cirsec Baselines
Esc
Microsoft 365 tenant · Exchange Online, Defender for Office 365 & mail DNS

Block additional storage providers in Outlook on the web

When it fails: Outlook on the web lets users attach and save files with personal cloud storage. Users can attach files from, or save attachments to, Dropbox, Google Drive, Box or a personal OneDrive, outside the organization's control.

CB-M365-MAIL-008mediumactivemanualprofile hardened

Description

Every Outlook on the web mailbox policy in use has AdditionalStorageProvidersAvailable set to $false. Users can then only attach files from the device or from the organization's OneDrive and SharePoint, and cannot connect third-party or personal storage accounts in Outlook on the web and the new Outlook.

Rationale

A connected personal storage account is an easy path to move work files out of the organization, outside data loss prevention, retention and audit. Files shared from third-party storage are also not scanned by Safe Attachments the way OneDrive and SharePoint files are.

Impact

Users who used Box, Dropbox or Google Drive in Outlook on the web lose that option. Teams that exchange files with partners through those services must download and re-attach them, or use SharePoint sharing.

Audit

  1. Connect to Exchange Online PowerShell as at least a Global Reader.
  2. Run (read-only): 
    Get-OwaMailboxPolicy | Format-Table Name, IsDefault, AdditionalStorageProvidersAvailable
Get-CASMailbox -ResultSize Unlimited | Group-Object OwaMailboxPolicy | Select-Object Name, Count
  3. Fail if a policy used by at least one mailbox (an empty OwaMailboxPolicy means the default policy) has AdditionalStorageProvidersAvailable set to True.

Remediation

  1. Connect to Exchange Online PowerShell as an Exchange Administrator.
  2. For each policy in use: 
    Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false

Rollback

Set AdditionalStorageProvidersAvailable back to $true on the policy.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-4related
NIST SP 800-53 Rev. 55.1.1AC-20related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1567
  • related CB-M365-MAIL-004 Prevent users from installing Outlook add-ins
  • related CB-M365-MAIL-005 Prevent users from adding personal email accounts and calendars in Outlook
  • related CB-M365-TENANT-017 Block third-party storage services in Microsoft 365 on the web
  • related CB-M365-COLLAB-016 Allow only approved third-party cloud storage in Teams

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr