6.2 Block OneDrive for Business sync from unmanaged devices

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Microsoft OneDrive allows users to sign in their cloud tenant account, and begin syncing select folders or the entire contents of OneDrive to a local computer. By default this includes any computer with OneDrive already installed, whether or not it is Azure Domain Joined or Active Directory Domain joined.


Unmanaged devices pose a risk, since their security cannot be verified through existing security policies, brokers or endpoint protection. Allowing users to sync data to these devices takes that data out of the control of the organization. This increases the risk of the data either being intentionally or accidentally leaked.

Note: This setting is only applicable to Active Directory domains when operating in a hybrid configuration. It does not apply to Azure AD domains. If there are devices which are only Azure AD joined, consider using a Conditional Access Policy instead.


Enabling this feature will prevent users from using the OneDrive for Business Sync client on devices that are not joined to the domains that were defined.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


Ensure OneDrive for Business sync is blocked from unmanaged devices

Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint

Click Settings then select OneDrive - Sync.

Check the Allow syncing only on computers joined to specific domains.

Use the Get-ADDomain PowerShell command to obtain the GUID from each domain then add them to the box.

Click Save.

To block the sync client on unmanaged devices using PowerShell:

Connect to SharePoint Online using Connect-SPOService

Run the following PowerShell command and provide the DomainGuids from the Get-AADomain command:

Set-SPOTenantSyncClientRestriction -Enable -DomainGuids '786548DD-877B-4760-A749-6B1EFBC1190A; 877564FF-877B-4760-A749-6B1EFBC1190A'

NOTE: Utilize the -BlockMacSync:$true parameter if you are not using conditional access to ensure Macs cannot sync.

Default Value:

By default there is no domain restriction applied to the syncing of OneDrive.

See Also


Item Details


References: 800-53|CM-7b.

Plugin: microsoft_azure

Control ID: 55ae0f5fea927846b66f3607d588f71e28c537d837b6e99680d3fff46d35ca78