I'm creating a provider hosted app for sharepoint which contains a number of client web parts. The app is for a specific department and it needs some custom configuration (columns, contenttypes etc) in the site in order for it to work.

When I deploy the app to the app catalog, it automatically becomes available to all the sitecollections. I don't want users in other sitecollections to be able to install this app. Is there a way to do this without activating the sideloading feature?

EDIT: I'm in an SharePoint online environment so I'm not able to create a separate webapplication for the sitecollection

6 Answers 6


Alternative 1

Your App Catalog site can be configured at web application, NOT at site collection level. Since an App Catalog is scoped to a web application, all apps that you want to make available have to be in the App Catalog site for that web application, and eventually to all site collections under it.

However, you can have more than one App Catalog site and create a separate App Catalog in another web application and move specific department site collection there.

Assuming you're on on-prem SharePoint environment, the aforementioned configuration could be done


Alternative 2 With the help of deployment UI and filtering, you can specify which specific site collection you want your app to be installed on, too. This method is effective for both SharePoint-Online and On-Prem

  • 4
    Nice answer! I didn't know you could have more than one AppCatalog!
    – Benny Skogberg
    Commented Jul 10, 2014 at 11:02
  • I'm not on a on-prem SharePoint environment so moving the sitecollection to a different web application is not an option. I'll update my post with this information
    – Marlou
    Commented Jul 10, 2014 at 11:17
  • I have just updated my response Commented Jul 10, 2014 at 12:06
  • 1
    Thanks for the update but it seems the deployment UI is not working for apps with app parts in it :(
    – Marlou
    Commented Jul 15, 2014 at 9:20
  • 1
    Marlou, I am having the same problem. App parts arent available when using the deployment UI. Did you find any work around?
    – NYTom
    Commented Dec 12, 2014 at 4:05

I found out that a user needs read rights on the app catalog to be able to see the app in "Apps from your organization". This also applies to the list item in the app catalog. So I stopped the permission inheritance on the list item for my app in the app catalog, and only gave specific users of my sitecollection read rights on the list item.

I still can't prevent that those users with rights install it in another sitecollection, but at least not every user can install the app in his sitecollectin.

  • 2
    Why not simply make it so that the app cannot be installed after installing it on the intended site?
    – wjervis
    Commented Jul 21, 2014 at 12:00
  • 1
    It has to be installed multiple times in the sitecollection because it contains some client web parts.
    – Marlou
    Commented Jul 21, 2014 at 12:33
  • Using this approach will the users with no read permissions to list item in app catalog will be able to use the app?
    – Jinxed
    Commented Sep 7, 2015 at 6:47
  • @Marlou: However, if your App Part requires 'tenant' permissions, will not work. "Access denied. You do not have permission to perform this action or access this resource."
    – fallout
    Commented Jun 10, 2016 at 12:42
  • How can we get information about sote collections if app os deployed using app stamping
    – user27178
    Commented Jun 18, 2016 at 14:12

My approach to this problem would be to make use of add-in event receiver.

Implement an AppInstalling event and check before hand where the user is trying to install the add in. If it is one off the target site collection/site then allow the installation or throw a permission denied error.

To read about the add in events please refer this Create an add-in event receiver in SharePoint Add-ins

  • We use this approach to prevent App upgrade for some cases (like user hasn't paid for support). Site lists/columns/Content Types can be similarly checked in install event and only allow installation if requirements are met. This sounds like the correct answer to me for this requirement!
    – Prakash
    Commented Sep 1, 2016 at 11:20

Site collection app catalogs are a newish feature that would allow you to do this.

Diagram illustrating the concept of site collection app catalog


No access to app in global App Catalog

My recommended approach for our (enterprise) use case is:

  1. Add App to global app catalog
  2. Remove all access permissions for all users except SPO-Admins on (app) item level
  3. The SPO-Admin then adds (and trusts) the App to the single site collection, where it should be added.


  • Nobody can add the app anywhere else
  • Nobody can even download the app from app-catalog
  • No SiteCollection App Catalog needed
  • This works for Add-Ins and for SPFx-Apps


  • SPO-Admin has to trust the app on site level, so approval by site owner should be retrieved beforehand.

Site Collection scoped app catalog

As previously stated, one option is also to create a Site Collection scoped app catalog.


  • Dedicated App Catalog only for the SiteCollection


  • the catalog has to be created through PowerShell by an SPO-Admin
  • It creates an additional place in the tenant, where apps can be added, so another place to care/worry of
  • Difficult to protect from users, if site has users as Site Collection Admins
  • The classic PHA-Apps are not working properly (they do not show up as 'addable' to the site), if the SPO-Admin who created the SCA-App-Catalog was not also a site collection admin (SCA) during creation of the catalog.

for "Site Collection scoped app catalog", more disadvantages are listed everywhere I searched.

However, my interest is the ability to have a different version of SPFx component in test site collection and different version on production site collection (same tenant). Not sure how this will be possible in tenant level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.