Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
exchange_mailbox_policy_additional_storage_restrictedProvider: Microsoft 365
Service:
exchangeSeverity: HIGH
Categories:
e3, trust-boundariesResource type:
NotDefinedWhat this check verifies
Microsoft 365 Outlook on the web mailbox policy governs access to additional storage providers (e.g., Box, Dropbox, Google Drive, personal OneDrive). The finding evaluates whether these third-party file integrations are disabled viaAdditionalStorageProvidersAvailable=false.
Risk
Enabling third-party storage in OWA weakens:- Confidentiality: data can leave the tenant to unmanaged clouds
- Integrity: external links can deliver or reference malicious/tampered files
- Visibility/Compliance: M365 DLP and audit may not fully apply, enabling undetected exfiltration
Recommendation
Block third-party storage integrations in the OWA mailbox policy (AdditionalStorageProvidersAvailable=false). Prefer enterprise-managed repositories, enforce least privilege, and apply DLP and Conditional Access to control egress. If required, permit only vetted providers under governed exceptions with monitoring.
Remediation
- CLI
- Dashboard steps
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false
References
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = exchange_mailbox_policy_additional_storage_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks