⚙️🪟🧑💼🔓CP - OneDrive - Allow other tenant signin
What this policy is for 🪄
This is the counter-policy to ⚙️🪟🧑💼CP - OneDrive - Block other tenant signin.
While that one slams the door shut on signing into OneDrive with external tenant accounts, this one says:
“Okay, but only for a select few — and only if we can explain it.”
Why? Because in real-world scenarios, not everything is black and white:
- You might be merging companies
- You might be sharing workloads between tenants
- Or a user just happens to still be active across both environments
This policy re-enables that specific functionality — but only for those assigned to the
🛡️🧑💼👈🔓Group - Multi tenant OneDrive Allowed users
🛠️ Configuration
| Setting | Value |
|---|---|
| Allow syncing OneDrive accounts for only specific organizations | Disabled |
This effectively unlocks the ability to sign into any tenant from the OneDrive client — for users that receive this policy.
💡 SuperVision Tip
This policy depends entirely on the correct group assignment.
With SuperVision, you can:
- Assign cross-tenant user access cleanly
- Centrally manage memberships
- Use one group name across all environments
(in this case: 🛡️🧑💼👈🔓Group - Multi tenant OneDrive Allowed users)
No device tags or tenant ID logic needed — just IAM done right.
👥 Group Assignments
✅ Included:
❌ Excluded:
- None explicitly.
Everyone else simply doesn't receive this policy — and remains restricted by ⚙️🪟🧑💼CP - OneDrive - Block other tenant signin
📝 Governance Check
If you enable this policy without understanding why a user needs it, you're just creating shadow IT with extra steps.
Always combine this with:
- A written approval from the customer
- Internal documentation of purpose
- Regular review of who's in the group
🧞♂️ Just because you can allow cross-tenant syncing, doesn’t mean you should.
Use this policy with care. It's a scalpel — not a sledgehammer.