Block third-party storage services in Microsoft 365 on the web

Description

The option Let users open files stored in third-party storage services in Microsoft 365 on the web is cleared. Technically, the service principal of the application Microsoft 365 web third-party storage (app ID c1f33bc0-bdb4-4248-ba9b-096807ddb43e) exists in the tenant with Enabled for users to sign-in set to No (accountEnabled = false).

Outlook on the web storage providers are a separate Exchange setting (MAIL domain). If the service principal does not exist, the feature is on.

Rationale

Third-party storage connected to Microsoft 365 on the web lets users save and open work documents in personal cloud accounts that the organization does not manage, back up or monitor. Turning it off removes an easy exfiltration path and keeps files in governed storage.

Impact

Users who open files from Dropbox, Box or Google Drive in Microsoft 365 on the web can no longer do so. Desktop sync clients for those services are not affected; control them on devices.

Setting

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Org settings > Services > Microsoft 365 on the web and read the third-party storage option.
3. Read-only PowerShell alternative (Microsoft Graph, scope Application.Read.All):

   Get-MgServicePrincipal -Filter "appId eq 'c1f33bc0-bdb4-4248-ba9b-096807ddb43e'" |
     Select-Object DisplayName, AccountEnabled
   

4. Fail if the option is checked, if the service principal does not exist, or if AccountEnabled is true.

Remediation

1. Sign in to the Microsoft 365 admin center as at least a Global Administrator.
2. Browse to Settings > Org settings > Services > Microsoft 365 on the web.
3. Clear Let users open files stored in third-party storage services in Microsoft 365 on the web and Save.
4. Equivalent with Microsoft Graph PowerShell (scope Application.ReadWrite.All, at least Cloud Application Administrator):

   $sp = Get-MgServicePrincipal -Filter "appId eq 'c1f33bc0-bdb4-4248-ba9b-096807ddb43e'"
   if (-not $sp) { $sp = New-MgServicePrincipal -AppId 'c1f33bc0-bdb4-4248-ba9b-096807ddb43e' }
   Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false
   

Rollback

Check the option again, or set AccountEnabled back to true.

References

• Set up OneDrive file storage and sharing Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-008 Block additional storage providers in Outlook on the web
• related CB-M365-COLLAB-016 Allow only approved third-party cloud storage in Teams

People and lifecycle