Microsoft OneDrive Auto-Sync Exposes Enterprise Secrets in SharePoint Online

A default auto-sync feature in Microsoft OneDrive automatically moves local files to SharePoint, creating a significant security risk by exposing sensitive data and secrets on a large scale.

Research from Entro Security highlights the severity of the issue, revealing that one in every five exposed secrets within an enterprise originates from files synced to SharePoint.

This unintended exposure stems from a OneDrive for Business feature called Known Folder Move (KFM).

Designed for convenience, KFM automatically syncs important user folders such as “Desktop” and “Documents” to OneDrive, which, in enterprise settings, stores the data in SharePoint Online document libraries.

While this ensures users can access their files from any device, it also creates a repository of sensitive information accessible to a broader audience than intended.

From Local Files To Cloud Exposure

The core of the problem is that files saved locally, including configuration files like .env or .json, and even spreadsheets named passwords.xlsx, are silently uploaded to the cloud.

Once on SharePoint, these files are no longer just personal documents; they become subject to the platform’s sharing and access policies.

This means they are always accessible to administrators, who can grant themselves permissions to read these synced files. Consequently, what begins as a local backup becomes a potential tenant-wide vulnerability.

This risk is not limited to enterprise accounts. On Windows 10 and 11, the OneDrive sync client is enabled by default for personal accounts as well.

Users often skip through the initial setup, where the option to opt out is presented as a “recommended step,” leading to their files being backed up without their full awareness.

Entro Security’s research into enterprise environments identified common patterns of secret exposure in SharePoint.

The research found that specific file types are particularly likely to contain unencrypted secrets:

• Spreadsheets (.xlsx): Over 50% of secrets found on SharePoint were located in workbooks used for tracking, logs, or as developer scratchpads.
  
• Plain Text Files: Files such as .txt, .json, and .pem accounted for 18% of the exposed secrets. These often contain configuration details or certificate bundles.
  
• Scripts and Documents: PowerShell scripts, SQL dumps, and Word documents also frequently contained credentials, demonstrating that almost any file can become a security risk when automatically synced.

“Entro Labs research found that nearly one in five exposed secrets came from SharePoint – not due to a CVE, but because of Microsoft’s everyday auto-sync feature”.

That’s what makes it so dangerous: even developers who follow best practices end up with secrets synced into the cloud, where attackers can easily find them.” Peleg Cabra, director of product marketing at Entro Security

This auto-sync functionality undermines a standard security best practice for developers, who store secrets in local .env files to avoid hardcoding them in source code.

With KFM enabled, these supposedly local-only files are synced to SharePoint, making them discoverable across the entire Microsoft 365 tenant.

The silent nature of this auto-sync feature significantly expands the potential damage of a security breach.

If an attacker compromises a single Microsoft 365 user account, they not only gain access to emails and applications but also to all the local files synced from the user’s computer.

For a compromised administrator account, the risk is even greater, as they can systematically search the entire SharePoint environment for sensitive data.

Attackers can automate searches for keywords like “password,” “API key,” or “token” to locate and exfiltrate secrets quickly.

To mitigate this risk, security experts recommend several actions. Organizations should raise awareness among employees, especially developers, about how their local files may be exposed.

Administrators can use Group Policy or Intune to disable the auto-sync feature where it is not necessary. 

security teams should implement solutions to continuously scan SharePoint environments for exposed secrets, detecting and remedying them before they can be exploited.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.