Hackers Can Extract Usernames From OneDrive URLs, but Microsoft Calls It Low Risk

Microsoft has classified username enumeration through OneDrive and SharePoint URLs as a low-risk security threat, even though attackers can use the information to prepare phishing and credential-based attacks.

The technique allows attackers to identify user principal names (UPNs) associated with organizational accounts. However, Microsoft says discovering a valid username does not bypass authentication or give attackers direct access to an account.

Why Microsoft considers the threat low risk

OneDrive and SharePoint URLs can reveal information that helps attackers identify valid organizational usernames without signing in.

Microsoft considers this passive reconnaissance rather than a direct security breach. However, attackers could use the usernames in phishing campaigns, brute-force attempts, credential stuffing, or social engineering attacks.

Another concern is visibility. Microsoft confirms that standard sign-in logs and Microsoft Purview do not record this type of URL probing, leaving security teams without a direct way to monitor the activity or create alerts for it.

OneDrive automatically limits suspicious requests

Microsoft says OneDrive and SharePoint use automatic throttling to limit repeated URL requests.

The mechanism makes large-scale username enumeration more difficult but does not completely prevent attackers from discovering usernames.

Microsoft recommends MFA and Conditional Access

Microsoft advises organizations to focus on preventing attackers from exploiting discovered usernames rather than treating enumeration itself as an account compromise.

The company recommends several protections:

• Microsoft Entra multifactor authentication (MFA) to prevent unauthorized access using stolen passwords.
• Microsoft Entra Conditional Access to restrict suspicious sign-in attempts.
• Sign-in risk policies to identify and respond to potentially compromised accounts.
• Phishing protection and employee training to reduce social engineering risks.

Microsoft maintains that username discovery alone poses limited risk when organizations enforce appropriate authentication and security policies.

Microsoft has also introduced several other OneDrive improvements. The company recently announced a major AI upgrade with Copilot file analysis, easier sharing, and smarter photo features.

For IT administrators, Microsoft introduced a OneDrive Sync CLI to simplify management tasks. The company is also cleaning up OneDrive’s right-click menu in Windows 11.