A critical security vulnerability in Microsoft’s OneDrive auto-sync feature is silently exposing enterprise secrets at scale, according to new research from Entro Labs.
The study reveals that one in five exposed secrets in enterprise environments originates from SharePoint, not through sophisticated attacks, but via a default OneDrive feature that automatically moves local files containing sensitive credentials into cloud repositories.
The Hidden Risk of Default Auto-Sync
The security flaw stems from OneDrive for Business’s Known Folder Move (KFM) feature, which automatically synchronizes critical user folders, including Desktop and Documents, into OneDrive.
While designed for productivity and file accessibility across devices, this feature creates an unintended secrets goldmine in SharePoint Online document libraries.
When developers save supposedly “local-only” files like .env configurations, JSON configs, or credential notes to their desktop, OneDrive silently uploads these files to SharePoint without user awareness.
What begins as a personal backup becomes a tenant-wide exposure, as synced files inherit SharePoint’s broad visibility model, making them accessible to administrators and potentially compromised accounts.
The problem extends beyond enterprise environments. On Windows 10/11 systems, OneDrive sync is enabled by default even for personal accounts, with users encountering opt-out options only once during initial setup.
Most users skip through this configuration, unknowingly backing up sensitive local files to the cloud.
Scale of Secret Exposure in SharePoint
Entro Labs’ analysis of dozens of enterprise environments revealed consistent patterns of secret exposure across specific file types.
Spreadsheets pose the greatest risk, accounting for over 50% of SharePoint-hosted secrets, typically found in Excel workbooks used as password tracking sheets or developer scratchpads.
Plain text files, including .txt, .json, and .pem formats, collectively contribute 18% of exposed secrets, while PowerShell scripts, SQL dumps, Word documents, and OneNote files also contain credentials.
Unlike source code repositories with version control oversight, these user-generated files move with minimal friction and broad sharing permissions.
The research demonstrates how security best practices backfire when combined with auto-sync.
Developers following guidance to store secrets in environment variables and local .env files inadvertently create exposure vectors when OneDrive automatically backs up these “local-only” files to SharePoint.
Attack Surface Amplification
SharePoint’s position as a high-value target amplifies the auto-sync risk significantly.
Recent attacks, including the July 2025 “ToolShell” zero-day exploitation (CVE-2025-53770) that compromised hundreds of organizations through SharePoint servers, demonstrate attackers’ focus on these platforms.
Microsoft’s May 2025 update further blurs security boundaries by enabling OneDrive to detect personal Microsoft accounts on business devices and prompt users to sync personal files alongside work data.
This creates additional pathways for sensitive corporate information to migrate into personal storage or vice versa.
Phishing campaigns targeting SharePoint credentials expand the blast radius considerably.
With stolen credentials being the primary initial attack vector in data breaches, a single compromised admin account can search SharePoint environments using simple queries like “password,” “AWS,” or “token” to instantly surface synced secrets.
Attackers can then automate discovery using regex patterns and open-source scanning tools.
Security teams can mitigate these risks through several approaches: building organizational awareness about auto-sync behavior, disabling Known Folder Move where unnecessary, implementing Group Policy controls like DisableKnownFolderMove, and deploying specialized scanning solutions to detect secrets within SharePoint environments.
The research emphasizes that most traditional security scanners focus on code repositories while missing collaboration platforms where secrets increasingly accumulate.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The security flaw stems from OneDrive for Business's KFM feature, which automatically synchronizes critical user folders including Desktop and Documents into OneDrive.){kind=link}