CIS.M365.8.1.1: Ensure external file sharing in Teams is enabled for only approved cloud storage services


ID	`CIS.M365.8.1.1`
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Teams
Feature	File sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, `8.1.1` (L2, E3 Level 2)
Framework controls	`cis-m365:8.1.1` `nist-800-53-r5:AC-20` Use of External Systems `nist-800-53-r5:CM-7` Least Functionality
MITRE ATT&CK	T1567.002
Reads from	Microsoft Teams

What this checks and how to fix it

8.1.1 (L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services

Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well.

Note: Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.

Rationale

Ensuring that only authorized cloud storage providers are accessible from Teams will help to dissuade the use of non-approved storage providers.

Impact

The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

Remediation action

To change third-party cloud services using the UI:

Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.
Select Settings & policies > Global (Org-wide default) settings.
Click Teams to open the Teams settings section.
Under files set storages providers to Off unless they have first been authorized by the organization.

To change third-party cloud services using PowerShell:

Connect to Teams using Connect-MicrosoftTeams.
Run the following PowerShell command to disable external providers that are not authorized. (the example disables Citrix Files, DropBox, Box, Google Drive and Egnyte)

$Params = @{
 Identity = 'Global'
 AllowGoogleDrive = $false
 AllowShareFile = $false
 AllowBox = $false
 AllowDropBox = $false
 AllowEgnyte = $false
}
Set-CsTeamsClientConfiguration @Params

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: HenrikPiecha; contributors: merill, Mynster9361. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).