Roadmap shows Organization Evaluation Score for Apps and Agents as Launched. Security wants a percentage threshold that auto-allows anything above 80%. Can we treat the score as the approval decision, or is it only decision support before we allow an app in Manage apps?

MRC 532720 Organization Evaluation Score for Apps and Agents: configure trust criteria once, score third-party apps — Steady GRC still owns allow/block.

Teams now scores third-party apps and agents against our trust criteria — do we still need a human approval gate?

You’re right to want something more repeatable than “open the Security and compliance tab and squint.” Third-party apps and agents pile up faster than a weekly change board can read attestations. A score that matches your criteria is useful — it is not a substitute for a named human saying yes.

Here’s what’s going on. Roadmap 532720 (Microsoft Teams: Organization Evaluation Score for Apps and Agents) is Launched, with general availability dated February 2026 on the MRC record (Worldwide and GCC; Web). Learn documents the living how-to under Organization Evaluation Score for Apps and Agents: in the Teams admin centre go to Teams apps → Evaluation score settings, pick from a predefined list of security, compliance and permission-related requirements, then see an Evaluation score percentage column on Manage apps. Open an app or agent for the Evaluation score report — each requirement shows Met, Not met, or No data. Changing your criteria recalculates scores; it does not rewrite the underlying metadata the publisher or Microsoft surfaces.

Eligibility matters. Learn is explicit: scores appear only for third-party apps and agents that have security and compliance data and are not already available in the organisation for anyone to install. First-party / already-allowed catalogue items won’t fill that column the same way — so “everything is green” is never a complete inventory story. Message Centre guidance around this workstream also framed the experience as enabled by default decision support: you still allow or block on Manage apps (and under unified app management, keep Teams and Microsoft 365 admin centre aligned).

This is Steady before scale for Pane 04 Security and Pane 05 GRC: automate the comparison, keep a human on the decision. Schofield’s Third Law (historically attributed) still applies — the easier it is to install an agent, the easier it is for that agent’s permissions to reach your data. A percentage is a filter, not a firewall.

Options that actually work:

Write the criteria with Security and GRC before you trust the column. Map ISO 27001 / SOC 2 / GDPR-style attributes and permission privilege levels to what your policy already requires; download the CSV of selected requirements as the register exhibit. Best Steady default.
Use score filters to triage the queue, then human-approve. Sort and filter Manage apps by evaluation requirements met (for example greater than a chosen percentage), open the report for gaps and No data, then allow only with an owner and purpose logged. The score accelerates review; it does not flip availability by itself.
Pilot on a named request path. Pick the next five user-requested third-party agents, score them against your criteria, compare against your existing allow/block habit, and only then publish an internal “how we use Evaluation score” note.
Auto-allow anything above 80% and skip the report. Fast — until No data hides a permission gap, or a high score on yesterday’s metadata meets a publisher that changed attestations overnight.

12 Panes action / comms: Tell Security: 532720 scores third-party apps and agents against criteria we configure; allow/block remains ours. Tell GRC: Put Evaluation score settings and the CSV export in the AI/agent register evidence pack — criteria owner, review cadence, what “No data” means for us. Tell Teams admins: Configure Evaluation score settings once; use the Manage apps column to prioritise, not to rubber-stamp. Leadership: This is Steady agent intake, not a reason to open the catalogue wide.

Benefits / risks: Consistent, organisation-specific triage instead of tribal knowledge; scores move when underlying trust data moves; eligibility excludes already-available and first-party items so the column is not a full estate scorecard; Learn and Message Centre timing can lag MRC — verify the Evaluation score settings page in your tenant before you brief the board.

I’d suggest a short Steady workshop this week: agree ten requirements that match your existing app policy, configure them in Evaluation score settings, walk three pending requests through the report with Security in the room, and write the one-sentence rule — score informs; a named approver decides. Once that habit sticks, the percentage becomes useful rather than theatrical.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer