OneDrive
Enterprise
ESM Security Setting - OneDrive Silently Moving Folders Policy
Description: This setting lets you redirect known folders to OneDrive without any user interaction. In sync app builds below 18.171.0823.0001, this setting only redirects empty known folders to OneDrive (or known folders already redirected to a different OneDrive account). In later builds, it redirects known folders that contain content and moves the content to OneDrive. We recommend using this setting together with "Prompt users to move Windows known folders to OneDrive." If moving the known folders silently does not succeed, users will be prompted to correct the error and continue. If you enable this setting and provide your tenant ID, you can choose whether to display a notification to users after their folders have been redirected. You can move all folders at once or select the folders you want to move. After a folder is moved, this policy will not affect that folder again, even if you clear the check box for the folder. If you disable or do not configure this setting, your users' known folders will not be silently redirected and/or moved to OneDrive.
Why It's Important: This setting ensures that important user files are backed up to OneDrive without users needing to do anything. It helps protect data from loss due to hardware failure, theft, or accidental deletion by keeping files in the cloud. Since it works silently, users won’t be interrupted or confused by prompts—it just happens in the background. It’s like automatically moving important papers from a desk drawer to a secure digital filing cabinet.
Learn More
ESM Security Setting - OneDrive Silent Sign In Policy
Description: This setting lets you silently sign in users to the OneDrive sync app (OneDrive.exe) with their Windows credentials. If you enable this setting, users who are signed in on the PC with the primary Windows account (the account used to join the PC to the domain) can set up the sync app without entering the credentials for the account. Users will still be shown OneDrive Setup so they can select folders to sync and change the location of their OneDrive folder. If a user is using the previous OneDrive for Business sync app (Groove.exe), the new sync app will attempt to take over syncing the user's OneDrive from the previous app and preserve the user's sync settings. This setting is frequently used together with "Set the maximum size of a user's OneDrive that can download automatically" on PCs that don't have Files On-Demand, and "Set the default location for the OneDrive folder." If you disable or do not configure this setting, users will need to sign in with their work or school account to set up sync.
Why It's Important: This setting makes it easier for users to start syncing their files with OneDrive by skipping the manual sign-in step. As long as they’re logged into Windows with their work or school account, OneDrive will sign them in automatically. It’s like unlocking your office door with your badge and having your computer automatically open your cloud storage too—saving time and reducing setup issues. This also helps IT ensure users are connected to OneDrive for backup and file access without needing extra support.
Learn More
ESM Security Setting - OneDrive Redirect Policy
Description: This setting forces users to keep their Documents, Pictures, and Desktop folders directed to OneDrive. If you enable this setting, the "Stop protecting" button in the "Your IT department wants you to protect your important folders" window will be disabled and users will receive an error if they try to stop syncing a known folder. If you disable or do not configure this setting, users can choose to redirect their known folders back to their PC.
Why It's Important: This setting ensures that important folders stay backed up to OneDrive, where they’re protected and accessible from any device. It prevents users from undoing the redirection, which could lead to data being stored only on the local machine—making it harder to recover if the device is lost or damaged. It’s like saying, “Keep your files in the cloud locker, not just in your desk drawer,” so IT can manage and protect them properly.
Learn More
ESM Security Setting - OneDrive Files On-Demand Policy
Description: This setting lets you control whether OneDrive Files On-Demand is enabled for your organization. If you enable this setting, OneDrive Files On-Demand will be turned on by default. If you disable this setting, OneDrive Files On-Demand will be explicitly disabled and users can't turn it on. If you do not configure this setting, users can turn OneDrive Files On-Demand on or off.
Why It's Important: This setting helps save disk space and reduce network usage by keeping files in the cloud until the user opens them. Users can still see all their files and choose which ones to keep offline. It’s like having a bookshelf where you can see every book, but only pull one down when you want to read it—saving space while keeping everything accessible. This is especially useful on devices with limited storage or in environments with many synced files.
Learn More
Privileged
PSM OneDrive Settings - Silently sign in users to the OneDrive sync app with their Windows credentials
Description: This setting lets you silently sign in users to the OneDrive sync app (OneDrive.exe) with their Windows credentials. If you enable this setting, users who are signed in on the PC with the primary Windows account (the account used to join the PC to the domain) can set up the sync app without entering the credentials for the account. Users will still be shown OneDrive Setup so they can select folders to sync and change the location of their OneDrive folder. If a user is using the previous OneDrive for Business sync app (Groove.exe), the new sync app will attempt to take over syncing the user's OneDrive from the previous app and preserve the user's sync settings. This setting is frequently used together with "Set the maximum size of a user's OneDrive that can download automatically" on PCs that don't have Files On-Demand, and "Set the default location for the OneDrive folder." If you disable or do not configure this setting, users will need to sign in with their work or school account to set up sync.
Why It's Important: Manual sign-in steps can delay onboarding and introduce user errors. SHIELD enables silent sign-in to streamline the setup process, reduce support requests, and ensure that OneDrive sync is activated consistently across all managed devices—like automatically unlocking a secure locker with a badge swipe instead of requiring a password every time. This policy improves user experience, accelerates deployment, and ensures that data protection via OneDrive starts immediately.
Learn More
PSM OneDrive Settings - Allow users to contact Microsoft for feedback and support
Description: This setting specifies whether users in your organization can communicate directly with Microsoft through user experiences in the sync app. Letting users share their thoughts helps us improve OneDrive. If you enable or do not configure this setting, users can use the experiences in the OneDrive sync app to contact Microsoft directly for feedback and support. If you disable this setting, users will be unable to contact Microsoft for support, feedback, or suggestions within the sync app. Users will still have access to help content and self-help tools.
Why It's Important: [coming soon]
Learn More
- [coming soon]
PSM OneDrive Settings - Prevent users from redirecting their Windows known folders to their PC
Description: This setting forces users to keep their Documents, Pictures, and Desktop folders directed to OneDrive. If you enable this setting, the "Stop protecting" button in the "Your IT department wants you to protect your important folders" window will be disabled and users will receive an error if they try to stop syncing a known folder. If you disable or do not configure this setting, users can choose to redirect their known folders back to their PC.
Why It's Important: Redirecting known folders to OneDrive ensures that critical user data is backed up to the cloud and accessible across devices. Allowing users to opt out of this protection risks data loss, fragmentation, and non-compliance with organizational backup policies. SHIELD enforces this policy to maintain centralized control over data storage—like requiring employees to store important documents in a secure vault rather than personal drawers. This policy helps protect against accidental data loss, supports remote access, and ensures consistent backup practices across the organization.
Learn More
PSM OneDrive Settings - Prevent users from syncing libraries and folders shared from other organizations
Description: This setting controls whether users in your organization are allowed to sync OneDrive for Business or SharePoint content that has been shared by users in a different organization. This is a collaboration feature called B2B Sync. If you enable this setting, users will not be able to start syncing a OneDrive for Business or SharePoint library or folder that was shared from an external organization. Any shared libraries or folders already being synced will stop syncing. If you disable or do not configure this setting, users will be able to sync OneDrive for Business and SharePoint libraries and folders that have been shared from external organizations.
Why It's Important: Cross-organization syncing introduces risks of data leakage, compliance violations, and loss of control over sensitive information. SHIELD enforces this policy to ensure that all synced content originates from within the organization’s trusted environment—like restricting file transfers to internal couriers only. This helps maintain data sovereignty, prevent unauthorized sharing, and ensure that collaboration remains secure and auditable.
Learn More
PSM OneDrive Settings - Prevent users from syncing personal OneDrive accounts (User)
Description: This setting lets you block users from signing in with a Microsoft account to sync their personal OneDrive files. If you enable this setting, users will be prevented from setting up a sync relationship for their personal OneDrive account. Users who are already syncing their personal OneDrive when you enable this setting won't be able to continue syncing (and will be shown a message that syncing has stopped), but any files synced to the computer will remain on the computer. If you disable or do not configure this setting, users can sync their personal OneDrive accounts.
Why It's Important: Allowing personal OneDrive sync on enterprise devices can lead to data leakage, non-compliance with data governance policies, and loss of visibility into where sensitive files are stored. SHIELD enforces this policy to ensure that all file synchronization is done through corporate-managed accounts—like restricting company documents to secure filing cabinets instead of personal backpacks. This helps protect intellectual property, maintain audit trails, and prevent unauthorized data sharing.
Learn More
PSM OneDrive Settings - Silently move Windows known folders to OneDrive
Description: This setting lets you redirect known folders to OneDrive without any user interaction. In sync client builds below 18.171.0823.0001, this setting only redirects empty known folders to OneDrive (or known folders already redirected to a different OneDrive account). In later builds, it redirects known folders that contain content and moves the content to OneDrive. We recommend using this setting together with "Prompt users to move Windows known folders to OneDrive." If moving the known folders silently does not succeed, users will be prompted to correct the error and continue. If you enable this setting and provide your tenant ID, you can choose whether to display a notification to users after their folders have been redirected. If you disable or do not configure this setting, your users' known folders will not be silently redirected and/or moved to OneDrive.
Why It's Important: Automatically redirecting known folders to OneDrive ensures that important user data is backed up to the cloud and accessible across devices. SHIELD enforces this policy to eliminate reliance on local storage, reduce data loss risk, and streamline backup and recovery processes—like automatically storing critical files in a secure vault instead of leaving them scattered across desks. This policy supports business continuity, simplifies device transitions, and enhances data protection without disrupting user workflows.
Learn More
PSM Security Setting - OneDrive Files On-Demand Policy
Description: This setting lets you control whether OneDrive Files On-Demand is enabled for your organization. If you enable this setting, OneDrive Files On-Demand will be turned on by default. If you disable this setting, OneDrive Files On-Demand will be explicitly disabled and users can't turn it on. If you do not configure this setting, users can turn OneDrive Files On-Demand on or off.
Why It's Important: Files On-Demand helps optimize device storage while maintaining seamless access to cloud files. SHIELD enables this policy to ensure users can work efficiently without consuming unnecessary disk space—like keeping a digital archive accessible without storing every document locally. It also supports faster device provisioning, reduces sync overhead, and enhances user experience by balancing performance and accessibility.
Learn More
- [coming soon]