stage, such as disabling the "take control" feature.

+Chat and channel tabs allow users to pin your application to a chat or channel. A tab that supports both `sidePanel` and `content` features the same pinned URL, but the use cases are fairly different. For starters, chat and channel tabs generally have more horizontal space to work with. As a best practice, allow users to search for content to "pin" to the tab. For example, teachers using a note app may pin notes containing educational resources for their students.

+While chat and channel tabs are most commonly used for asynchronous consumption, it's possible for your users to have the same content at the same time. When this happens, it's useful to keep content in sync to prevent data conflicts or duplication of work. Live Share allows you to show what content each user is viewing, what they're doing, and more. This can provide social incentives that draw users into app content, increasing engagement and collaboration. We call this "coincidental collaboration."

+- Show which users are viewing content pinned to the tab, such as users actively viewing each whiteboard.

+- Show which users are viewing the content and what they're doing, such as displaying a user's avatar at the position they are at in a video.

+Live Share has a dedicated React integration, making Live Share features even easier to integrate into React apps. Rather than using `LiveShareClient` directly, you can use the `LiveShareProvider` component to join a Live Share session when the component first mounts. Each `LiveDataObject` has a corresponding React hook, designed to make using Live Share incredibly easy. For more information, see Live Share for React [GitHub page](https://aka.ms/livesharereact).

+Here, `12345` is the signaling port, `8445` is the application-hosted port, and `12332` is the remote media port exposed by ngrok. Note that we have a forwarding from `1.bot.contoso.com` to `1.tcp.ngrok.io`. This is used as the media URL for the bot. Of course, these port numbers are just examples and you can use any available port.

+> Your local instance must be listening to HTTP traffic on the signaling port. The requests made by the calls and online meetings platform reach the bot as localhost HTTP traffic unless end-to-end encryption is set up.

+An application-hosted media bot has the following requirements:

+* The bot must be developed in C# and the standard .NET Framework and deployed in Microsoft Azure. The Graph Communications SDK supports .NET 6 and .NET Core frameworks. You can't use C++ or Node.js APIs to access real-time media.

+ * Infrastructure as a Service (IaaS) Virtual Machine (VM).

+ * Azure Kubernetes Service (AKS).

+* Bot Framework Emulator doesn't support application-hosted media bots.

+* The VM instance hosting the real-time media bot must have at least two CPU cores. For Azure, a Dv2-series virtual machine is recommended. For other Azure VM types, a system with four virtual CPUs (vCPU) is the minimum size required. Detailed information about Azure VM types is available in the [Azure documentation](/azure/virtual-machines/windows/sizes-general).

+- **How to create an authentication-enabled bot**. Use [cs-auth-sample][teams-auth-bot-cs] to handle user sign-in credentials and the generating the authentication token.

+- The latest versions of Microsoft Visual Studio and Git.

+The resource group and the service plan aren't strictly necessary, but they allow you to conveniently release the resources you create. We recommend that you keep your resources organized and manageable.

+ 1. Select the **Create** button. It might take a few minutes to create the resource group.

+ 1. Select **Create**. It might take a few minutes to create the app service plan. The plan is listed in the resource group.

+ > You must create and register this Microsoft Entra resource in a tenant in which you can consent to delegate permissions requested by an application. For instructions on creating a tenant, see [Access the portal and create a tenant](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant).

+1. After Azure creates the app, it displays the **Overview** page for the app. Copy and save the following information to a file:

+ 1. The **Application (client) ID** value. Use this value later as the *Client ID* when you register this Azure identity application with your bot.

+ 1. The **Directory (tenant) ID** value. Use this value later as the *Tenant ID* when you register this Azure identity application with your bot.

+ 1. Before leaving this page, **record the secret**. Use this value later as the *Client secret* when you register your Microsoft Entra application with your bot.

+ h. For **Resource URL**, enter `https://graph.microsoft.com/`. This URL isn't used in the code sample.

+ 1. **Name**. Enter a name for the connection. Use this name in your bot in the `appsettings.json` file. For example, *BotTeamsAuthADv2*.

+ Depending on the characters in your bot secret, you might need to XML escape the password. For example, any ampersands (&) must be encoded as `&`.

+ Depending on the characters in your bot secret, you might need to XML escape the password. For example, any ampersands (&) must be encoded as `&`.

+ Depending on the characters in your bot secret, you might need to XML escape the password. For example, any ampersands (&) must be encoded as `&`.

+Install [Microsoft Bot Framework Emulator](https://aka.ms/bot-framework-emulator-readme). For more information, see [test and debug with the Emulator](/azure/bot-service/bot-service-debug-emulator?view=azure-bot-service-4.0&tabs=csharp&preserve-view=true).

+After you configure the authentication mechanism, you can perform the actual bot testing.

+ The following image is an example of the bot UI after you sign in:

+ :::image type="content" source="../../../assets/images/authentication/auth-bot-login-emulator.PNG" alt-text="Screenshot shows an example of the bot UI after you sign in.":::

+ The following image is an example of the bot UI after you sign in:

+ :::image type="content" source="../../../assets/images/authentication/auth-bot-login-deployed.PNG" alt-text="Screenshot shows an example of the Teams bot UI after you sign in.":::

+Teams is an entirely cloud-based product. It requires all services it accesses to be available from the cloud using HTTPS endpoints. Therefore, to enable the bot (our sample) to work in Teams, you need to either publish the code to the cloud of your choice, or make a locally running instance externally accessible via a **tunneling** tool. We recommend [ngrok](https://ngrok.com/download), which creates an externally addressable URL for a port you open locally on your machine.

+With authentication, Teams behaves differently than other channels.

+Within a dialog step, use `begin_dialog` to start the OAuth prompt, which asks the user to sign in. If the user is already signed in, it generates a token response event, without prompting the user. Otherwise, it prompts the user to sign in. The Azure Bot Service sends the token response event after the user attempts to sign in.

+Sending proactive messages to the users is an effective way to communicate with your users. However, from the user's perspective, the message appears unprompted. If there's a welcome message, it marks their first interaction with your app. It's important to use this functionality and provide the complete information to the user to understand the purpose of this message.

+> In this payload, `conversation.id` and `channelData.settings.selectedChannel.id` are the IDs of the channel that the user selected during app installation or from which the installation was triggered.

+In this example, the `conversation.id` of the `conversationUpdate` and `installationUpdate` activities is set to the ID of the Response channel in the Daves Demo team.

+For more information about the `appInstallDialog` module, see [appInstallDialog module](/javascript/api/@microsoft/teams-js/appinstalldialog?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-appinstalldialog-openappinstalldialog).

+You can trigger navigation from your tab using the [pages.navigateToApp()](/javascript/api/@microsoft/teams-js/pages?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-pages-navigatetoapp) function as shown in the following code:

+For more information about navigation within a tab app, see [navigate within a tab app](../../tabs/how-to/tab-navigation.md). For more information about using the pages capability, see [pages.navigateToApp()](/javascript/api/@microsoft/teams-js/pages?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-pages-navigatetoapp) and the [pages](/javascript/api/@microsoft/teams-js/pages?view=msteams-client-js-latest&preserve-view=true) namespace for other navigation options. If needed directly open a deep link using the [app.openLink()](/javascript/api/@microsoft/teams-js/app?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-app-openlink) function.

+Add a **copy link** action to each item in whatever way best suits your UI. When the user takes this action, call [`pages.shareDeepLink()`](/javascript/api/@microsoft/teams-js/pages?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-pages-sharedeeplink) to display a dialog containing a link that the user can copy to the clipboard. When you make this call, pass an ID for your item. You get it back in [context](~/tabs/how-to/access-teams-context.md) when the link is followed and your tab is reloaded.

+For more information, see [pages.shareDeepLink()](/javascript/api/@microsoft/teams-js/pages?view=msteams-client-js-latest&preserve-view=true#@microsoft-teams-js-pages-sharedeeplink).

+ Most growth and GTM activities during this stage are pilots to discover effectiveness, learning, and execution rhythms. When the app crosses the *traction barrier*, one can say it has achieved product market fit in Teams marketplace and ecosystem.

+- **Scale stage**: This stage encompasses scaling in the market on the back of activation in existing customers who use the Software as a Service (SaaS) app outside Teams and selling to new customers through product-led, sales-led, and channel-led initiatives. Growth and GTM activities become more programmatic at this stage. When the app crosses the scale barrier, often also referred to as the *growth barrier*, one can conclude the apps is ready to deliver on the business goals and starts to deliver ROI on engineering and GTM investments.

+There might be examples of developers short circuiting the lifecycle to jump across stages, for example, directly starting to monetize their app after launch using their version 1 experience itself. It's recommended that you follow a stage-by-stage approach as a best practice that most developers follow to derive the best ROI from their Teams app journey.

+Get started first by reviewing (and sharing with your GTM leaders) this high-level visual [Guide to ISV success with Microsoft for Teams Partners](https://aka.ms/teamsappsGTMguide) flipbook. This resource orients you about how to plan and strategize your Teams app offering, insights about key industry-wise personas and trends, how to define your appΓÇÖs value proposition, create content to maximize your appΓÇÖs reach among customers and sellers, access various partner benefits available to you, how to visualize a simplistic customer journey with your app, how to align your marketing activities with key opportunities from Microsoft and how to sell your app through MicrosoftΓÇÖs global marketplace. As you can see from the flipbook, Microsoft partners with app developers once theyΓÇÖve launched their apps on the marketplace by offering select, programmatic GTM investments depending on the appΓÇÖs maturity in the market. You're encouraged to get in touch with your Microsoft field, account, or engineering representatives before spending cycles on your app growth planning and execution, so that you can get the most appropriate guidance youΓÇÖre eligible for.

+- The app launched on Teams.

+## Best practices for app growth and adoption

+To accelerate the growth of third-party apps and increase the adoption rates, consider the following strategies:

+- **Leverage a freemium model**: It's proven that a basic freemium account significantly improves user conversion rates. It allows users to experience the core benefits of your app without initial costs and increases the chances of conversion to paid plans. It's recommended to offer a free trial period of 30 days.

+- **Integrate a shareable call-to-action**: Implement a dynamic call-to-action (CTA) button within an Adaptive Card. It enables users to share your app effortlessly, to onboard their team members, thereby fostering organic growth.

+- **Implement adoption change management**: Consistent communication with users is a key. Update users regularly about the new and existing features through email, which helps maintain their interest and encourages continued use of your app.

+- **Identify and resolve blockers**: Proactively address and resolve any issues to drive app adoption. Collaborate with partners to gather feedback and eliminate any blockers that hinder the user experience.

+- **Embrace growth marketing**: Develop a dynamic growth marketing strategy tailored for SaaS offers that focuses on driving usage through data-driven techniques and user engagement analytics.

+ Here are a few recommendations for growth marketing strategies:

+ - Send active notifications to users through email with a CTA to the Teams app.

+ - Conduct targeted campaigns on social media with direct links to the Teams app.

+ - Secure a premium placement for the Independent software vendor (ISV) Teams app on SaaS platforms with a CTA to the Teams app.

+ - Create informative blog posts, tutorials, or webinars that highlights the unique features of your Teams app.

+By adopting these methods, you can observe an increase in app installations, sustained engagement, and growth over time. For more information, see [educate users and drive adoption change management for your app](~/promote-app-adoption.md#step-3-educate-users-and-drive-adoption-change-management-for-your-app).

+description: App that requires device permissions, such as camera or microphone access, now require users to manually grant permission at a per app level in the web browser.

+A user needs to enable these permissions in the browser for these permissions to take effect. After user changes the appΓÇÖs device permissions in the browser, they're prompted to reload the application in Teams.

+| Tab device permissions for browser | The sample shows how to show the device permissions using TeamsJS SDK and browser APIs. | [View](https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/tab-device-permissions/nodejs) | [View](https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/tab-device-permissions/nodejs/demo-manifest/tab-device-permissions.zip)

+ Title: Preapproval of RSC permissions

+description: In this article, learn more about to create, manage, and delete preapprovals of RSC enabled app in Microsoft Teams.

+ms.localizationpriority: medium

+# Preapproval of RSC permissions

+Resource-Specific Consent (RSC) permissions preapproval provides admins with granular control over the RSC permissions an app can request upon installation. RSC permissions are granted to an app at the time the app gets installed. Through the use of pre-approval policies, admins can declare ahead of time the maximum permissions an app can request from the end user and be consented to during installation time.

+For an RSC permission pre-approval policy to take effect for an app, the admin must ensure that the app is enabled (installable) in their organization. If the app is not installable, then the permission pre-approval for that specific app becomes irrelevant. For more information on enabling apps in Teams Admin Center, see [managing apps in Teams Admin Center](/microsoftteams/apps-in-teams).

+Admins can create a detailed preapproval policy, based on the app ID, permissions, and the sensitivity of the accessed data. Preapproval of RSC permissions are designed for admins seeking to create advanced custom policies for their organization.

+By default, the preapproval policies are managed by Microsoft, and we recommend that organizations maintain `ManagedByMicrosoft` state. This state allows Microsoft's security team to deliver the best security for your organization.

+> [!NOTE]

+>

+> * Preapproval of RSC permissions are available only in [public developer preview](../../resources/dev-preview/developer-preview-intro.md).

+> * Preapproval of RSC permissions and its operating procedures are subject to change.

+## Set up PowerShell to manage preapproval of RSC permissions

+Preapproval of RSC permissions are managed through Microsoft Graph PowerShell. You can learn more about managing Microsoft Teams with PowerShell [here](/powershell/microsoftgraph/get-started).

+To create, manage, and delete RSC preapproval policies, you must grant the following permissions to the PowerShell cmdlet:

+* `TeamworkAppSettings.ReadWrite.All`

+* `Policy.ReadWrite.Authorization`

+* `AppCatalog.Read.All`

+* `Policy.ReadWrite.PermissionsGrant`

+* `InformationProtectionPolicy.Read`

+* `Application.ReadWrite.All`

+> [!NOTE]

+> You need global admin level privileges to connect Graph with your organization for the first time.

+The following is an example of the PowerShell setup to manage preapproval policies of RSC permissions:

+```powershell

+Connect-MgGraph -Scopes @('TeamworkAppSettings.ReadWrite.All', 'Policy.ReadWrite.Authorization', 'AppCatalog.Read.All', 'Policy.ReadWrite.PermissionGrant', 'InformationProtectionPolicy.Read', 'Application.ReadWrite.All')

+```

+## Allow RSC permissions for apps in your organization

+For both team and chat specific RSC permissions, admins can set four different states for their organization. Apart from `DisabledForAllApps` state, all the other states allow RSC permissions to different degrees. These states can be set through `Set-MgBetaChatRscConfiguration` and `Set-MgBetaTeamRscConfiguration` cmdlets.

+For example, to allow RSC permissions for all unblocked apps in your organization, use the `Set-MgBetaTeamRscConfiguration -State EnabledForAllApps` cmdlets.

+The following are the different states that allow and disallow RSC permissions in your organization:

+|Configuration| Description|

+|||

+|`ManagedByMicrosoft`|A dynamic policy administered by Microsoft. It might be updated based on best security practices. By default, this state enables RSC for all unblocked apps in the organization. |

+|`EnabledForAllApps`|Users can consent to RSC permissions for any unblocked apps in the organization. |

+|`EnabledForPreApprovedAppsOnly`| Users in the organization can consent to only those unblocked apps that also have an explicit preapproval policy associated with them. This option must be used only if the admin wants to explicitly limit the allowed RSC permissions on a per app basis. |

+|`DisabledForAllApps`| Users can't consent to the RSC permissions required by any app even if the app is unblocked in the organization. **Warning:** This state doesn't allow installation for apps that need RSC permissions. |

+ >[!WARNING]

+ > If you change your chat or team RSC configuration to `DisabledForAllApps`, it disables preapproval in your tenant and users run into errors when they install RSC enabled apps.

+## Enable RSC permissions for all unblocked apps in the organization

+You can enable RSC for all unblocked apps in your organization using PowerShell cmdlets by changing your RSC permission setting state to `EnabledForAllApps`. You can set the state for both chat and team RSC settings in your organization as follows:

+```powershell

+Set-MgBetaTeamRscConfiguration -State EnabledForAllApps

+Set-MgBetaChatRscConfiguration -State EnabledForAllApps

+```

+## Enable RSC for a specific set of apps only

+You can create preapproval policy for specific apps with the permissions and sensitivity labels of the data you wish you preapprove. The following sections show how to create a preapproval policy with and without a sensitivity label attached.

+### Create a preapproval policy based on app ID and permissions

+Preapproval policies allow users in your organization to consent to RSC permissions for a specific set of apps. This implies that you can determine which RSC-enabled apps your organization can access, without limiting RSC permissions for all apps within your organization.

+To create a preapproval policy without a sensitivity label, ensure that you have the following information:

+* Teams App ID.

+* The RSC permissions associated with the app.

+* Team or Global admin privilege in your tenant.

+You can use PowerShell cmdlets to create a preapproval policy. To create the cmdlet, you must get the information mentioned earlier with the `New-MgBetaTeamAppPreApproval` command and specify the one of the following RSC permissions you want to preapprove in the cmdlet:

+|Configuration| Description|

+|||

+|`ResourceSpecificApplicationPermissionsAllowedForChats`|Use this configuration when creating a preapproval policy for RSC permissions for a chat. For a list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+|`ResourceSpecificApplicationPermissionsAllowedForTeams`|Use this configuration when creating a preapproval policy for RSC permissions for a team. For a list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+**Preapprove an app with team RSC permissions**

+```powershell

+New-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForTeams @('ChannelMessage.Read.Group') -TeamLevelSensitivityLabelCondition AnySensitivityLabel

+```

+**Preapprove an app with chat RSC permissions**

+```powershell

+New-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForChats @('OnlineMeeting.ReadBasic.Chat')

+```

+**Preapprove an app with both team and chat RSC permissions**

+```powershell

+New-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForChats @('OnlineMeeting.ReadBasic.Chat') -ResourceSpecificApplicationPermissionsAllowedForTeams @(ΓÇÿChannelMessage.Read.GroupΓÇÖ) -TeamLevelSensitivityLabelCondition AnySensitivityLabel

+```

+>[!WARNING]

+> Your preapproval policy creation might fail if you link the wrong permissions with the wrong permission type in your cmdlet. Ensure that the chat RSC permissions end with `.Chat` and the team RSC permissions end with `.Group`.

+### Create a preapproval policy based on app ID, permissions and sensitivity labels

+Preapproval policies can be created to preapprove RSC permissions against certain sensitivity labels in your tenant. This enables you to control the data that RSC-enabled apps can access. Here, you can learn the process to create a preapproval policy based on the sensitivity of the data.

+You can also create a preapproval policy for specific permissions in addition to specific sensitivity labels. You can allow all RSC consent requests to be approved for a particular permission. To create a preapproval policy, ensure that you have the following information:

+* Teams App ID.

+* The RSC permissions associated with the app.

+* The sensitivity label ID associated with the sensitivity label. This isn't required if you want the policy to apply to all sensitivity labels or if you preapprove only chat RSC permissions.

+* Team or Global admin privilege in your tenant.

+You can use PowerShell cmdlets to create a preapproval policy. To create the cmdlet, you must get the information mentioned earlier with the `New-MgBetaTeamAppPreApproval` command and specify the one of the following RSC permissions you want to preapprove in the cmdlet:

+|Configuration| Description|

+|||

+|`ResourceSpecificApplicationPermissionsAllowedForChats`|Use this configuration when you create a preapproval policy for RSC permissions for a chat. For the list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+|`ResourceSpecificApplicationPermissionsAllowedForTeams`|Use this configuration when you create a preapproval policy for RSC permissions for a team. For the list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+You can use the `SpecificSensitivityLabel` arguments to define specific sensitivity labels to apply the RSC preapproval policy to.

+The following are an example of cmdlets that use these arguments:

+```powershell

+New-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForTeams @('ChannelMessage.Read.Group') -TeamLevelSensitivityLabelCondition SpecificSensitivityLabel -SpecificSensitivityLabelIdsApplicableToTeams @('4de11089-adb9-4be8-9b7a-8336be68f3c4')

+```

+### Change RSC configuration to only allow apps with custom defined preapproval policies

+After creating your preapproval policies, change your organization's RSC settings to use the new policy. This setting is more restrictive and might cause some apps not to function for your end users. To make this change, change the state of your organization's RSC settings. The following example shows the required PowerShell cmdlets:

+```powershell

+Set-MgBetaTeamRscConfiguration -State EnabledForPreApprovedAppsOnly

+Set-MgBetaChatRscConfiguration -State EnabledForPreApprovedAppsOnly

+```

+## Manage the existing preapproval policies

+After you create a preapproval policy, you can modify the policy to change the permissions and the sensitivity label of the policy. When apps are released with additional permissions, you must update the preapproval policy for that app to add the new permissions, ensuring that the app can be installed in your tenant. You need the same information to manage an existing preapproval policy and create a new preapproval policy.

+You can also delete an existing preapproval policy if you want to stop preapproving an existing appΓÇÖs RSC permission.

+### Update an existing preapproval policy

+You can update a preapproval policy with the `Update-MgBetaTeamAppPreApproval` cmdlet. When you specify the permissions to be updated, you must distinguish the type of RSC permissions.

+The following RSC configurations are available to manage an existing preapproval policy:

+|Configuration| Description|

+|||

+|`ResourceSpecificApplicationPermissionsAllowedForChats`| Use this configuration when you create a preapproval policy for RSC permissions for a chat. For the list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+|`ResourceSpecificApplicationPermissionsAllowedForTeams`| Use this configuration when you create a preapproval policy for RSC permissions for a team, use this configuration. For the list of all permissions, see [RSC permissions](resource-specific-consent.md).|

+#### Update the preapproval policy for chat RSC

+```powershell

+Update-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForChats @('OnlineMeeting.ReadBasic.Chat', 'TeamsAppInstallation.Read.Chat')

+```

+#### Update the preapproval policy for team RSC

+```powershell

+Update-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForTeams @('ChannelMessage.Read.Group', 'TeamsAppInstallation.Read.Group') -TeamLevelSensitivityLabelCondition AnySensitivityLabel

+```

+If you want to change your preapproval policy from a defined sensitivity label to all sensitivity labels, you must reset the value of the `SpecificSensitivityLabel` argument in your preapproval policy. You can do so by setting the `AnySensitivityLabel` argument to null as follows:

+```powershell

+Update-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e -ResourceSpecificApplicationPermissionsAllowedForTeams @('ChannelMessage.Read.Group') -TeamLevelSensitivityLabelCondition AnySensitivityLabel -SpecificSensitivityLabelIdsApplicableToTeams $null

+```

+ >[!NOTE]

+ > You must include all relevant permissions in your `Update-MgBetaTeamAppPreApproval` cmdlet, even if youΓÇÖve already declared them in the existing preapproval.

+### Delete an existing preapproval policy

+If you want to stop preapproving an existing appΓÇÖs RSC permission, you can delete the preapproval policy for that app. To delete a preapproval policy, ensure that you have the App ID.

+You can delete the preapproval policy associated with an app by using the following PowerShell cmdlet:

+`Remove-MgBetaTeamAppPreapproval`

+```powershell

+Remove-MgBetaTeamAppPreapproval -TeamsAppId c626ce8b-6d15-4c07-bfb1-a5fd0bc3c20e

+```

+## See also

+* [Grant RSC permissions to your app](grant-resource-specific-consent.md)

+* [Test resource-specific consent permissions in Teams](test-resource-specific-consent.md)

+|`LiveShareSession.ReadWrite.Group`| Allows the app to create and synchronize Live Share sessions for the team and get access related information, such as name and role, about the team's roster and any associated meetings. | Supported | NA |

+| `LiveShareSession.ReadWrite.Chat` | Allows the app to create and synchronize Live Share sessions for the chat and get access related information, such as name and role, about the chat's roster and any associated meetings. |Supported |NA |

+[Support and feedback](~/feedback.md)

+You can use Microsoft [Champions Program Guide](https://adoption.microsoft.com/become-a-champion/) as a reference and build this program in your organization for your app. For more information, see [Create your champions program for Microsoft Teams](/microsoftteams/teams-adoption-create-champions-program). For best practices on app adoption, see [app growth and adoption](concepts/deploy-and-publish/appsource/post-publish/app-growth/app-growth-lifecycle.md#best-practices-for-app-growth-and-adoption).

+ |`LiveShareSession.ReadWrite.Group`|Allows the app to create and synchronize Live Share sessions for the team and get access related information, such as name and role, about the team's roster and any associated meetings, on behalf of the signed-in user.|

+ |`LiveShareSession.ReadWrite.Chat`|Allows the app to create and synchronize Live Share sessions for the chat and get access related information, such as name and role, about the chat's roster and any associated meetings, on behalf of the signed-in user.|

+ |`LiveShareSession.ReadWrite.Group`|Allows the app to create and synchronize Live Share sessions for the team and get access related information, such as name and role, about the team's roster and any associated meetings, on behalf of the signed-in user.|

+ |`LiveShareSession.ReadWrite.Chat`|Allows the app to create and synchronize Live Share sessions for the chat and get access related information, such as name and role, about the chat's roster and any associated meetings, on behalf of the signed-in user.|

+[Glossary](../../../get-started/glossary.md)

+* [Work with Universal Actions for Adaptive Cards](Work-with-Universal-Actions-for-Adaptive-Cards.md)

+**2024 June**

+***June 14, 2024***: [Introduced preapproval of RSC permissions for admins to control RSC permissions for app installation](graph-api/rsc/preapproval-instruction-docs.md).

+| 14/05/2024 | Introduced a new manifest property to let potential customers contact you with queries before they can confidently adopt your app.| App manifest > [Public developer preview](resources/schem#developercontactinfo)|

+| 07/05/2024 | You can specify a 32x32 color icon with a transparent background to ensure a consistent appearance when your app runs in Outlook and Microsoft 365.| Distribute your app > [32x32 color icon](concepts/build-and-test/apps-package.md#outline-icon)|