STIGQter: STIG Summary: Microsoft OneDrive Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 13 Nov 2020:

OneDrive must only allow synchronizing of accounts for DoD organization instances.

DISA Rule

SV-230562r569322_rule

Vulnerability Number

V-230562

Group Title

SRG-APP-000516

Rule Version

DTOO605

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> "Allow syncing OneDrive accounts for only specific organizations", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.

If the organization does not have an instance of OneDrive, configure the Tenant GUID with "1111-2222-3333-4444".

Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\".

Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Check Contents

If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.

If the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.

If the following registry value does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\OneDrive\AllowTenantList\

Value Name: Organization's Tenant GUID

Value Type: REG_SZ
Value: Organization's Tenant GUID

If the organization does not have an instance of OneDrive, the Value Name and Value must be 1111-2222-3333-4444.

If it is not, this is a finding.

Vulnerability Number

V-230562

Documentable

False

Rule Version

DTOO605

Severity Override Guidance

If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.

If the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.

If the following registry value does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\OneDrive\AllowTenantList\

Value Name: Organization's Tenant GUID

Value Type: REG_SZ
Value: Organization's Tenant GUID

If the organization does not have an instance of OneDrive, the Value Name and Value must be 1111-2222-3333-4444.

If it is not, this is a finding.

Check Content Reference

M

Target Key

4015

Comments