How to Configure Teams Files Policies and Third-Party Cloud Storage Permissions Using PowerShell CsTeamsFilesPolicy

Document collaboration is at the core of Microsoft Teams productivity. By default, Teams leverages SharePoint Online and OneDrive for Business to manage channel files and private chat attachments. However, many enterprise organisations operate strict regulatory compliance boundaries that prohibit users from integrating unapproved third-party consumer cloud storage services—such as Dropbox, Box, Google Drive, or Citrix ShareFile—directly into Teams channels and tabs. Conversely, specific specialized business units may require controlled access to external storage providers. To govern file sharing, third-party storage integration, and default file-opening behaviours, enterprise IT administrators utilize the Microsoft Teams PowerShell module and CsTeamsFilesPolicy cmdlets.

Understanding CsTeamsFilesPolicy Governance

The CsTeamsFilesPolicy cmdlet suite controls how files are handled across desktop, mobile, and web versions of Microsoft Teams. A files policy governs several critical parameters:

• Third-Party Cloud Storage Permissions: Enables or restricts whether end users can connect external non-Microsoft cloud storage services (including Dropbox, Box, Google Drive, and Egnyte) to Teams channels. Disabling third-party providers prevents shadow IT and ensures all corporate documents remain indexed under Microsoft Purview DLP and eDiscovery umbrellas.
• Default File Opening Application: Governs whether Office documents (Word, Excel, PowerPoint) shared in chat and channels open by default in the Teams embedded viewer, the browser (Office on the web), or native desktop applications.
• Granular Departmental Scoping: Allows compliance teams to enforce a complete storage lockdown on finance and healthcare personnel while permitting marketing teams to access approved vendor storage repositories.

Connecting to Microsoft Teams PowerShell

Launch an elevated PowerShell session and establish an authenticated connection using an account with the Teams Administrator or Global Administrator Entra ID role:

# Import Microsoft Teams module
Import-Module MicrosoftTeams

# Authenticate to tenant
Connect-MicrosoftTeams

Auditing Existing Teams Files Policies

Query the tenant to review all existing files policies, including the tenant-wide Global default:

Get-CsTeamsFilesPolicy | Select-Object Identity, Description, DefaultFileUploadApp, AllowedThirdPartyStorageProviders

To inspect the detailed parameter list of the Global policy:

Get-CsTeamsFilesPolicy -Identity "Global" | Format-List

Creating a Strict Files Policy Blocking Third-Party Storage

To ensure strict corporate compliance across standard employees, create a new files policy named Strict-InternalStorage-Only that completely blocks all third-party cloud storage integrations:

New-CsTeamsFilesPolicy -Identity "Strict-InternalStorage-Only" `
    -Description "Blocks all third-party cloud storage providers; enforces SharePoint and OneDrive only" `
    -AllowedThirdPartyStorageProviders @() `
    -DefaultFileUploadApp "Teams"

Passing an empty array @() to -AllowedThirdPartyStorageProviders immediately strips the “Add cloud storage” options for Dropbox, Box, Google Drive, and ShareFile from the Teams channel files tab.

Creating a Permissive Policy for Creative Teams

For marketing or media teams that must exchange assets with external advertising agencies using specific authorized providers (such as Box and Dropbox), create a scoped policy permitting only those selected platforms:

New-CsTeamsFilesPolicy -Identity "Creative-Agency-FilesPolicy" `
    -Description "Permits approved Box and Dropbox integrations for creative collaboration" `
    -AllowedThirdPartyStorageProviders @("Box", "Dropbox") `
    -DefaultFileUploadApp "Desktop"

Modifying Existing Files Policies

To adjust the allowed storage providers or default file opening mode on an existing policy, execute Set-CsTeamsFilesPolicy:

# Revoke Dropbox from the creative policy, leaving only Box
Set-CsTeamsFilesPolicy -Identity "Creative-Agency-FilesPolicy" `
    -AllowedThirdPartyStorageProviders @("Box")

Assigning Files Policies to Users and Security Groups

Assign the policy directly to individual accounts or batch-assign it across departmental security groups using Entra ID attributes:

# Assign directly to a user
Grant-CsTeamsFilesPolicy -Identity "[email protected]" `
    -PolicyName "Strict-InternalStorage-Only"

# Bulk assign across a financial services group
Get-AzADGroupMember -GroupDisplayName "Corporate Finance" | ForEach-Object {
    Grant-CsTeamsFilesPolicy -Identity $_.UserPrincipalName `
        -PolicyName "Strict-InternalStorage-Only"
}

To verify the effective files policy applied to an employee:

Get-CsUserPolicyAssignment -Identity "[email protected]" | Where-Object { $_.PolicyType -eq "TeamsFilesPolicy" }

Validating File Storage Governance in Teams

Have an assigned user restart the Microsoft Teams desktop client. Instruct them to navigate to any standard channel, select the Files tab, and click the + Add cloud storage button. Under the strict policy, the options for external consumer storage are removed, guaranteeing that corporate data remains protected inside enterprise Microsoft 365 boundaries.