In tenant settings there is option to block publishing content packs and apps to entire organization. However, it does not prevent user from publishing app (it just blocks the ability to publish app to the whole organization... Unfortunately you can still publish app and share it with specific accounts rather than sharing with everyone at once)
I see a challenge here for many organizations that want to fully control what is published. Now it can be achieved only partially:
1) We can control workspace creation (to be specific: we can disable ability to create groups in Office 365). Then:
- we can decide that only some specific adminstrator would be able to create workspaces for all other users
- each workspace would have also pre-existing security created by administrator (leveraging active directory)
- we can prevent dashboard creator to alter that security (dashboard creator would be member with edit permissions so he can create dashboard, but cannot alter security without being workspace admin)
2) However we _cannot_ control app publishing. So if some specific security in workspace is defined, user is actually still able to publish app to anyone (however, it would be good is to either block app publishing entirely for most users or at least ensure that app publishing is aligned with workspace security)
I would be very interested to know if second limitation can be somehow solved.
