What this check looks at
Checks the Outlook on the web policies for "additional storage providers", which let people attach and open files from services such as Dropbox and Google Drive.
Outlook on the web can let people attach and open files from third-party storage services (Dropbox, Box, Google Drive and others) alongside OneDrive and SharePoint. This is controlled by AdditionalStorageProvidersAvailable on each Outlook on the web mailbox policy, which the new Outlook for Windows also follows, and it is on in Microsoft’s default policy.
The check reads every Outlook on the web mailbox policy and fails when any allows additional storage providers, naming the policies; it passes when all of them block them.
Files shared from a personal Dropbox or Google Drive sit outside the organisation’s retention, eDiscovery, data loss prevention and access controls. They can be shared publicly, stay reachable after the person leaves, and leave no audit trail. It is also an easy route for staff to move work files into personal storage the business cannot see.
Why it matters
Files attached from personal storage services sit outside the organisation’s retention and data loss prevention. Restricting them keeps attachments in OneDrive and SharePoint, where they are protected.
A recruitment consultant attaches candidate CVs from her personal Google Drive in Outlook on the web because it is quicker. When she leaves for a competitor, the files, and the sharing links sent to clients, stay in her personal account. The agency has lost control of personal data it is responsible for under UK GDPR and cannot even list what was shared.
Restricting third-party storage keeps attachments in OneDrive and SharePoint, where sharing is governed, retention applies and access ends when the account is disabled. People who need to exchange files with an outside party can still use OneDrive or SharePoint sharing.
CIS Microsoft 365 Foundations Benchmark 6.5.3 asks for additional storage providers to be restricted in Outlook on the web. ISO 27001 A.5.14 and A.8.12 (data leakage prevention), NIST CSF 2.0 PR.DS-01, CIS Controls v8 3.3 and NCSC CAF B3.c cover keeping data in controlled locations.
How to fix it
Before you start
- Ask whether anyone attaches files from Dropbox, Box or Google Drive in Outlook on the web, and agree how they will share files instead.
Step by step
- Ask who uses other storage. Ask the client whether anyone attaches files from Dropbox, Box or Google Drive in Outlook on the web or the new Outlook, and agree that they will use OneDrive or SharePoint instead.
- Check the policies. Connect with Connect-ExchangeOnline and run Get-OwaMailboxPolicy | Format-Table Name, AdditionalStorageProvidersAvailable. The policies showing True match the ones in the evidence.
- Turn it off in every policy. Run Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersAvailable $false. This covers the default policy and any others, such as one created for Bookings creators.
- Remember new policies. A new Outlook on the web mailbox policy starts with third-party storage allowed, so add -AdditionalStorageProvidersAvailable $false whenever you create one with New-OwaMailboxPolicy and Set-OwaMailboxPolicy.
- Confirm the setting. Run Get-OwaMailboxPolicy | Format-Table Name, AdditionalStorageProvidersAvailable and check every policy shows False. In Outlook on the web, attaching a file should no longer offer other storage accounts once the policy has applied, which can take a while. The next assessment passes.
With PowerShell
Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersAvailable $false
What users will notice
People can no longer attach or open files from third-party storage in Outlook on the web.
How to confirm it worked
Get-OwaMailboxPolicy | Select-Object Name, AdditionalStorageProvidersAvailable shows False for every policy.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.8.12 Data leakage prevention |
| CIS M365 | 6.5.3 Ensure additional storage providers are restricted in Outlook on the web |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-OwaMailboxPolicy (Microsoft Learn)