Microsoft OneDrive Security Technical Implementation Guide

The Microsoft OneDrive Security Technical Implementation Guide (V2 R4) has 12 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

12STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Wed Jul 02 2025

The use of personal accounts for OneDrive synchronization must be disabled.

Microsoft OneDrive Security Technical Implementation Guide

Assessment Title

Rule Text

The use of personal accounts for OneDrive synchronization must be disabled.

Description

Discussion Text

OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-230564

Rule

SV-230564r960963_rule

Severity

medium

Rule Version

DTOO607

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_CURRENT_USER
Registry Path: \Software\Policies\Microsoft\OneDrive\

Value Name: DisablePersonalSync

Value Type: REG_DWORD
Value: 0x00000001 (1)

Implementation Procedure

Fix Text

Configure the policy value for User Configuration >> Administrative Templates >> OneDrive >> "Prevent users from syncing personal OneDrive accounts" to "Enabled". 

Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\".

Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

STIG check 11 of 12 in the Microsoft OneDrive STIG checklist

← Previous · V-230562OneDrive must only allow synchronizing of accounts for DoD organization instances.Next · V-275978 →The version of OneDrive running on the system must be a supported version.