DTOO605 - OneDrive must only allow synchronizing of accounts for DoD organization instances.

Information

OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.

Solution

Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> 'Allow syncing OneDrive accounts for only specific organizations', with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.

If the organization does not have an instance of OneDrive, configure the Tenant GUID with '1111-2222-3333-4444'.

Group policy files for OneDrive are located on a system with OneDrive in '%localappdata%\Microsoft\OneDrive\BuildNumber\adm\'.

Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_OneDrive_V2R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-230562r879887_rule, STIG-ID|DTOO605, STIG-Legacy|SV-98853, STIG-Legacy|V-88203, Vuln-ID|V-230562

Plugin: Windows

Control ID: 6c122f1779a9015d585550b0da5e1c6784f433a4447d959e3e88f360403b34f6