Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'

НизкийУровень 2Ручная проверкаm365

Описание

Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. Ensure Microsoft 365 on the web third-party storage services are restricted. By using external storage services an organization may increase the risk of data breaches and unauthorized access to confidential information. Additionally, third-party services may not adhere to the same security standards as the organization, making it difficult to maintain data privacy and security.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Go to Settings > Org Settings > Services > Microsoft 365 on the web 3. Verify that Let users open files stored in third-party storage services in Microsoft 365 on the web is not checked. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "Application.Read.All". 2. Run the following script: $SP = Get-MgServicePrincipal -Filter "appId eq 'c1f33bc0-bdb4-4248-ba9b- 096807ddb43e'" if ((-not $SP) -or $SP.AccountEnabled) { Write-Host "Audit Result: ** FAIL **" } else { Write-Host "Audit Result: ** PASS **" } 3. Verify that AccountEnabled is False. Note: The check will also fail if the Service Principal does not exist as users will still be able to open files stored in third-party storage services in Microsoft 365 on the web.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Go to Settings > Org Settings > Services > Microsoft 365 on the web 3. Uncheck Let users open files stored in third-party storage services in Microsoft 365 on the web To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "Application.ReadWrite.All" 2. Run the following script: $SP = Get-MgServicePrincipal -Filter "appId eq 'c1f33bc0-bdb4-4248-ba9b- 096807ddb43e'" # If the service principal doesn't exist then create it first. if (-not $SP) { $SP = New-MgServicePrincipal -AppId "c1f33bc0-bdb4-4248-ba9b- 096807ddb43e" } Update-MgServicePrincipal -ServicePrincipalId $SP.Id -AccountEnabled:$false

Свойства

Операционные системы: Любая
Теги: m365saas
Источник: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 1.3.7 Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'