What this check looks at
Checks whether people can open and save files in services such as Dropbox and Google Drive from Microsoft 365 on the web.
Microsoft 365 on the web can connect to storage outside Microsoft 365, such as Dropbox, Box and Google Drive, so people can open, edit and save files there from Office on the web. It is allowed by default. Behind the setting is a Microsoft service principal (app ID c1f33bc0-bdb4-4248-ba9b-096807ddb43e): while it is absent or enabled, third-party storage is allowed; once it exists and is disabled, it is blocked.
The check passes when third-party storage is turned off, and fails when people can open and save files in third-party storage from Microsoft 365 on the web, which includes tenants where the setting has never been touched.
Files saved to a personal Dropbox or Google Drive leave everything the organisation uses to protect them: retention and backup, data loss prevention, sensitivity labels, audit logging, and the ability to remove access when someone leaves. Connecting personal storage inside the company’s own Microsoft 365 also makes copying data out look like normal work.
Why it matters
Files saved to a personal Dropbox or Google Drive leave the organisation’s retention, data loss prevention and audit. Turning off third-party storage keeps company files in OneDrive and SharePoint, where they are protected and can be recovered.
A departing salesperson connects a personal Dropbox to Office on the web and saves the client list and price book there during their last fortnight. Nothing is flagged, because nothing leaves by email. Months later the firm finds a competitor using its pricing, with no audit trail showing what was taken.
If those files hold personal data, the organisation has lost control of it and may have a breach to assess under UK GDPR; it also cannot answer a subject access or deletion request for copies it does not know exist. Keeping files in OneDrive and SharePoint keeps them recoverable and inside every control the firm pays for.
The CIS Microsoft 365 Foundations Benchmark (1.3.7) asks for third-party storage services to be restricted in Microsoft 365 on the web. The rule maps to NIST CSF 2.0 PR.DS-01, protecting data at rest.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Microsoft 365 on the web
Before you start
- Ask whether anyone opens Dropbox, Box or Google Drive files from Microsoft 365 on the web, and agree how they will share files instead.
Step by step
- Ask who uses it. Ask the client whether anyone opens Dropbox, Box or Google Drive files from Microsoft 365 on the web, for example with a supplier who shares through Dropbox. Agree how they will work instead, such as sharing through OneDrive or SharePoint.
- Turn off third-party storage. In the Microsoft 365 admin centre, go to Settings > Org settings > Services > Microsoft 365 on the web. Untick Let users open files stored in third-party storage services in Microsoft 365 on the web and select Save.
- Or make the change in PowerShell. In Microsoft Graph PowerShell (Connect-MgGraph -Scopes Application.ReadWrite.All), run $sp = Get-MgServicePrincipal -All | Where-Object AppId -eq "c1f33bc0-bdb4-4248-ba9b-096807ddb43e". If nothing is returned, create it with $sp = New-MgServicePrincipal -AppId c1f33bc0-bdb4-4248-ba9b-096807ddb43e. Then run Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false.
- Tell the people who used it. Let anyone who used third-party storage know it no longer appears in Office on the web, and that files already in OneDrive and SharePoint are unaffected.
- Confirm. Reopen Microsoft 365 on the web in Org settings and check the option is unticked. In Office on the web, adding a place such as Dropbox should no longer be offered. Re-run the assessment to confirm.
What users will notice
People can no longer add or open third-party storage in Microsoft 365 on the web. Files already saved in OneDrive or SharePoint are unaffected.
How to confirm it worked
Microsoft 365 admin centre, Org settings, Microsoft 365 on the web: the third-party storage option is unticked.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.8.12 Data leakage prevention |
| CIS M365 | 1.3.7 Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web' |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Allow or prevent third-party storage in Microsoft 365 on the web (Microsoft Learn)