External file sharing is limited to approved providers

​

What this check verifies

Microsoft 365 Teams client settings restrict external file sharing via third-party storage providers to an approved allowlist. Configuration is considered in place when only sanctioned providers are enabled, or when all non-approved providers are disabled.

​

Risk

Unrestricted third-party storage in Teams weakens confidentiality and integrity:

• Data may bypass DLP, eDiscovery, and retention
• Sensitive files can be shared to unmanaged tenants
• Unvetted apps can deliver tampered content, enabling data exfiltration and malware

​

Recommendation

Adopt a deny-by-default allowlist for Teams file sharing with third-party storage.

• Enable only vetted providers aligned with governance
• Prefer SharePoint Online/OneDrive for collaboration
• Enforce least privilege, DLP, and eDiscovery on allowed paths
• Block unsanctioned apps and limit external sharing to trusted domains

​

Remediation

​

References

• https://learn.microsoft.com/en-us/powershell/module/teams/get-csteamsclientconfiguration?view=teams-ps

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = teams_external_file_sharing_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks