OneDrive Username Enumeration: What Security Teams Should Know

From time to time, we receive questions about a reconnaissance technique that enumerates usernames, or user principal names (UPNs), by probing OneDrive and SharePoint URLs. The technique can reveal account names that attackers may use in targeted phishing, credential-stuffing, or brute-force attempts. These URL probes do not appear in Microsoft Entra sign-in logs or Microsoft Purview, which limits direct visibility into the reconnaissance activity.

 Key risks

• Attacker reconnaissance: UPNs discovered → targeted phishing, credential stuffing, social engineering.


• No direct alerting is currently available to notify organizations when users are identified through this reconnaissance technique.

OneDrive enumeration is a reconnaissance technique that can support targeted phishing and credential attacks. It is currently classified as low risk because it is passive and does not bypass authentication. Organizations can reduce the risk of downstream attacks by using identity protections such as multifactor authentication and Conditional Access policies. Microsoft may also throttle clients that make excessive requests to OneDrive site collections that do not exist:

“When a client makes excessive attempts to access many OneDrive site collections that do not exist, we may throttle requests from that client’s IP address. The client will receive an HTTP 429 response when accessing any OneDrive site collection during the throttling period.”  – Throttled or blocked in SharePoint Online

From a threat-model perspective, OneDrive enumeration is reconnaissance vector worth monitoring and implementing defenses. Please see the table below that provides the techniques and the associated defense that can be used:

The key takeaway: OneDrive username enumeration is a low-risk reconnaissance technique, but the account names it reveals can support higher-impact attacks. Organizations should reduce that downstream risk through strong identity controls, phishing protection, and user awareness.