Microsoft OneDrive STIG Version Comparison
Microsoft OneDrive Security Technical Implementation Guide
There are 5 differences between versions v1 r3 (April 24, 2020) (the "left" version) and v2 r2 (Nov. 1, 2021) (the "right" version).
Check DTOO605 was added to the benchmark in the "right" version.
This check's original form is available here.
OneDrive must only allow synchronizing of accounts for DoD organization instances.
If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance. If the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances. If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\OneDrive\AllowTenantList\ Value Name: Organization's Tenant GUID Value Type: REG_SZ Value: Organization's Tenant GUID If the organization does not have an instance of OneDrive, the Value Name and Value must be 1111-2222-3333-4444. If it is not, this is a finding.
OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.
Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> "Allow syncing OneDrive accounts for only specific organizations", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444. If the organization does not have an instance of OneDrive, configure the Tenant GUID with "1111-2222-3333-4444". Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\". Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.