Block File Sharing in Teams

COVID-19 has led many IT Departments scrambling to roll out some form of conference/ collaboration tool as many had to work remotely. This has affected organizations that where were not agile or cloud agnostic by not adopting to modern workplace earlier on.

Microsoft Teams runs on SharePoint Online, OneDrive in its core, organizations running on-premises compliance/DLP solutions will find it hard to put in controls for data in the cloud, not being an early adopter, and having to enable collaboration tools such as Microsoft Teams is a daunting task when you want to protect the organizational data from going walkabouts. If your organization is one of those, which is like a cat on the wall – how do we do it?

Block File sharing in Teams by:

1. Not assigning a SharePoint Online license for End-users

2. Not creating a Teams or Channels, if you do….

3. Create Teams for your organization but remove the Teams members from having EDIT permission on the Teams SharePoint Site.

4. Additionally if the tenant has Microsoft Cloud App Security enabled – create a session based conditional policy, which blocks upload and download of files in Teams and SharePoint Online.

SharePoint Online License – by not assigning this you deprive the end users from accessing OneDrive for business, which is primary storage for file sharing when it comes to 1-1 and group chats.

Creating a Team – when a team is created with members, this creates a SharePoint online site, which by default allows members to have edit permission on the site. By removing the EDIT permission from the Team site leaves members with only read permission leaving only the owner of the Team/SharePoint site full permission, no just do not assign or delegate the owner permission to a regular user.

Microsoft Cloud App Security – is a Microsoft CASB solution (Cloud Access Security Broker) acts as a reverse proxy. A session based conditional policy can be configured to prevent file uploads/downloads in Teams/Sharepoint site, caveat this only works when accessing them via Web but not through desktop client, hence the above point – remove EDIT permission for Team members. MCAS gives you an insight and alert when someone does indeed try to upload a file as it will block and alert the admin.

Now that you have control of filesharing and enabled Microsoft Teams, start strategic roll out of cloud solutions for DLP, Information protection and governance, classification – all of this is available via Microsoft 365 through Azure Information Protection, DLP, Azure and Defender ATP which can scan and classify your organization data automatically based on data sensitivity you can control.

9 thoughts on “Block File Sharing in Teams

  1. virendrak August 20, 2020 / 7:51 pm

    If we do not assign license to user in O365 (which is NOT recommended), we have noticed that the users were able to share the file in teams chat using OneDrive. When two users chat in teams, the file exchanged b/w them is saved in sender’s OneDrive and automatically shared with recipients. Also unlicensed user can create teams as well.


      • robdy November 26, 2020 / 3:09 pm

        virendrak is right, not assigning the license doesn’t prevent anything. On my brand new account I’m able to even download all the team files. Conditional Access worked just fine.


      • Godwin Daniel November 26, 2020 / 7:47 pm

        Not when you don’t assign them OneDrive license.


  2. Ariel August 24, 2020 / 3:43 pm

    There’s a way to do it simply with a friendly UI called SphereShield. It has a granular approach to control which users have permission to file sharing, messaging, calls and screensharing

    Here’s the appsource link:

    This is the Official Site:

    All the best!

    Liked by 1 person

  3. Rog October 8, 2020 / 2:20 pm

    Everything looks good but if we remove the owner, nobody is able to add a team member any more. how did you handle this?


    • Godwin Daniel October 9, 2020 / 6:46 am

      Yes, you will still need a owner, so perhaps add a owner who is not an actual user which only you as the admin can login and add members – more controlled. members will request to add other members, you will recieve email notification to add them.


Leave a Reply to Rog Cancel reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.