Found out a sysadmin as made himself proprietary of all my work onedrive

Posted by FluidBreath4819@reddit | sysadmin | View on Reddit | 29 comments

Hi, I just found out that all my onedrive, any files or directory, new or old, he's also proprietary of it. Found it because I was trying to share a folder and noticed that there's already two people having access to the folder : when clicking on the two circles, it said that him and I were proprietary. Checked with my peers and none of them have the same issue as me. I am the only one. Plus this guy bragged last time that he was able to track anyone in the company on a map : he's like fond of those tracking tools. Is it ok what he's doing ? I mean, if I am not the only or he's not the only one, I am fine with it. But it's like is abusing is admin rights. Can he get fired for that ?

Reply to Post

29 Comments

[-]

Prophage7@reddit

Have you ever asked IT to look at anything OneDrive for you? Have they ever dropped a file or folder into your OneDrive? Have you ever left the company and returned later? Has there been any OneDrive migration projects? Basically when an admin accesses a users OneDrive, it's one button that says "create link to user's OneDrive", and that's it, there's no picking individual files or folders just "give admin access to user OneDrive". So if any work ever needed to be done in your OneDrive then there's your answer.

[-]

FluidBreath4819@reddit (OP)

I don't remember asking them to look at my OneDrive the ways you're describing. This guy doesn't keep track of ssl expired certificates... I am no sysadmin, but I believe azure has tools to send reminder way before it breaks production servers. At least, a spreadsheet or an event on a calendar can do the trick. So I won't be surprise that he does not have your level of expertise and know the discreet ways you know.

[-]

Quantity_Vast@reddit

So an admin can request access to your OneDrive and it creates a link for the admin to get into your files. This is typically used for troubleshooting issues with OneDrive etc. After an admin has completed its troubleshooting task, they should be removing themselves from your accounts. If no request was made on your side and the admin doing this has no reason to answer why they accessed these files, they could get in big trouble for that.

[-]

FluidBreath4819@reddit (OP)

can you explain what kind of typical issues ?

[-]

HankMardukasNY@reddit

You reporting a file is missing or can’t find. You needing files from another employee who left. Those two are the only reasons I’ve done it

[-]

FluidBreath4819@reddit (OP)

what about sync issue or auth / login issue ?

[-]

HankMardukasNY@reddit

I would view heath reports for onedrive, view sign in logs in azure, or remote into your computer. Wouldn’t need access for that

[-]

aringa@reddit

I think you should start filling your account with pictures and videos of goats and see if he says anything.

[-]

anxiousinfotech@reddit

My privileged account technically has access to a bunch of the OneDrive accounts on our tenant. We were doing a migration a few years ago, company had $0 (mid-Covid) so no migration tools. Some of the users couldn't handle moving their own stuff, either technically, or due to crap internet, so I did it for them. It's been on my list for about 3 years now to clean that up, but I've never gotten to priorities that low. Once an admin gains access through the admin portal, for whatever reason, it is not automatically revoked afterward. They remain a site collection owner unless removed afterward. That said, if this person brags about abusing their permissions, I would assume they did this nefariously and forgot to clean up after themselves (or are dumb enough to not know you'll see it when sharing...or that there are audit logs). I'd absolutely run this up the flagpole and see what happens to him.

[-]

lostscause@reddit

Has your account been compromised in the past ? I had to do the same thing your describing to review the files to see if any PII data or company data that needed reporting on. Kinda sloppy not to remove after done.

[-]

FluidBreath4819@reddit (OP)

Never compromised. Why ? Funny thing : his account was compromised once (my manager told me). You need to the same to report if some data in a onedrive was compromised ?

[-]

lostscause@reddit

Depends , I work for a SOX compliant company. Everything gets reported and audited

[-]

craZboy87@reddit

I have one employee (also IT but more of a PM, structurally separate) who has the same thing show up for me. All I can think of is that I used admin access to drop a file in his OneDrive directly at one point and somehow it added me as owner on his OneNote notebook. It's strange and he says it won't let him remove me. But I literally do not care about his files and wouldn't spend my time on it even if I had time to spend. Sounds like the guy in your case is an ass, but the sign you are seeing isn't necessary malicious or even intentional. Either way, that's for your own company, not really for blasting on Reddit.

[-]

HankMardukasNY@reddit

Yes once you click on the access onedrive link in admin portal, it adds you as a site collection admin to the user’s OneDrive. Most people forgot to remove themselves afterwards. To do this you have to go to SharePoint admin portal - more features - user profiles - search for user - click the arrow and select site collection administrators - remove your admin account. It’s such a convoluted process lol

[-]

craZboy87@reddit

That is very good to know. Most of my use of that feature is for archiving data during offboarding, so it doesn't matter in those cases, but that should at least help for that one user who actually seems to care. Thanks.

[-]

xenontechs@reddit

if an admin uses the admin center to get access to any of the files, it will generate a sharing link specifically for that admin and add them to the files. so if there was ever any reason to do that, you get the result you see. I blame microsoft for doing it this way without any easy way to undo it (because it sure looks sketchy), but check your own policies and communicate your concerns upwards

[-]

FluidBreath4819@reddit (OP)

I get the result on any files ! It's like he's proprietary of all the onedrive

[-]

sitesurfer253@reddit

Yes, you set yourself as a delegate and you have a cess to the whole OneDrive. You don't get a list of the folders you'd like to be a delegate on, you get all of nothing.

[-]

xenontechs@reddit

yes that is by design and exactly how it works. one click to check one thing, that person is set as owner everywhere been there, done that

[-]

Ashamed_Chemical5347@reddit

People forget what admins are capable of

[-]

FluidBreath4819@reddit (OP)

that's my point, he can do the same for 1 hour on the onedrive of the CEO just to have a peek

[-]

pinalbakulagr1@reddit

What to do: Document Everything: Take screenshots and document everything you've noticed. Speak with your manager: Share your concerns. This isn't just about your personal files; it's about the potential misuse of access rights. Involve HR or Legal: Depending on the gravity, HR or legal might need to be involved, especially if company policies were violated.

[-]

anonymousITCoward@reddit

Order is very important... report up, before getting HR or legal involved... this is not an egregious misuse of access rights (yet).

[-]

YellowOnline@reddit

He might have a valid reason. I routinely take ownership of user files for a variety of legitimate reasons

[-]

FluidBreath4819@reddit (OP)

All onedrive ? And only for one not others ? I mean if he does that for everyone, I am ok.

[-]

Flatline1775@reddit

Literally just discovered this in our environment last week. It's because we used a tool called ShareGate to migrate user folders to OneDrive. The sysadmin that used their account to authenticate was added as owner to everything. It wasn't malicious or anything, but it did make me scratch my head a second when I saw it. I had him go through and strip the permissions before I got fun questions from people higher up than me.

[-]

FluidBreath4819@reddit (OP)

Thing is, I am the only one that he owns all file too. I've checked with others.

[-]

thortgot@reddit

This largely depends on what the policy of the company is and what country you are in (laws are very different on this around the world). Why not have a conversation about it?

[-]

BachRodham@reddit

Why don't you ask *your* manager who knows your company's policies and practices?