# (L2) Ensure additional storage providers are restricted in Outlook on the web

6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web

Source: https://maester.dev/docs/tests/CIS.M365.6.5.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/weycc81" title="Stefan Wey · Original author"><img src="https://github.com/weyCC81.png" alt="Stefan Wey" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/bastienperez" title="Bastien Perez · Co-contributor"><img src="https://github.com/bastienperez.png" alt="Bastien Perez" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/mynster9361" title="-Mynster · Co-contributor"><img src="https://github.com/Mynster9361.png" alt="-Mynster" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/weycc81">Stefan Wey</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Outlook · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.5.3
```

## Overview

6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web

This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that Microsoft doesn't control the use terms or privacy policies of those third-party services.

Ensure **AdditionalStorageProvidersAvailable** is restricted on the default OWA policy.

The check passes only when the default policy returns `False`. A missing value does not demonstrate that storage providers are restricted and therefore does not pass.

#### Rationale

By default, additional storage providers are allowed in Office on the Web (such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.). This could lead to information leakage and additional risk of infection from organizational non-trusted storage providers. Restricting this will inherently reduce risk as it will narrow opportunities for infection and data leakage.

#### Impact

The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

#### Remediation

##### PowerShell

1. Connect to Exchange Online using `Connect-ExchangeOnline`.
2. Run the following PowerShell command:

```powershell
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false
```

#### Default Value

```txt
AdditionalStorageProvidersAvailable : True
```

#### Related links

* [Set-OwaMailboxPolicy](https://learn.microsoft.com/powershell/module/exchangepowershell/set-owamailboxpolicy?view=exchange-ps)
* [3rd party cloud storage services supported by Office apps](https://support.microsoft.com/office/3rd-party-cloud-storage-services-supported-by-office-apps-fce12782-eccc-4cf5-8f4b-d1ebec513f72)
* [Microsoft Secure Score - Restrict third-party storage services](https://security.microsoft.com/securescore)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 454](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.5.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1567.002 Exfiltration to Cloud Storage, T1204.002 Malicious File |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.3 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2, E5 Level 2 |
| Supports controls | cis-m365:6.5.3, nist-800-53-r5:AC-20, nist-800-53-r5:CM-7 |
| PowerShell test | [Test-MtCisExoAdditionalStorageProvider](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.3.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.5.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.5.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.3.md)