{
  "id": "CB-M365-COLLAB-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-016.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-016",
    "title": "Allow only approved third-party cloud storage in Teams",
    "finding": {
      "title": "Teams lets users connect unapproved third-party cloud storage",
      "description": "Users can attach Dropbox, Box, Google Drive, Citrix ShareFile or Egnyte storage to teams, moving files outside Microsoft 365 retention, DLP and audit."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "cloud-storage",
      "data-loss-prevention",
      "shadow-it"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "In the Teams client configuration, only the third-party storage providers in\n`{{ approved_cloud_storage }}` are enabled (`AllowDropBox`, `AllowBox`, `AllowGoogleDrive`,\n`AllowShareFile`, `AllowEgnyte`). With the default empty list, all five are off and files in Teams\nlive in SharePoint and OneDrive only.\n",
    "rationale": "Files stored in a third-party service through Teams escape sensitivity labels, DLP, retention,\neDiscovery and the Microsoft 365 audit log, and their sharing follows the other provider's rules.\nLimiting providers to approved ones keeps team content under the organization's data governance.\n",
    "impact": "Teams that added a disabled provider as a tab lose access to it from Teams; the files remain in the\nthird-party service. Move them to SharePoint before the change.\n",
    "setting": {
      "location": "Teams admin center > Teams > Teams settings > Files",
      "default_value": "All providers On",
      "recommended_value": "Only {{ approved_cloud_storage }} On"
    },
    "parameters": [
      {
        "name": "approved_cloud_storage",
        "type": "list",
        "description": "Third-party storage providers allowed in Teams (any of: DropBox, Box, GoogleDrive, ShareFile, Egnyte).",
        "default": []
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Teams** > **Teams settings** > **Files** and check that only the providers in\n   `{{ approved_cloud_storage }}` are **On**.\n3. With Microsoft Teams PowerShell (`Connect-MicrosoftTeams`, Global Reader is enough):\n   `Get-CsTeamsClientConfiguration -Identity Global | Select-Object AllowDropBox, AllowBox, AllowGoogleDrive, AllowShareFile, AllowEgnyte`.\n4. Fail if a provider outside `{{ approved_cloud_storage }}` is `True`.\n"
    },
    "remediation": {
      "manual": "1. Find teams that use third-party storage tabs and agree a migration to SharePoint.\n2. In the Teams admin center, browse to **Teams** > **Teams settings** > **Files**, turn off each\n   provider that is not approved and **Save**. Role: Teams Administrator.\n3. PowerShell equivalent:\n   `Set-CsTeamsClientConfiguration -Identity Global -AllowDropBox $false -AllowBox $false -AllowGoogleDrive $false -AllowShareFile $false -AllowEgnyte $false`\n   (keep `$true` for approved providers).\n"
    },
    "references": [
      {
        "title": "Set-CsTeamsClientConfiguration",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsclientconfiguration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Teams settings and policies reference",
        "url": "https://learn.microsoft.com/microsoftteams/settings-policies-reference",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-017",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}