{
  "id": "CB-M365-MAIL-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-008.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-008",
    "title": "Block additional storage providers in Outlook on the web",
    "finding": {
      "title": "Outlook on the web lets users attach and save files with personal cloud storage",
      "description": "Users can attach files from, or save attachments to, Dropbox, Google Drive, Box or a personal OneDrive, outside the organization's control."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "outlook",
      "owa-policy",
      "cloud-storage",
      "data-leakage"
    ],
    "description": "Every Outlook on the web mailbox policy in use has `AdditionalStorageProvidersAvailable` set to\n`$false`. Users can then only attach files from the device or from the organization's OneDrive\nand SharePoint, and cannot connect third-party or personal storage accounts in Outlook on the web\nand the new Outlook.\n",
    "rationale": "A connected personal storage account is an easy path to move work files out of the\norganization, outside data loss prevention, retention and audit. Files shared from third-party\nstorage are also not scanned by Safe Attachments the way OneDrive and SharePoint files are.\n",
    "impact": "Users who used Box, Dropbox or Google Drive in Outlook on the web lose that option. Teams that\nexchange files with partners through those services must download and re-attach them, or use\nSharePoint sharing.\n",
    "audit": {
      "manual": "1. Connect to Exchange Online PowerShell as at least a Global Reader.\n2. Run (read-only):\n   ```powershell\n   Get-OwaMailboxPolicy | Format-Table Name, IsDefault, AdditionalStorageProvidersAvailable\n   Get-CASMailbox -ResultSize Unlimited | Group-Object OwaMailboxPolicy | Select-Object Name, Count\n   ```\n3. Fail if a policy used by at least one mailbox (an empty `OwaMailboxPolicy` means the default\n   policy) has `AdditionalStorageProvidersAvailable` set to `True`.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell as an Exchange Administrator.\n2. For each policy in use:\n   ```powershell\n   Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false\n   ```\n",
      "rollback": "Set `AdditionalStorageProvidersAvailable` back to `$true` on the policy.\n"
    },
    "references": [
      {
        "title": "Set-OwaMailboxPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-owamailboxpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Outlook on the web mailbox policies in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/outlook-on-the-web/outlook-web-app-mailbox-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-004",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-005",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-017",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}