UPN

OneDrive and SharePoint URLs Enable Corporate Username Enumeration, Microsoft Calls Risk Low

Attackers can discover valid corporate User Principal Names by probing OneDrive and SharePoint URLs without triggering authentication logs. Microsoft acknowledges the reconnaissance technique but classifies it as low severity because a discovered login alone does not bypass multi-factor authentication. The method leaves no traces in Microsoft Entra ID or Microsoft Purview audit logs, and organizations receive no alerts when usernames are enumerated this way. Microsoft limits bulk requests against non-existent OneDrive sites yet does not fully block the enumeration vector. The company recommends organizations rely on conditional access policies, phishing-resistant MFA, and sign-in risk protections to prevent follow-on attacks such as password spraying or targeted phishing. The issue primarily affects small and medium businesses as well as enterprises using Microsoft 365.