8.1.1 Ensure external file sharing in Teams is enabled for only approved cloud storage services

Information

Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well.

Note: Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.

Rationale:

Ensuring that only authorized cloud storage providers are accessible from Teams will help to dissuade the use of non-approved storage providers.

Impact:

The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To set external file sharing in Teams:

Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.

Click to expand Teams select Teams settings.

Set any unauthorized providers to Off.

To set cloud sharing options using PowerShell:

Connect to Teams PowerShell using Connect-MicrosoftTeams

Run the following PowerShell command to disable external providers that are not authorized. (the example disables Citrix Files, DropBox, Box, Google Drive and Egnyte)

$storageParams = @{
AllowGoogleDrive = $false
AllowShareFile = $false
AllowBox = $false
AllowDropBox = $false
AllowEgnyte = $false
}

Set-CsTeamsClientConfiguration @storageParams

Default Value:

AllowDropBox : True

AllowBox : True

AllowGoogleDrive : True

AllowShareFile : True

AllowEgnyte : True

See Also

https://workbench.cisecurity.org/benchmarks/15279

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.7

Plugin: microsoft_azure

Control ID: 24a41ba7c3f5b1172d13e72700e15603c7425bfba9c40f3760cbd42cbca184ac