How to block file sharing sites on your network
File transfer services and personal cloud storage are the easiest way for data to leave an organisation, by accident or on purpose. Blocking them well means stopping personal accounts while keeping the company's own storage working.
Written for IT admins, MSPs, school IT teams and filtering vendors, with a data loss prevention angle throughout.
What counts as a file sharing site
"File sharing" covers three groups with different risks and different fixes. Decide which ones your policy targets before you change anything.
Transfer services
Send a link, file expires later- Large file senders such as WeTransfer and similar services
- Anonymous "upload and share a link" sites
- Browser to browser transfer tools
No account is needed for many of them, so they are the fastest route for a file to leave.
Personal cloud storage
Sync folders and shared drives- Dropbox, Box, MEGA and other storage providers
- Personal Google Drive, OneDrive and iCloud Drive accounts
- Desktop sync clients that copy whole folders
The hard part: company accounts often live on the same domains as personal ones.
File hosting and P2P
Public downloads, often pirated- One click hosting sites used to share large archives
- Torrent index sites and trackers
- Peer to peer client downloads
More of a malware and copyright risk than a data leak risk. See our guide to blocking torrent sites.
Why organisations block file sharing sites
Data leaks
A spreadsheet of customer records sent to a personal account is a reportable incident in many jurisdictions.
Insider departures
Staff leaving for a competitor sometimes copy files to personal storage in their last weeks.
Malware delivery
Phishing emails often link to files on trusted storage and transfer services, because those domains pass reputation checks.
Compliance
Data protection, health and finance rules expect control over where regulated data is stored and sent.
Shadow IT
Teams adopt their own storage without contracts, retention or access reviews.
Schools
Hosting sites spread inappropriate content and pirated games, and transfer links sidestep the web filter.
Sanctioned vs unsanctioned: a policy matrix
Blanket blocks rarely survive contact with the business. A matrix that separates the company's own services from everything else is easier to defend and to enforce.
| Service type | Company tenant or approved tool | Personal or unknown account | Control needed |
|---|---|---|---|
| Microsoft OneDrive and SharePoint | Allow | Block sign-in | Microsoft 365 tenant restrictions |
| Google Drive | Allow | Block sign-in | Google Workspace allowed domains header |
| Other cloud storage (Dropbox, Box, MEGA) | Allow only if contracted | Block | Category block plus allowlist, or provider team controls |
| Large file transfer services | Allow downloads from partners | Block uploads | Gateway or CASB with upload inspection |
| Anonymous upload sites | Not applicable | Block | Cloud Storage / File Hosting category |
| Torrent and P2P | Exception for named devices | Block | File Sharing/P2P category and app control |
| Personal webmail | Allow reading if policy permits | Block attachments upload | Gateway upload rules, email category |
Tenant restrictions: block personal accounts, keep your own
Personal and company OneDrive or Google Drive accounts use the same domains, so a domain block hits both. Tenant restrictions solve this by adding a header to sign-in traffic that names your organisation. Both need a proxy or firewall that can inspect and modify HTTPS.
Microsoft 365
- Decide which tenants are allowed: your own and any partner tenants staff must use.
- Configure tenant restrictions in Microsoft Entra; the newer version can also be enforced on Windows devices without a proxy.
- For proxy based enforcement, have the proxy insert the tenant restriction headers on Microsoft sign-in traffic.
- Test with a personal Microsoft account: sign-in should be refused with a clear message.
Google Workspace
- List the Workspace domains your users may sign in to.
- Configure the proxy to add the
X-GoogApps-Allowed-Domainsheader with those domains to Google traffic. - Users who try a personal Google account see a message that the account is not allowed on this network.
- On managed Chrome, also restrict which accounts can sign in to the browser.
Other storage providers offer similar team or network controls. Check each provider's current admin documentation, because the details change. Exact setting names in Microsoft and Google consoles also change, so follow their current guidance.
The DLP layer: four controls beyond the block
A category block reduces the number of exits. Data loss prevention watches what still goes through the exits you keep open.
Upload inspection
A gateway or CASB inspects files uploaded to allowed services and stops those that match sensitive patterns or labels.
Sensitivity labels
Files labelled confidential can be blocked from any upload outside the tenant, regardless of destination.
Endpoint DLP
Agents on laptops watch copies to USB drives, personal sync folders and browser uploads.
Shadow IT discovery
Reports from firewall and DNS logs show which storage apps are used, so you can sanction or block each one.
Microsoft Defender for Cloud Apps, for example, lets admins mark discovered apps as unsanctioned, and on onboarded Windows devices that tag can block access through Defender for Endpoint. Accurate categories make discovery reports far more useful, because unknown domains are grouped by what they do.
Warning signs worth an alert
| Signal | Why it matters | Suggested response |
|---|---|---|
| Large uploads to a storage or transfer domain outside the tenant | The classic pattern of a bulk copy before someone leaves | Alert security, check with the manager |
| Repeated block hits on several transfer services in one session | A user is trying to find any route that works | Contact the user and offer the approved tool |
| A new sync client process on a managed laptop | Folders may already be syncing to personal storage | Remove the client, review what was synced |
| Uploads at unusual hours from a service account | Possible compromise or a misconfigured backup job | Investigate the account and the destination |
| Traffic to a newly registered domain with "share" or "drop" in the name | Fresh upload sites, or phishing pages imitating storage services | Block, then look up the domain category |
Methods: router, firewall, DNS, Intune, Google Admin and MDM
Router
- Use a filtering DNS resolver that blocks Cloud Storage / File Hosting and File Sharing/P2P.
- Block other DNS resolvers so devices cannot skip it.
- Accept the limit: no upload control and no tenant awareness.
- Best for small offices with no company cloud storage.
Firewall
- Block the storage and file sharing URL categories in the outbound web filter.
- Use application control to allow your sanctioned storage app and block the rest.
- Where the firewall supports it, block upload actions for file transfer apps only.
- Add tenant restriction headers if the firewall performs HTTPS inspection.
DNS filter
- Block Cloud Storage / File Hosting for groups that never need it.
- Allowlist the domains of your sanctioned storage service.
- Use DNS logs as a discovery source for shadow storage apps.
- Remember DNS cannot tell uploads from downloads or personal from company accounts.
Microsoft Intune and Defender
- Block installation of unsanctioned sync clients with app control policies.
- Use Defender custom indicators or web content filtering to block storage domains.
- Apply endpoint DLP rules to uploads and USB copies.
- Use Intune app protection on phones to stop "save as" to personal storage from work apps.
Google Admin console
- Restrict browser sign-in to your Workspace domains on managed Chrome.
- Block storage and transfer sites through the URL blocklist or a category filter.
- Control Drive sharing outside the domain in Workspace settings.
- Block extensions that add upload or transfer features.
Mobile MDM
- Separate work and personal data with work profiles or managed apps.
- Prevent managed apps from opening files in unmanaged storage apps.
- Keep unsanctioned storage apps out of the managed catalogue.
- Push your DNS or filtering profile for the category block.
Bypass and leak routes to plan for
Users who need to move a file will find a way. Offer an approved secure transfer route, then close the common side doors. Most of these routes need a device control as well as a network rule.
VPNs and proxies
A tunnel hides the upload completely. Block them with our guides on VPN apps and proxy sites.
Personal email
Attachments to a personal webmail account. Block uploads to webmail or use endpoint DLP.
Messaging apps
Chat apps accept file uploads. Apply the same upload policy to the messaging category.
AI tools with uploads
Many AI assistants accept documents. Our AI and LLM tools category lets you include them in the same policy.
Fresh hosting domains
New upload sites appear constantly, often behind short links. Use a policy for newly registered domains.
USB and hotspots
Data that never touches your network. Endpoint DLP and device control are the only answer here.
Give users an approved route before you block
The fastest way to make a file sharing block fail is to leave people with no way to send a large file. Pick an approved route first, announce it, then switch on the block.
Expiring links
Shared links from the company tenant should expire by default, for example after a set number of days.
External sharing rules
Limit who outside the organisation can receive links, and require sign-in for sensitive folders.
Audit trail
Every share and download should be logged, so you can answer "who sent what to whom".
Size limits that fit
If designers or engineers need very large transfers, size the approved tool for them, or they will find another one.
Clear guidance
Put a one line pointer to the approved tool on the block page, where users see it at the moment they need it.
Partner exceptions
Some clients insist on their own transfer portal. Allowlist those portals by name, with an owner and a review date.
Starting points by organisation type
Use these as a first draft and adjust for your own data, contracts and regulators.
| Organisation | Transfer services | Personal storage | File hosting and P2P | Extra controls |
|---|---|---|---|---|
| K-12 school | Block for students | Block personal accounts, allow the school tenant | Block | Device filtering that follows Chromebooks home, see K-12 web filtering |
| Small business | Block uploads, allow downloads | Allow the company tenant only | Block | DNS category block, a simple approved transfer tool |
| Healthcare, legal, finance | Block | Tenant restrictions on all networks | Block | Endpoint DLP, sensitivity labels, USB control |
| MSP managed tenants | Template block with tenant overrides | Per tenant tenant restrictions | Block | Shadow IT reports in monthly reviews, see MSP web filtering |
| Higher education | Allow for staff, warn for students | Allow, with DLP on research data | Block on residence networks | Research data classification |
How to test the file sharing block
Use a test file with harmless content and a clear name. Test from managed and unmanaged devices on each network segment. If you use labels, create one test file per sensitivity label so you can see which rule fired. Record each result with the date, device and outcome, so the next review can repeat the same checks.
- Open three file transfer services: the upload page should be blocked or the upload refused.
- Download a file from a partner's transfer link if your policy allows downloads.
- Sign in to a personal OneDrive or Google account: tenant restrictions should refuse it.
- Sign in to your company tenant: it should work normally.
- Try installing an unsanctioned sync client on a managed laptop: app control should block it.
- Upload a labelled confidential file to an allowed service: DLP should stop it.
- Look up several storage domains in our domain lookup tool to confirm their categories.
- Check that business partner portals and document embeds still load.
- Confirm each blocked attempt appears in logs with user and device.
- Repeat after changes to proxy, firewall or tenant settings.
Category-based blocking with our database
Our 59 categories separate storage from peer to peer, so you can be strict or light. Cloud Storage / File Hosting covers storage, transfer and hosting services; File Sharing/P2P covers torrent and peer to peer sites, described on our file sharing category page.
Each domain can carry several ranked categories. A storage service with a messaging feature, for example, is recognisable for both policies.
Use the categories for blocking, for shadow IT discovery reports and for DLP rules that apply only to unsanctioned destinations. Vendors embedding this in products can read about OEM licensing.
- 120 million categorized domains in 59 categories plus the IAB Content Taxonomy.
- About 300,000 newly registered domains categorized daily and checked again after a week and a month.
- Daily delta files; all other domains refreshed monthly.
- CSV, Parquet or JSON in your own systems, air-gapped if needed, plus a lookup API.
- Exports as DNS RPZ, hosts files or firewall external dynamic lists, see blocklist formats.
- Fits enterprise stacks described in web filtering software for business.
File sharing blocking FAQ
How do I block personal cloud storage but keep our company OneDrive or Google Drive?
You cannot do it by domain alone, because personal and company accounts share the same domains. Use tenant restrictions: Microsoft 365 tenant restrictions and Google Workspace's allowed domains header let a proxy or firewall permit sign-in only to your own organisation's accounts.
Should I block file transfer services like WeTransfer?
Most organisations that handle confidential data block them, or allow downloads but block uploads, and offer an approved secure transfer tool instead. Blocking without an alternative pushes users to worse workarounds.
Can I block uploads but allow downloads?
Yes, with a secure web gateway, a cloud access security broker or a firewall that inspects HTTPS. They can tell an upload request from a download and apply different rules. DNS filters cannot, because they only see the domain name.
Is a DNS block enough to stop data leaving through file sharing sites?
It stops the easy cases and is a good first layer. For real data loss prevention you also need upload inspection, endpoint DLP and controls on email, USB storage and messaging apps.
Which categories cover file sharing sites?
Our database separates Cloud Storage / File Hosting, which covers storage and transfer services, from File Sharing/P2P, which covers torrent and peer to peer sites. Block both for a strict policy, or only the second for a lighter one.
Will blocking file sharing break websites?
Some sites load documents or images from storage services, and some partners send files by transfer link. Keep a short allowlist for the partners and test key business sites after the change.
Add storage and file sharing categories to your product
License a categorized domain database for blocking, discovery and DLP policies, delivered as files with daily updates. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
WeTransfer is a trademark of WeTransfer B.V. Dropbox is a trademark of Dropbox, Inc. Box is a trademark of Box, Inc. MEGA is a trademark of Mega Limited. Microsoft, Microsoft 365, OneDrive, SharePoint, Entra, Intune and Defender are trademarks of Microsoft Corporation.
Google, Google Drive, Google Workspace and Chrome are trademarks of Google LLC. Apple and iCloud are trademarks of Apple Inc. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.