DPDP.3.9 - Backup and recovery procedures SHALL be encrypted and periodically verified (Rule 8(5)-Sec-4).
Overview
6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web
This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that Microsoft doesn't control the use terms or privacy policies of those third-party services.
Ensure AdditionalStorageProvidersAvailable is restricted on the default OWA policy.
Rationale
By default, additional storage providers are allowed in Office on the Web (such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.). This could lead to information leakage and additional risk of infection from organizational non-trusted storage providers. Restricting this will inherently reduce risk as it will narrow opportunities for infection and data leakage.
Impact
The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.
Remediation
PowerShell
- Connect to Exchange Online using
Connect-ExchangeOnline. - Run the following PowerShell command:
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false
Default Value
AdditionalStorageProvidersAvailable : True
Related links
- Set-OwaMailboxPolicy
- 3rd party cloud storage services supported by Office apps
- Microsoft Secure Score - Restrict third-party storage services
- CIS Microsoft 365 Foundations Benchmark v6.0.1 - Page 356
Test Metadata
| Field | Value |
|---|---|
| Test ID | DPDP.3.9 |
| Severity | Unknown |
| Suite | DPDP Act 2023 |
| Category | IndiaDPDP |
| PowerShell test | Test-MtCisExoAdditionalStorageProvider |
| Tags | DPDP, DPDP.3.9, DPDP2023, IndiaDPDP |
Source
- Pester test:
tests/dpdp/Test-MtDpdpBaselines.Tests.ps1 - PowerShell source:
powershell/public/cis/Test-MtCisExoAdditionalStorageProvider.ps1