⚙️🪟🧑💼CP - OneDrive - Block other tenant signin
What this policy is about 🛑
You know the drill by now. We don’t like chaos.
We don’t like data all over the place.
And we really don’t like users signing into OneDrive with accounts from some other tenant they found behind the couch.
This policy says:
“You're either with us, or you're not syncing anything.”
No more mystery accounts. No more “I just needed to grab something real quick.”
Only sign in with your organization's account. Period.
Why? 🤨
Because you don’t know:
- Where that other tenant is managed
- If it even is managed
- Or if Bob from Accounting is syncing your quarterly reports to his old startup's OneDrive
Add a few mergers and acquisitions into the mix — and suddenly you've got data going in ten directions with zero accountability.
Let’s not.
🛠️ Configuration
| Setting | Value |
|---|---|
| Allow syncing OneDrive accounts for only specific organizations | Enabled |
| Tenant ID | ${SUPERVISION_TENANTID} |
💡 SuperVision Tip
This policy requires a Tenant ID to work.
And while you're technically allowed to paste in your own... don't.
Instead, use the dynamic tag ${SUPERVISION_TENANTID} — SuperVision will automatically inject the correct value per environment.
Why this matters:
- Prevents config mistakes during rollout
- Avoids syncing devices to the wrong tenant (been there 😅)
- Makes your blueprint multi-tenant ready out of the box
👥 Group Assignments
✅ Included:
All Users
❌ Excluded:
This group is reserved for users who are explicitly allowed to sync to another tenant — see Allow Policy
🔗 Related
If someone really needs to sign into another tenant:
Send them to the ⚙️🪟🧑💼🔓CP - OneDrive - Allow other tenant signin
.
With written approval. And a raised eyebrow.