⚙️🪟💻CP - OneDrive - Configuration
Back up the user's files whether they remember to or not. Silent sign-in, Known Folder Move and Files On-Demand, set at the device so it applies to whoever is at the keyboard.
What this policy is about 📦
This is the OneDrive baseline: sign the user in silently with their Windows account, move Desktop, Documents and Pictures into OneDrive automatically (Known Folder Move), turn on Files On-Demand, and put a few guardrails around the edges. It is set at the device level on purpose, so it protects everyone who logs on, not just the first tidy user before someone hands the laptop to a colleague.
The goal is simple: the user should not have to think about backup, and you should not have to clean up after them when they don't.
Get Desktop, Documents and Pictures redirected into OneDrive and the "my only copy was on the laptop that died" conversation disappears. The rest of this profile is polish; KFM is the reason the profile exists.
Why this matters ☁️
Files that live only on a local disk are one spilled coffee, one theft, or one ransomware run away from gone. Known Folder Move quietly fixes that for the folders people actually use, without a training session or a nagging email. And when the CFO deletes their Desktop folder "to clean up", you restore it from OneDrive in a click instead of explaining what a backup rotation is.
Doing it at the device level also removes the ambiguity about who owns what. Nobody is manually pointing folders at personal storage, nobody's cat-tax photo collection is competing for corporate quota, and the sync behaviour is the same on every managed machine.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → OneDrive.
| Setting | State | Value |
|---|---|---|
| Silently sign in users to the OneDrive sync app with their Windows credentials | Enabled | |
| Silently move Windows known folders to OneDrive | Enabled | Desktop / Documents / Pictures = True; notification = No; Tenant ID = per-environment variable |
| Prompt users to move Windows known folders to OneDrive | Enabled | Tenant ID = per-environment variable |
| Prevent users from redirecting their Windows known folders to their PC | Enabled | |
| Use OneDrive Files On-Demand | Enabled | |
| Set the sync app update ring | Enabled | Production |
| Exclude specific kinds of files from being uploaded | Enabled | Microsoft Teams.lnk |
| Allow OneDrive to disable Windows permission inheritance in folders synced read-only | Enabled | |
| Always use the user's Windows display language when provisioning known folders | Enabled | |
| Warn users who are low on disk space | Enabled | 1024 MB |
| Hide the "Deleted files are removed everywhere" reminder | Enabled | |
| Assignment, include | All devices | |
| Assignment, exclude | 🛡️🪟💻⛓️Group - Autopilot Devices - IoT 🛡️🪟💻⛓️Group - Autopilot Devices - Kiosk 🛡️🪟💻⛓️Group - Autopilot Devices - W365 Boot |
Kiosks, signage and W365 boot devices are excluded because a screen looping a slide deck all day has no business syncing anyone's Documents folder.
Caveats ⚠️
Never hardcode a Tenant ID. The known-folder settings take a tenant ID, and pasting your own into a blueprint that ships to every customer connects all of them to the wrong cloud. Use a per-environment variable (this baseline injects one automatically), so each tenant gets its own value.
Known Folder Move is a migration, not a toggle. The first move copies real data up to OneDrive, so on rollout expect an initial sync spike and make sure users have connectivity and quota. It is smooth once seeded, but seeding is a real event, not instant.
Files On-Demand assumes a network. It keeps files as online-only placeholders until opened, which is brilliant on a laptop and briefly annoying on a boat. Users who work offline should pin what they need first.
License and reversibility. OneDrive and Intune configuration are included in Business Premium, no add-on. Clean-revert: unassign and the settings stop applying, though already-moved known folders stay in OneDrive, which is the point, not a problem.
🔗 Related
- ⚙️🪟🧑💼CP - OneDrive - Block personal OneDrive: keeps corporate data off consumer accounts while this profile manages the corporate one.
- ⚙️🪟🧑💼CP - OneDrive - Block other tenant signin: pins the sync client to the customer's own tenant.
Back up the folders people actually use, do it without asking, and never trust a folder called Temp. 📦