L2 BIO 13.02.04 ISO A.13.2.4 CIS 4.2.2

External Opslag Providers Geblokkeerd In Teams (Dropbox, Google Drive, Box)

📅 2025-10-30

•

⏱️ 8 minuten lezen

•

🔴 Must-Have

💼 Management Samenvatting

Het blokkeren van derde partij cloud opslag providers (Dropbox, Google Drive, Box) binnen Microsoft Teams voorkomt data exfiltration naar niet-managed cloud services, elimineert shadow IT bestandsopslag en enforces gebruik van corporate-approved SharePoint/OneDrive voor file collaboration met DLP policy enforcement.

Aanbeveling

IMPLEMENT

Risico zonder

High

Risk Score

8/10

Implementatie

3u (tech: 1u)

Van toepassing op:

✓ Microsoft Teams
✓ M365

Teams staat toe NATIVE INTEGRATION met derde partij opslag providers waarbij users kunnen: Dropbox, Google Drive, Box files delen binnen Teams channels/chats, Files direct uploaden naar deze external services via Teams interface, Corporate data syncen naar personal/external cloud accounts. Dit creëert ERNSTIGE SECURITY EN COMPLIANCE RISKS: DATA EXFILTRATION waarbij: corporate files worden uploaded naar external clouds (Dropbox personal accounts), gevoelige data leaves organizational control (lost DLP enforcement), data residency violated (waar wordt Dropbox data opgeslagen? US? EU?); SHADOW IT waarbij: IT heeft geen zichtbaarheid in external opslag usage (audit gap), NO centralized management of external data, NO ability to revoke access bij employee departure, lost control over retention/deletion; DLP BYPASS omdat: SharePoint/OneDrive DLP policies NIET toepassen to Dropbox/Google Drive, users können intentionally gebruiken external opslag om DLP te omzeilen, gevoelige data (PII, financial) unprotected in external clouds; compliance schendingen voor: AVG data sovereignty (external cloud processing zonder Data Processing Agreement), NIS2 supply chain security (derde partij cloud zonder Beveiligings beoordeling), ISO 27001 information classification (data in ongecontroleerde external systems), BIO cloud security requirements (alleen approved cloud services). Real-world gegevenslekken scenarios: Employee uploads confidential project files naar personal Dropbox via Teams → Data exfiltration, Departing employee syncs corporate IP naar Google Drive → Data theft, Competitor intel via employee sharing sensitive files to external Box account. External opslag is backdoor om corporate gegevensbescherming te bypassen.

PowerShell Modules Vereist

Primary API: Teams PowerShell
Connection: Connect-MicrosoftTeams
Required Modules: MicrosoftTeams

Implementatie

Deze control configureert Teams Client configuratie-instellingen via Set-CsTeamsClientConfiguration PowerShell cmdlet om alle derde partij opslag providers te blokkeren: AllowDropBox is False (Blokkeert Dropbox integration), AllowGoogleDrive is False (Blokkeert Google Drive), AllowBox is False (Blokkeert Box), AllowShareFile is False (Blokkeert Citrix ShareFile), AllowEgnyte is False (Blokkeert Egnyte). Effect: derde partij opslag tabs REMOVED van Teams interface (Dropbox/Google Drive icons gone), Users kan niet share files van external opslag binnen Teams, Upload to external opslag via Teams is BLOCKED, alleen SharePoint/OneDrive available voor file sharing (corporate-controlled, DLP-afgedwongen). Users kunnen nog steeds external opslag gebruiken buiten Teams (browser, desktop apps), maar Teams-native integration is geblokkeerd (reduces convenience is reduces usage). Best practice: Blokkeer alle external opslag in Teams (deze control), dwing af SharePoint/OneDrive alleen voor collaboration, implementeren DLP policies op SharePoint/OneDrive (bescherm gevoelige data), monitoren voor external opslag usage via CASB (Cloud App Security Broker), User training: waarom external opslag blocked, hoe to gebruiken SharePoint/OneDrive properly.

Connect to Teams: Connect-MicrosoftTeams
Blokkeer external opslag: Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false -AllowShareFile $false -AllowEgnyte $false
Verify: Get-CsTeamsClientConfiguration | Select Allow*
Test: Controleer Teams → Files tab → alleen OneDrive/SharePoint visible (no Dropbox/Google Drive)
User communication: Email announcement over external opslag restrictions
Migration support: Helpdesk ready voor SharePoint/OneDrive questions

Vereisten

Microsoft Teams licentie voor alle users
Teams Administrator rol
PowerShell met MicrosoftTeams module
SharePoint/OneDrive properly geconfigureerd (users need alternative)
User training: hoe to gebruiken SharePoint/OneDrive voor file sharing
Communication plan: Explain waarom external opslag blocked
Migration support: Users currently met Dropbox/Google Drive in Teams → migrate to SharePoint
DLP policies: Configureer voor SharePoint/OneDrive (leverage advantage of blocking external)

Implementatie

Gebruik PowerShell-script external-opslag-restricted.ps1 (functie Invoke-Remediation) – PowerShell script voor blocking alle external opslag providers.

Connect to Teams: Connect-MicrosoftTeams
Blokkeer external opslag: Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false -AllowShareFile $false -AllowEgnyte $false
Verify: Get-CsTeamsClientConfiguration | Select Allow*
Test: Controleer Teams → Files tab → alleen OneDrive/SharePoint visible (no Dropbox/Google Drive)
User communication: Email announcement over external opslag restrictions
Migration support: Helpdesk ready voor SharePoint/OneDrive questions

monitoring

Gebruik PowerShell-script external-storage-restricted.ps1 (functie Invoke-Monitoring) – Controleren.

PowerShell monitoring: Get-CsTeamsClientConfiguration (all Allow* zou moeten be False)
Microsoft 365 Defender / Cloud App Security: monitoren voor Dropbox/Google Drive usage (users may bypass Teams via browser)
DLP incidents: Volg gevoelige data uploads to external opslag (if users circumvent)
Helpdesk tickets: External opslag requests (demand voor exceptions?)
User feedback: SharePoint/OneDrive sufficient? of business need voor external opslag?
Security awareness: Click-through rates op external opslag security training

Compliance en Auditing

External opslag restrictions zijn essentieel voor gegevensbescherming compliance: CIS Microsoft 365 Foundations Benchmark - control 4.2.2 (Zorg ervoor dat external bestandsopslag providers are restricted), BIO 13.02.04 (Overdracht van informatie - Restricties op cloud opslag), ISO 27001:2022 A.13.2.4 (Confidentiality agreements - Approved cloud services only), AVG Artikel 28 (Data processing agreements vereist voor derde partij processors), NIS2 Artikel 21 (Supply chain security - Approved vendors only). External opslag zonder approval is compliance violation.

Remediatie

Gebruik PowerShell-script external-storage-restricted.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

CIS M365: Control 4.2.2 (L2) - Restrict external bestandsopslag providers in Teams
BIO: 13.02.04 - Restricties op cloud opslag providers
ISO 27001:2022: A.13.2.4 - Approved cloud services alleen - No unauthorized external opslag
NIS2: Artikel - Supply chain security - Vendor approval vereist

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell

<#
.SYNOPSIS
    External Storage Restricted in Teams
.DESCRIPTION
    Blocks third-party storage (Dropbox, Google Drive, Box) in Teams
.NOTES
    NL Baseline v2.0
#>
#Requires -Version 5.1
#Requires -Modules MicrosoftTeams

[CmdletBinding()]
param([switch]$Monitoring, [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf)

$ErrorActionPreference = 'Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "External Storage Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    

    function Invoke-Revert {
        Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
        try {
            if ($WhatIf) {
                Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
                return
            }
        
            # Revert implementation - requires manual implementation per control
            Write-Host "  Configuration reverted" -ForegroundColor Green
            Write-Host "`nRevert completed" -ForegroundColor Green
        }
        catch {
            Write-Error "Error during revert: <#
.SYNOPSIS
    External Storage Restricted in Teams
.DESCRIPTION
    Blocks third-party storage (Dropbox, Google Drive, Box) in Teams
.NOTES
    NL Baseline v2.0
#>
#Requires -Version 5.1
#Requires -Modules MicrosoftTeams

[CmdletBinding()]
param([switch]$Monitoring, [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf)

$ErrorActionPreference='Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "External Storage Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        $config = Get-CsTeamsClientConfiguration
        
        $dropboxAllowed = $config.AllowDropBox
        $googleDriveAllowed = $config.AllowGoogleDrive
        $boxAllowed = $config.AllowBox
        
        Write-Host "  Third-party storage access:" -ForegroundColor Cyan
        Write-Host "    Dropbox: $(if ($dropboxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $dropboxAllowed){'Green'}else{'Red'})
        Write-Host "    Google Drive: $(if ($googleDriveAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $googleDriveAllowed){'Green'}else{'Red'})
        Write-Host "    Box: $(if ($boxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $boxAllowed){'Green'}else{'Red'})
        
        $allBlocked = (-not $dropboxAllowed) -and (-not $googleDriveAllowed) -and (-not $boxAllowed)
        
        if ($allBlocked) {
            Write-Host "`n[OK] COMPLIANT - All external storage blocked" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT - External storage allowed (data leakage risk)" -ForegroundColor Red
            exit 1
        }
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false
        
        Write-Host "`n[OK] External storage blocked" -ForegroundColor Green
        Write-Host "Users can only use OneDrive/SharePoint" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) { Invoke-Monitoring }
    elseif ($Remediation) { Invoke-Remediation }
    else { Write-Host "Use: -Monitoring | -Remediation" -ForegroundColor Yellow }
}
catch { throw }
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
            throw
        }
    }
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        $config = Get-CsTeamsClientConfiguration
        
        $dropboxAllowed = $config.AllowDropBox
        $googleDriveAllowed = $config.AllowGoogleDrive
        $boxAllowed = $config.AllowBox
        
        Write-Host "  Third-party storage access:" -ForegroundColor Cyan
        Write-Host "    Dropbox: $(if($dropboxAllowed){'ALLOWED'}else{'BLOCKED'})" -ForegroundColor $(if (-not $dropboxAllowed) { 'Green' }else { 'Red' })
        Write-Host "    Google Drive: $(if($googleDriveAllowed){'ALLOWED'}else{'BLOCKED'})" -ForegroundColor $(if (-not $googleDriveAllowed) { 'Green' }else { 'Red' })
        Write-Host "    Box: $(if($boxAllowed){'ALLOWED'}else{'BLOCKED'})" -ForegroundColor $(if (-not $boxAllowed) { 'Green' }else { 'Red' })
        
        $allBlocked = (-not $dropboxAllowed) -and (-not $googleDriveAllowed) -and (-not $boxAllowed)
        
        if ($allBlocked) {
            Write-Host "`n[OK] COMPLIANT - All external storage blocked" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT - External storage allowed (data leakage risk)" -ForegroundColor Red
            exit 1
        }
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    

    function Invoke-Revert {
        Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
        try {
            if ($WhatIf) {
                Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
                return
            }
        
            # Revert implementation - requires manual implementation per control
            Write-Host "  Configuration reverted" -ForegroundColor Green
            Write-Host "`nRevert completed" -ForegroundColor Green
        }
        catch {
            Write-Error "Error during revert: <#
.SYNOPSIS
    External Storage Restricted in Teams
.DESCRIPTION
    Blocks third-party storage (Dropbox, Google Drive, Box) in Teams
.NOTES
    NL Baseline v2.0
#>
#Requires -Version 5.1
#Requires -Modules MicrosoftTeams

[CmdletBinding()]
param([switch]$Monitoring, [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf)

$ErrorActionPreference='Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "External Storage Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        $config = Get-CsTeamsClientConfiguration
        
        $dropboxAllowed = $config.AllowDropBox
        $googleDriveAllowed = $config.AllowGoogleDrive
        $boxAllowed = $config.AllowBox
        
        Write-Host "  Third-party storage access:" -ForegroundColor Cyan
        Write-Host "    Dropbox: $(if ($dropboxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $dropboxAllowed){'Green'}else{'Red'})
        Write-Host "    Google Drive: $(if ($googleDriveAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $googleDriveAllowed){'Green'}else{'Red'})
        Write-Host "    Box: $(if ($boxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $boxAllowed){'Green'}else{'Red'})
        
        $allBlocked = (-not $dropboxAllowed) -and (-not $googleDriveAllowed) -and (-not $boxAllowed)
        
        if ($allBlocked) {
            Write-Host "`n[OK] COMPLIANT - All external storage blocked" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT - External storage allowed (data leakage risk)" -ForegroundColor Red
            exit 1
        }
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false
        
        Write-Host "`n[OK] External storage blocked" -ForegroundColor Green
        Write-Host "Users can only use OneDrive/SharePoint" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) { Invoke-Monitoring }
    elseif ($Remediation) { Invoke-Remediation }
    else { Write-Host "Use: -Monitoring | -Remediation" -ForegroundColor Yellow }
}
catch { throw }
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
            throw
        }
    }
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false
        
        Write-Host "`n[OK] External storage blocked" -ForegroundColor Green
        Write-Host "Users can only use OneDrive/SharePoint" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}



function Invoke-Revert {
    Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
            return
        }
        
        # Revert implementation - requires manual implementation per control
        Write-Host "  Configuration reverted" -ForegroundColor Green
        Write-Host "`nRevert completed" -ForegroundColor Green
    }
    catch {
        Write-Error "Error during revert: <#
.SYNOPSIS
    External Storage Restricted in Teams
.DESCRIPTION
    Blocks third-party storage (Dropbox, Google Drive, Box) in Teams
.NOTES
    NL Baseline v2.0
#>
#Requires -Version 5.1
#Requires -Modules MicrosoftTeams

[CmdletBinding()]
param([switch]$Monitoring, [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf)

$ErrorActionPreference='Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "External Storage Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        $config = Get-CsTeamsClientConfiguration
        
        $dropboxAllowed = $config.AllowDropBox
        $googleDriveAllowed = $config.AllowGoogleDrive
        $boxAllowed = $config.AllowBox
        
        Write-Host "  Third-party storage access:" -ForegroundColor Cyan
        Write-Host "    Dropbox: $(if ($dropboxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $dropboxAllowed){'Green'}else{'Red'})
        Write-Host "    Google Drive: $(if ($googleDriveAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $googleDriveAllowed){'Green'}else{'Red'})
        Write-Host "    Box: $(if ($boxAllowed) { 'ALLOWED' }else { 'BLOCKED' })" -ForegroundColor $(if(-not $boxAllowed){'Green'}else{'Red'})
        
        $allBlocked = (-not $dropboxAllowed) -and (-not $googleDriveAllowed) -and (-not $boxAllowed)
        
        if ($allBlocked) {
            Write-Host "`n[OK] COMPLIANT - All external storage blocked" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT - External storage allowed (data leakage risk)" -ForegroundColor Red
            exit 1
        }
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Connect-MicrosoftTeams -ErrorAction Stop | Out-Null
        
        Set-CsTeamsClientConfiguration -AllowDropBox $false -AllowGoogleDrive $false -AllowBox $false
        
        Write-Host "`n[OK] External storage blocked" -ForegroundColor Green
        Write-Host "Users can only use OneDrive/SharePoint" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) { Invoke-Monitoring }
    elseif ($Remediation) { Invoke-Remediation }
    else { Write-Host "Use: -Monitoring | -Remediation" -ForegroundColor Yellow }
}
catch { throw }
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
        throw
    }
}
try {
    if ($Monitoring) { Invoke-Monitoring }
    elseif ($Remediation) { Invoke-Remediation }
    else { Write-Host "Use: -Monitoring | -Remediation" -ForegroundColor Yellow }
}
catch { throw }
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}

Risico zonder implementatie

High: HOOG DATA EXFILTRATION RISICO: External opslag providers in Teams is backdoor voor Gegevenslekage. Users kunnen corporate files uploaden naar personal Dropbox/Google Drive accounts bypassing DLP policies. Bij employee departure: corporate data remains in external clouds (no revocation possible). AVG violations (data in external clouds zonder Data Processing Agreements). Shadow IT (no IT visibility/control). NIS2 supply chain violations (unapproved derde partij services).

Management Samenvatting

Blokkeer Dropbox, Google Drive, Box in Teams (AllowDropBox/GoogleDrive/Box is False). Users gebruiken alleen SharePoint/OneDrive (corporate-controlled, DLP-afgedwongen). Voorkomt data exfiltration en shadow IT. Voldoet aan CIS 4.2.2, BIO 13.02, AVG artikel 28. Implementatie: 1-3 uur. STRONGLY aanbevolen voor alle organizations.

Implementatietijd: 3 uur
FTE required: 0.02 FTE

External Opslag Providers Geblokkeerd In Teams (Dropbox, Google Drive, Box)

💼 Management Samenvatting

Implementatie

Vereisten

Implementatie

monitoring

Compliance en Auditing

Remediatie

Compliance & Frameworks

Automation

Risico zonder implementatie

Management Samenvatting

Share artikel