Detect Personal OneDrive Use

G5 Cyber Security

2 weeks ago

TL;DR

Yes, a company can detect personal OneDrive accounts being used on company machines using a combination of methods including the Microsoft 365 Admin Center, endpoint detection and response (EDR) tools, network monitoring, and potentially data loss prevention (DLP) policies. It’s not foolproof but provides good visibility.

How to Detect Personal OneDrive Use

Microsoft 365 Admin Center Activity Logs: This is your first stop.
- Sign in to the Microsoft 365 admin center with administrator credentials.
- Navigate to Reports > Usage.
- Select OneDrive from the activity report options.
- Filter by user and date range. Look for unusual activity patterns or users who aren’t expected to be using OneDrive (if it’s only provisioned for certain roles). This won’t *directly* show personal accounts, but can highlight anomalies.
Endpoint Detection and Response (EDR) Tools: EDR solutions provide deeper visibility into what’s happening on company devices.
- Most EDR tools allow you to monitor processes running on endpoints. Look for the OneDrive process (
```
OneDrive.exe
```
  ) but investigate further if it’s not associated with a corporate Microsoft account.
- Search for file system activity related to OneDrive folders (e.g., Documents, Pictures) being synced to locations other than the company-managed OneDrive folder.
- EDR tools can often detect registry entries or scheduled tasks created by personal OneDrive installations.
Network Monitoring: Track network traffic.
- Use a network monitoring tool to identify connections to OneDrive domains (
```
onedrive.live.com
```
  ,
```
microsoft.com
```
  ) originating from company devices. This can indicate personal account usage.
- Examine the URLs accessed. Personal OneDrive accounts will have different URL structures than corporate ones.
Data Loss Prevention (DLP) Policies: Configure DLP to identify sensitive data being uploaded to non-approved cloud storage services.
- In the Microsoft 365 compliance center, create a DLP policy that scans OneDrive for company confidential information.
- Set conditions to alert or block uploads of sensitive data to URLs associated with personal OneDrive accounts. This requires maintaining an up-to-date list of these domains.
Windows Event Logs: Check the Windows event logs for clues.
- Look for events related to OneDrive installations or configuration changes in the Application and System logs.
- Specifically, check for events indicating the creation of new OneDrive accounts or the syncing of files to personal OneDrive locations.
Group Policy (for Windows Domains): Restrict application execution.
- You can use Group Policy to block the installation and execution of the OneDrive desktop app, preventing users from installing a personal version. This is a preventative measure rather than detection.

Important Considerations

Privacy: Be transparent with employees about monitoring policies. Consult legal counsel before implementing any monitoring solutions.
False Positives: Network and EDR alerts can generate false positives. Investigate thoroughly before taking action.
Circumvention: Tech-savvy users may attempt to circumvent detection methods (e.g., using web browsers instead of the desktop app). A layered approach is best.