Back to Checks
m365

OneDrive sync from unmanaged devices is blocked

sharepoint_onedrive_sync_restricted_unmanaged_devices
Service: sharepointSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariese3
Resource Type:NotDefined

Microsoft 365 SharePoint tenant settings for OneDrive sync enforce that only managed, domain-joined devices can sync. The evaluation looks for a configured list of approved domain GUIDs that limits syncing to specific Active Directory domains.

Prowler logoProwlerprowler-provider-m365

Risk

Without this restriction, users can sync SharePoint/OneDrive files to unmanaged devices, undermining:

  • Confidentiality: data copied to personal or lost endpoints, outside DLP.
  • Integrity: malicious edits synced back to sites.
  • Availability: mass deletion or ransomware can propagate via sync clients.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks sharepoint_onedrive_sync_restricted_unmanaged_devices

Recommendation

Allow OneDrive sync only from managed, domain-joined devices by maintaining an approved domain GUIDs list. For Entra-joined devices, require device compliance via Conditional Access. Apply least privilege, use DLP/sensitivity labels, and periodically review exceptions.

Remediation

CLI

Set-SPOTenantSyncClientRestriction -Enable -DomainGuids '<DOMAIN_GUID>'

Other

1Go to the SharePoint admin center: https://admin.microsoft.com/sharepoint
2Select Settings > Sync
3Check "Allow syncing only on computers joined to specific domains"
4Enter at least one AD domain GUID (separate multiple GUIDs with semicolons)
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.sharepoint.sharepoint_client import (
    sharepoint_client,
)


class sharepoint_onedrive_sync_restricted_unmanaged_devices(Check):
    """
    Check if OneDrive sync is restricted for unmanaged devices.

    This check verifies that OneDrive sync is restricted to managed devices only.
    Unmanaged devices can pose a security risk by allowing users to sync sensitive data to unauthorized devices,
    potentially leading to data leakage or unauthorized access.

    The check fails if OneDrive sync is not restricted to managed devices (AllowedDomainGuidsForSyncApp is empty).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the OneDrive sync restriction check.

        Retrieves the OneDrive sync settings from the Microsoft 365 SharePoint client and
        generates a report indicating whether OneDrive sync is restricted to managed devices only.

        Returns:
            List[CheckReportM365]: A list containing the report object with the result of the check.
        """
        findings = []
        settings = sharepoint_client.settings
        if settings:
            report = CheckReportM365(
                self.metadata(),
                resource=settings if settings else {},
                resource_name="SharePoint Settings",
                resource_id="sharepointSettings",
            )
            report.status = "PASS"
            report.status_extended = "Microsoft 365 SharePoint does not allow OneDrive sync to unmanaged devices."

            if len(settings.allowedDomainGuidsForSyncApp) == 0:
                report.status = "FAIL"
                report.status_extended = "Microsoft 365 SharePoint allows OneDrive sync to unmanaged devices."

            findings.append(report)

        return findings

References