⚙️🪟🧑💼🔓CP - OneDrive - Allow other tenant signin
The counter-policy to the tenant restriction. It reopens cross-tenant sync for a select few who can explain why, and nobody else.
What this policy is about 🪄
This is the deliberate exception to ⚙️🪟🧑💼CP - OneDrive - Block other tenant signin. Where that one pins the sync client to a single tenant, this one says: "fine, but only for these people, and only because we can explain it."
The real world is not always one tenant. Companies merge, workloads get shared, a user is genuinely active in two organizations at once. For those cases you assign this policy to the 🛡️🧑💼👈🔓Group - Multi tenant OneDrive Allowed users group, and the tenant restriction lifts for them alone.
This does not relax the restriction for the tenant. It removes it for a named, approved list of users. Everyone else stays pinned by the block. Aimed correctly, it is precise; aimed broadly, it is just an open door.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → OneDrive.
| Setting | Value |
|---|---|
| Allow syncing OneDrive accounts for only specific organizations | Disabled |
| Assignment, include | 🛡️🧑💼👈🔓Group - Multi tenant OneDrive Allowed users |
| Assignment, exclude | None (only the approved exception group receives this) |
Disabling the restriction is what actually reopens cross-tenant sign-in for the assigned users.
Caveats ⚠️
Assign it to the exception group only. Point this any wider and you have removed the tenant restriction for everyone, undoing the block entirely. Narrow assignment is the whole safety mechanism.
It is one half of a pair. It has no purpose without the block policy, and the two are designed and reviewed as a set.
Enable it without a reason and you are building shadow IT with extra steps. Every member of the group needs a written customer approval, a documented purpose, and a place in a regular review. Just because you can allow cross-tenant syncing does not mean you should.
License and reversibility. Included in Business Premium. Clean-revert: unassign and those users fall back under the tenant restriction.
🔗 Related
- ⚙️🪟🧑💼CP - OneDrive - Block other tenant signin: the default restriction this policy makes room in.
Use it with care. It is a scalpel, not a sledgehammer, and the paperwork is what keeps it that way. 🪄