Why Your Team's OneDrive Setup Is Probably Leaking Data
Most businesses don't realize they have a data exposure problem until an auditor or a former employee does it for them. I've seen it at least a dozen times now. A company switches to Microsoft 365, IT sets up the basic sharing policies, and everyone gets on with their day. Six months later, someone finds a folder labeled "Confidential" sitting in a public URL with no authentication required. That's the kind of gap I'm talking about. "Onedhs" is a term that's been circulating in certain compliance circles. It refers to the aggregation of data stored across disparate OneDrive accounts — especially personal or improperly governed instances — where that data falls outside the reach of your DLP policies, eDiscovery, and audit logging. When employees use personal OneDrive accounts for work, or when shared links aren't properly scoped, you create exactly this kind of blind spot. Here's how it actually plays out. An employee creates a shared folder in their personal OneDrive. They copy-sensitive internal documents into it. They share that folder link with a contractor or a third-party vendor. That link stays active. The contractor's access persists even if the employee leaves the company. There is no central admin panel flagging this behavior unless you've specifically built one. Microsoft doesn't cross-contaminate personal account audit trails with business compliance tools by default.
I ran into this head-on with a mid-size logistics company about three years ago. They were up for SOC 2 certification and the auditor asked for a complete inventory of where customer data lived. The company had rolled out Microsoft 365 two years earlier. Everything looked clean on the enterprise side. Then we discovered that roughly 40 percent of their active project files were sitting in employees' personal OneDrive accounts, shared via anonymous links. The audit trail for those files didn't exist in their admin center at all. We spent about two weeks doing a manual sweep using the SharePoint admin API to pull back every external share across all tenant-owned accounts. It turned into a remediation project that pushed their certification timeline back by six weeks. The workaround we ended up using was a combination of three things. First, we enforced a policy through Intune that blocked sign-in to personal Microsoft accounts on managed devices. Second, we configured the DLP policies to scan not just for keyword matches but for patterns indicating externally shared sensitive data, and set those policies to block at the point of sharing. Third, we ran a PowerShell script against the SharePoint PnP module to enumerate every external share link across the entire tenant, generate a report, and auto-disable any link that had been shared for more than 90 days without re-approval. The script took about 15 minutes to run on a tenant with roughly 600 users. The cleanup took about three days of manual follow-up. There are a few things most people miss when they think about this problem. One is that even enterprise-grade OneDrive for Business doesn't automatically inherit your conditional access policies on shared links. If you set up MFA and device compliance requirements but forget to configure "link type" restrictions in the sharing policy, anyone with the link can open the file from an unmanaged device. The setting lives under the SharePoint Online admin center, not the Microsoft 365 compliance center, which is one of the more frustrating architectural decisions Microsoft has made here.
Another thing nobody warns you about is the version history problem. When you disable sharing or terminate a user account, the previous versions of documents that were shared through those accounts don't automatically get removed from the external user's cached copies. I've seen this repeatedly. Someone shares a final revision of a contract. Two weeks later, they retract the link. But the recipient already has a local copy. Retraction doesn't reach past the link expiration. The only real control here is retention labels that auto-delete files after a set period, and those only work within your own tenant, not on files that have been downloaded or synced to another device. There are tools that help. Microsoft Purview gives you data loss prevention, sensitivity labels, and insider risk management. But Purview doesn't cover personal Microsoft accounts that users sign into on their own time. It also requires the premium tier, which runs around $10 per user per month on top of the base Microsoft 365 license. If you're a small business running Business Standard, you don't get Purview at all. You get the basic DLP policies, which are decent but lack the advanced content scanning and external sharing governance that Purview provides. A few years ago, I worked with a fintech startup that was trying to keep costs down. They stayed on Business Standard and used a combination of third-party tools — Tessian for email security and Cloud Security Posture Management from a vendor called Wiz — to catch some of the gaps. Wiz's cloud detection found exposed storage accounts that Microsoft's own tools had missed, including several S3 buckets that had been created by ex-employees and never decommissioned. That was a separate problem from OneDrive, but it happened in the same environment and it showed me how easy it is to lose visibility across a mixed ecosystem.
Get the Full Details
If you want to actually fix this, start by running the Sharing and Collaboration report from the Microsoft 365 compliance center. It'll show you the top shared files, the number of external shares per user, and the link types in use. Filter for "Anyone" links first — those are the ones that require zero authentication. Next, check your DLP policy status under compliance center to see if you have any policies actively blocking sensitive information. If you don't, create one. Start simple: block any rule that detects credit card numbers, SSNs, or proprietary code being shared externally. You'll get some false positives. You'll need to tune it over the next few weeks. Then go into your sharing settings at the tenant level and restrict what link types are available. The options are Anyone, People in your organization, and People with existing access. Choose "People in your organization" as your default. The "Anyone" option should only be available for content that explicitly requires it and has gone through a review process. I also recommend disabling personal OneDrive accounts on managed devices through Intune. This is straightforward if you're already using Intune. If you aren't, that's a separate project entirely. The configuration profile goes under Device Configuration, under Microsoft 365 Apps, and you set the AllowPersonalSync key to false. It takes effect within an hour of the next policy refresh.
None of this is perfect. The biggest limitation I've run into is that some industries still require ad-hoc external collaboration that falls outside the bounds of what your compliance tools allow. Legal teams sharing documents with outside counsel, for example, often need to use anonymous links because the other side isn't in your tenant. In those cases, the workaround is to set a password on the shared link and expire it after 7 days. It's not ideal, but it gives you an audit trail and limits the window of exposure. The other hard truth is that you can't fully prevent this without restricting what your employees can do, and that creates friction. Some people will find workarounds. They'll upload files to Google Drive, Dropbox, or a personal email. The monitoring question then becomes whether you want to invest in a CASB solution like Netskope or Zscaler, which can detect and block traffic to unauthorized cloud services. That's a significant cost and deployment effort, but it's the only way to get full visibility across all cloud storage platforms, not just Microsoft's. What most businesses should do right now is run that sharing report, disable the "Anyone" link type, configure DLP rules, and disable personal OneDrive sync on managed devices. It will take you about two hours of work and maybe a day or two of user complaints. The payoff is that you'll know, for the first time, exactly where your data is and who can access it. That's not nothing.
