Detections
Analytics

6.2 Block OneDrive for Business sync from unmanaged devices

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Microsoft OneDrive allows users to sign in their cloud tenant account, and begin syncing select folders or the entire contents of OneDrive to a local computer. By default this includes any computer with OneDrive already installed, whether or not it is Azure Domain Joined or Active Directory Domain joined.

Rationale:

Unmanaged devices pose a risk, since their security cannot be verified through existing security policies, brokers or endpoint protection. Allowing users to sync data to these devices takes that data out of the control of the organization. This increases the risk of the data either being intentionally or accidentally leaked.

Note: This setting is only applicable to Active Directory domains when operating in a hybrid configuration. It does not apply to Azure AD domains. If you have devices which are only Azure AD joined, consider using a Conditional Access Policy instead.

Impact:

Enabling this feature will prevent users from using the OneDrive for Business Sync client on devices that are not joined to the domains that were defined.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To block the sync client on unmanaged devices, use the Microsoft 365 Admin Center:

Navigate to Microsoft 365 administration portal (https://admin.microsoft.com), Click on All Admin Centers and then Show All, then SharePoint.

Now click Settings followed by OneDrive - Sync

Check the Allow syncing only on computers joined to specific domains

Use the Get-ADDomain PowerShell command to obtain the GUID from each domain then add them to the box.

Click Save

To block the sync client on unmanaged devices, you can also use SharePoint Online PowerShell:

Connect to SharePoint Online using Connect-SPOService

Run the following PowerShell command and provide the DomainGuids from the Get-AADomain command:

Set-SPOTenantSyncClientRestriction -Enable -DomainGuids '786548DD-877B-4760-A749-6B1EFBC1190A; 877564FF-877B-4760-A749-6B1EFBC1190A'

NOTE: Utilize the -BlockMacSync:$true parameter if you are not using conditional access to ensure Macs cannot sync.

Default Value:

By default there is no domain restriction applied to the syncing of OneDrive.

See Also

https://workbench.cisecurity.org/files/4073

Item Details

References: CSCv7|13.4, CSCv7|14.6

Plugin: microsoft_azure

Control ID: dfbd433d6d34c61020f55a341f36fef3969d33628533ccca6e905587730ff0b1