⚙️🪟🧑💼🔓CP - OneDrive - Allow personal OneDrive
The inverse of the block. Not a green light for everyone, a scalpel for the one approved exception, because taking someone out of the block group leaves the tattoo behind.
What this policy is about 🔓
This is the deliberate undo for ⚙️🪟🧑💼CP - OneDrive - Block personal OneDrive, and it exists because of one Intune fact that trips everyone up: exclusion is not the same as reversal.
Say you block personal OneDrive for everyone (good), the CEO wants it anyway (fine), so you take them out of the block group. Still blocked. The setting already tattooed onto their device, and Intune applies the most restrictive value it has ever written. Removing the assignment stops new enforcement; it does not undo the old one. To genuinely re-enable it you have to assign a policy that says the opposite, out loud.
Whenever a tattooing setting has an exception group, it needs a matching policy that resets the value. This is that policy: assign it to the exception group and personal sync is re-enabled cleanly, no reimaging, no registry surgery.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → OneDrive.
| Setting | Value |
|---|---|
| Block syncing of personal OneDrive accounts | Disabled |
| Assignment, include | 🛡️🧑💼👈🔓⚙️Group - Personal OneDrive Allowed users |
| Assignment, exclude | None (only the approved exception group receives this) |
Setting the block to Disabled actively overwrites the previously-tattooed Enabled, which is the only thing that truly lifts it.
Caveats ⚠️
Assign it narrowly or you have unblocked the tenant. This policy only belongs on the approved exception group. Point it any wider and you have quietly undone the whole block, which is the opposite of the intent.
It is only half the pair. This does nothing useful without the block policy in place; the two are designed and reviewed together.
Governance is the actual control here. The technology is trivial; the risk is human. Written customer approval, a documented reason per user, and a periodic review keep this from becoming shadow IT with extra steps.
License and reversibility. Included in Business Premium. Clean-revert: unassigning this returns those users to the block, exactly as intended.
🔗 Related
- ⚙️🪟🧑💼CP - OneDrive - Block personal OneDrive: the default this policy carves an exception out of.
Want control? Start with the block. Want an exception? Use this, narrowly, with the paperwork to back it up. 🔓