What this check looks at
Checks whether people can add Dropbox, Box, Google Drive, Citrix ShareFile or Egnyte as file storage in Teams.
Teams lets people add third-party cloud storage to a team, so a channel’s files can sit in Dropbox, Box, Google Drive, Citrix ShareFile or Egnyte instead of the team’s SharePoint site. Microsoft turns all five providers on by default. The switches are in the organisation-wide Teams client configuration (Set-CsTeamsClientConfiguration -Identity Global), and there is no per-user version.
The check reads the Global Teams client configuration and fails when any of AllowDropBox, AllowBox, AllowGoogleDrive, AllowShareFile or AllowEgnyte is true, naming the providers that are on. It fails for an approved provider too, because it cannot tell approved from unapproved. It warns when no provider is known to be on but one or more of the five values was not returned.
A file kept with a third-party provider is outside Microsoft 365 altogether. Sensitivity labels, DLP, retention, eDiscovery and the unified audit log do not see it, and the account that holds it is often a free or personal one the business does not control. Someone can connect their own Dropbox to a team, move client files into it, and keep them after they leave.
Why it matters
Files shared through a third-party store in Teams sit outside SharePoint and OneDrive, so sensitivity labels, DLP, retention and the audit log do not apply to them. Only storage the business has approved, and can govern, should be on offer.
A typical case: a sales manager connects their personal Google Drive to the sales team so a partner can see price lists and customer contacts. A year later they resign. The folder, with the customer list and pricing, stays in their personal account; the business has no record of who opened it, cannot revoke access and cannot say what it held.
Under UK GDPR the business has to know where personal data is held and keep it secure, and the ICO expects an organisation to be able to say which systems hold personal data and who can reach it. Data in an unmanaged consumer account fails both, and losing it can be a reportable personal data breach.
CIS Microsoft 365 Foundations Benchmark 8.1.1 asks that external file sharing in Teams is enabled only for approved cloud storage services. Turning off the providers nobody approved takes minutes and changes nothing for files stored in SharePoint and OneDrive.
How to fix it
Where: Teams admin centre → Teams → Teams settings → Files
Before you start
- Ask each department whether they use Dropbox, Box, Google Drive, ShareFile or Egnyte in Teams, and agree which (if any) are approved.
- Move files people need into SharePoint or OneDrive first.
Step by step
- Agree which providers, if any, are approved. Ask department heads whether any team uses Dropbox, Box, Google Drive, ShareFile or Egnyte inside Teams, and whether the business has a contract and an owner for it. Write down any approved provider, who owns it and why it is needed. Anything without an owner is not approved.
- Move files people still need into SharePoint. For each team that has third-party storage added, ask the team owner to copy the files that are still needed into the channel’s Files (its SharePoint folder) before the provider is turned off. Turning a provider off does not delete anything, but the files can no longer be opened from Teams.
- Turn off unapproved providers in the Teams admin centre. In the Teams admin centre (admin.teams.microsoft.com), go to Teams > Teams settings and scroll to the Files section. Set each provider that is not approved (Citrix files, Dropbox, Box, Google Drive, Egnyte) to Off, then select Save.
- Or make the change in Teams PowerShell. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Set-CsTeamsClientConfiguration -Identity Global -AllowDropBox $false -AllowBox $false -AllowGoogleDrive $false -AllowShareFile $false -AllowEgnyte $false, leaving $true only for a provider you approved.
- Record any approved provider against the finding. If a provider stays on, this check keeps failing, because it reports every provider that is on. Record the approval, the owner and a review date with the finding so the next reviewer knows it is deliberate.
- Confirm the change. Run Get-CsTeamsClientConfiguration | Select-Object AllowDropBox, AllowBox, AllowGoogleDrive, AllowShareFile, AllowEgnyte: each should be False apart from an approved provider. In Teams, open a team’s Files and choose to add cloud storage: only approved providers are offered.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsClientConfiguration -Identity Global -AllowDropBox $false -AllowBox $false -AllowGoogleDrive $false -AllowShareFile $false -AllowEgnyte $false
What users will notice
The providers turned off disappear from the Add cloud storage option in Teams. Files already stored there stay where they are, but can no longer be opened from Teams.
How to confirm it worked
In Teams, open a team’s Files tab and choose Add cloud storage: only approved providers are offered.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.14 Information transferA.8.12 Data leakage prevention |
| CIS M365 | 8.1.1 Ensure external file sharing in Teams is enabled for only approved cloud storage services |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-CsTeamsClientConfiguration (Microsoft Learn)