Microsoft OneDrive Auto-Sync Flaw Leaks Enterprise Secrets from SharePoint Online

A new report from Entro Labs reveals that one in five exposed secrets in large organisations can be traced back to SharePoint, not a flaw in SharePoint itself but OneDrive’s default auto-sync. OneDrive for Business includes a Known Folder Move option that automatically redirects important folders such as Desktop and Documents into OneDrive and, by extension, SharePoint document libraries.

Files saved in those folders—even temporary configuration JSONs, .env files, or scratch pads—are copied to the cloud without alerting users, where they then follow SharePoint’s sharing rules and can become tenant-wide exposures. The article notes that over half of the exposed secrets came from Excel workbooks, with plain-text files and scripts also contributing, and that a single admin or compromised service account can retrieve these credentials in minutes.

To reduce risk, the piece suggests steps such as disabling Known Folder Move where not needed and using Group Policy or Microsoft Intune settings like DisableKnownFolderMove and DisablePersonalSync, alongside deploying secrets-scanning tools.