Description
In the Teams client configuration, only the third-party storage providers in
{{ approved_cloud_storage }} are enabled (AllowDropBox, AllowBox, AllowGoogleDrive,
AllowShareFile, AllowEgnyte). With the default empty list, all five are off and files in Teams
live in SharePoint and OneDrive only.
Rationale
Files stored in a third-party service through Teams escape sensitivity labels, DLP, retention, eDiscovery and the Microsoft 365 audit log, and their sharing follows the other provider's rules. Limiting providers to approved ones keeps team content under the organization's data governance.
Impact
Teams that added a disabled provider as a tab lose access to it from Teams; the files remain in the third-party service. Move them to SharePoint before the change.
Applies when
Requires: Microsoft Teams
Setting
| Location | Teams admin center > Teams > Teams settings > Files |
| Default | All providers On |
| Recommended | Only {{ approved_cloud_storage }} On |
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
approved_cloud_storagelist. Third-party storage providers allowed in Teams (any of: DropBox, Box, GoogleDrive, ShareFile, Egnyte). | | |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
- Browse to Teams > Teams settings > Files and check that only the providers in
{{ approved_cloud_storage }}are On. - With Microsoft Teams PowerShell (
Connect-MicrosoftTeams, Global Reader is enough):Get-CsTeamsClientConfiguration -Identity Global | Select-Object AllowDropBox, AllowBox, AllowGoogleDrive, AllowShareFile, AllowEgnyte. - Fail if a provider outside
{{ approved_cloud_storage }}isTrue.
Remediation
- Find teams that use third-party storage tabs and agree a migration to SharePoint.
- In the Teams admin center, browse to Teams > Teams settings > Files, turn off each provider that is not approved and Save. Role: Teams Administrator.
- PowerShell equivalent:
Set-CsTeamsClientConfiguration -Identity Global -AllowDropBox $false -AllowBox $false -AllowGoogleDrive $false -AllowShareFile $false -AllowEgnyte $false(keep$truefor approved providers).
References
- Set-CsTeamsClientConfiguration Microsoft, vendor-doc, accessed 2026-10-24
- Teams settings and policies reference Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-20 | related |
| NIST SP 800-53 Rev. 55.1.1 | SC-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1567.002 |
Related controls
- related
CB-M365-TENANT-017Block third-party storage services in Microsoft 365 on the web - related
CB-M365-MAIL-008Block additional storage providers in Outlook on the web
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
