An important security update on Microsoft OneDrive

In a forthcoming software update, currently scheduled for June, Microsoft will be introducing a new feature allowing users on hybrid devices to sync their personal and professional OneDrive files.  

This feature introduces several new data exposure risks that Microsoft tenant managers will need to take immediate action on.

The new feature, explained

The feature, officially titled “Prompt to Add Personal Account to OneDrive Sync,” detects if personal accounts are being used on business devices. If so, the user will be sent a single prompt, providing the option to synchronize both accounts. If accepted, synchronization begins with no further action or admin approval required.

The risks

The feature makes it easy for employees - inadvertently or otherwise - to synchronize their personal files with their corporate OneDrive.  The risks here are multiple, including: 

• The risk of transferring sensitive business files to personal accounts that lack corporate-grade protections
• The risk of disrupting corporate audit trails, with personal folders that do not fall under company jurisdiction
• The risk of exposing sensitive corporate data to third parties
• The risk of breaking regulatory compliance

Preparation and response

Microsoft admins can manage the threat using the following OneDrive policies:

• ‘DisablePersonalSync’, which disables personal OneDrive synchronization entirely and is considered the most effective defense.
• ‘DisableNewAccountDetection’, which disables the synchronization prompt, while still allowing for personal OneDrive access on company devices.

Additionally, some ongoing best practices include:

• Monitoring OneDrive activity, using Microsoft 365’s activity explorer to identify attempted syncs or other unexpected data movements.
• Communicating any changes to end users, explaining any associated risks, necessary security updates or changes to processes.
• Regularly reviewing known Cloud service updates and updating security baselines accordingly.

With inforcer, MSPs can push major policy changes to multiple tenants within minutes. To find out more, book a demo below: