Microsoft calls OneDrive username probing low risk

Microsoft says organizations should treat attackers probing OneDrive URLs for usernames as a low-risk threat, not a sign that accounts have been breached. The probes can reveal user principal names (UPNs), which attackers might later use for phishing, credential stuffing, or social engineering. Microsoft recommends strong identity protections to limit that downstream risk. Source

Read the full article at the source.