Security researchers have identified a reconnaissance technique that allows attackers to enumerate valid corporate usernames by checking OneDrive and SharePoint URLs. The method relies on predictable URL patterns tied to User Principal Names (UPN) in Microsoft 365 environments.
By sending requests to specific OneDrive or SharePoint links, an attacker can determine whether a given corporate account exists. Confirmed usernames can then be used for targeted phishing campaigns, password spraying, or credential-stuffing attempts with previously stolen passwords.
Microsoft has publicly acknowledged the behavior in its technical blog and stated that the discovered login does not, by itself, allow an attacker to bypass authentication. The company therefore rates the issue as low risk.
A notable concern is the lack of visibility: such enumeration attempts do not appear in Microsoft Entra sign-in logs or Microsoft Purview audit records. Organizations receive no direct notifications when external parties probe for valid user accounts using this technique.
Microsoft does impose rate limits on excessive requests to non-existent OneDrive sites, which makes large-scale harvesting more difficult but does not eliminate the possibility of targeted enumeration. The vendor continues to advise customers to deploy multi-factor authentication, conditional access policies, sign-in risk protections, and anti-phishing controls.
