Microsoft has addressed concerns regarding OneDrive URL probing, where attackers use batch requests to identify User Principal Names (UPNs). The company classifies this activity as a low-risk reconnaissance method, noting that it does not bypass authentication or grant direct account access.
The vulnerability stems from UPNs being embedded in OneDrive and SharePoint URLs, allowing attackers to verify user existence. Microsoft noted that these probing attempts do not appear in Microsoft Entra logs or Microsoft Purview, making them difficult for security teams to detect.
To mitigate mass enumeration, Microsoft has implemented rate limiting. Clients that repeatedly attempt to access non-existent OneDrive site collections will receive an HTTP 429 error, which restricts further requests from the specific IP address.
Microsoft emphasized that the primary threat lies in subsequent attacks, such as targeted phishing, credential stuffing, or social engineering, once a valid username is obtained. The company recommends enabling multi-factor authentication and conditional access policies.
