Back to Checks
m365

Mailbox policy has additional storage providers disabled

exchange_mailbox_policy_additional_storage_restricted
Service: exchangeSeverity: high
OfficialBuilt-inVerified
Categories:e3trust-boundaries
Resource Type:NotDefined

Microsoft 365 Outlook on the web mailbox policy governs access to additional storage providers (e.g., Box, Dropbox, Google Drive, personal OneDrive). The finding evaluates whether these third-party file integrations are disabled via AdditionalStorageProvidersAvailable=false.

Prowler logoProwlerprowler-provider-m365

Risk

Enabling third-party storage in OWA weakens:

  • Confidentiality: data can leave the tenant to unmanaged clouds
  • Integrity: external links can deliver or reference malicious/tampered files
  • Visibility/Compliance: M365 DLP and audit may not fully apply, enabling undetected exfiltration

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_mailbox_policy_additional_storage_restricted

Recommendation

Block third-party storage integrations in the OWA mailbox policy (AdditionalStorageProvidersAvailable=false). Prefer enterprise-managed repositories, enforce least privilege, and apply DLP and Conditional Access to control egress. If required, permit only vetted providers under governed exceptions with monitoring.

Remediation

CLI

Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false

Other

1Sign in to the Exchange admin center (https://admin.exchange.microsoft.com)
2Open Classic Exchange admin center (left pane)
3Go to Permissions > Outlook Web App policies
4Edit OwaMailboxPolicy-Default
5In Features, set "Additional storage providers" to Off
6Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_mailbox_policy_additional_storage_restricted(Check):
    """Check if Exchange mailbox policy restricts additional storage providers.

    This check ensures that the mailbox policy does not allow additional storage providers.
    """

    def execute(self) -> List[CheckReportM365]:
        """Run the check to validate Exchange mailbox policy restrictions.

        Iterates through all mailbox policies to determine if additional storage
        providers are restricted and generates reports for each policy.

        Returns:
            List[CheckReportM365]: A list of reports with the restriction status for each mailbox policy.
        """
        findings = []
        for mailbox_policy in exchange_client.mailbox_policies:
            if mailbox_policy:
                report = CheckReportM365(
                    metadata=self.metadata(),
                    resource=mailbox_policy,
                    resource_name=f"Exchange Mailbox Policy - {mailbox_policy.id}",
                    resource_id=mailbox_policy.id,
                )
                report.status = "FAIL"
                report.status_extended = f"Exchange mailbox policy '{mailbox_policy.id}' allows additional storage providers."

                if not mailbox_policy.additional_storage_enabled:
                    report.status = "PASS"
                    report.status_extended = f"Exchange mailbox policy '{mailbox_policy.id}' restricts additional storage providers."

                findings.append(report)

        return findings

References