Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
sharepoint_onedrive_sync_restricted_unmanaged_devicesProvider: Microsoft 365
Service:
sharepointSeverity: HIGH
Categories:
trust-boundaries, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 SharePoint tenant settings for OneDrive sync enforce that only managed, domain-joined devices can sync. The evaluation looks for a configured list of approveddomain GUIDs that limits syncing to specific Active Directory domains.
Risk
Without this restriction, users can sync SharePoint/OneDrive files to unmanaged devices, undermining:- Confidentiality: data copied to personal or lost endpoints, outside DLP.
- Integrity: malicious edits synced back to sites.
- Availability: mass deletion or ransomware can propagate via sync clients.
Recommendation
Allow OneDrive sync only from managed, domain-joined devices by maintaining an approveddomain GUIDs list. For Entra-joined devices, require device compliance via Conditional Access. Apply least privilege, use DLP/sensitivity labels, and periodically review exceptions.
Remediation
- CLI
- Dashboard steps
Set-SPOTenantSyncClientRestriction -Enable -DomainGuids ‘<DOMAIN_GUID>’
References
- https://learn.microsoft.com/en-us/graph/api/resources/sharepoint?view=graph-rest-1.0
- https://learn.microsoft.com/en-us/sharepoint/allow-syncing-only-on-specific-domains
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = sharepoint_onedrive_sync_restricted_unmanaged_devices. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks