Back to Checks
googleworkspace

Chat apps installation is disabled for users

chat_apps_installation_disabled
Service: chatSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Google Chat apps connect to external services to look up information, schedule meetings, or complete tasks. Apps are accounts created by Google, users in the organization, or third parties that can access user data including email addresses, conversation content, and organizational information.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Unrestricted Chat app installation allows unvetted third-party applications to access user data including conversation content and organizational information. An attacker could distribute a malicious Chat app to exfiltrate confidential data or establish persistent access to internal communications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks chat_apps_installation_disabled

Recommendation

Disable Chat apps installation to prevent unvetted third-party applications from accessing organizational data through the Chat platform.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Google Chat and classic Hangouts**
3Click **Chat apps**
4Under Chat apps access settings, set **Allow users to install Chat apps** to **OFF**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.chat.chat_client import chat_client


class chat_apps_installation_disabled(Check):
    """Check that users cannot install Chat apps.

    This check verifies that the domain-level Chat policy prevents users
    from installing Chat apps, reducing the risk of data exposure through
    third-party or unvetted applications.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if chat_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=chat_client.policies,
                resource_id="chatPolicies",
                resource_name="Chat Policies",
                customer_id=chat_client.provider.identity.customer_id,
            )

            apps_enabled = chat_client.policies.enable_apps

            if apps_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Chat apps installation is disabled "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            elif apps_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Chat apps installation uses Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Chat apps installation is enabled "
                    f"in domain {chat_client.provider.identity.domain}. "
                    f"Chat apps installation should be disabled to prevent unvetted apps."
                )

            findings.append(report)

        return findings

References