Skip to content
MitoMito Docs

CIS.M365.6.5.3: Ensure additional storage providers are restricted in Outlook on the web
ID CIS.M365.6.5.3
Severity Medium
Suite CIS Microsoft 365 Foundations Benchmark
Product Exchange Online
Feature Outlook
Security area External access and sharing
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CIS Microsoft 365 Foundations Benchmark 7.0.0, 6.5.3 (L2, E3 Level 2, E5 Level 2)
Framework controls cis-m365:6.5.3
nist-800-53-r5:AC-20 Use of External Systems
nist-800-53-r5:CM-7 Least Functionality
MITRE ATT&CK T1567.002, T1204.002
Reads from Exchange Online

What this checks and how to fix it

Section titled “What this checks and how to fix it”

6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web

This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that Microsoft doesn’t control the use terms or privacy policies of those third-party services.

Ensure AdditionalStorageProvidersAvailable is restricted on the default OWA policy.

Rationale

Section titled “Rationale”

By default, additional storage providers are allowed in Office on the Web (such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.). This could lead to information leakage and additional risk of infection from organizational non-trusted storage providers. Restricting this will inherently reduce risk as it will narrow opportunities for infection and data leakage.

Impact

Section titled “Impact”

The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

Remediation

Section titled “Remediation”
PowerShell
Section titled “PowerShell”
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following PowerShell command:
Terminal window
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false

Default Value

Section titled “Default Value”
AdditionalStorageProvidersAvailable : True
Section titled “Related links”

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: weyCC81; contributors: bastienperez, Mynster9361. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.