Skip to main content

Prevent Automatic Personal OneDrive Account Synchronization

Purpose​

This procedure outlines the steps to prevent Microsoft from automatically syncing detected personal OneDrive accounts on University-managed Windows devices, related to Microsoft 365 Roadmap ID 490064. Implementing these measures mitigates the risk of data exfiltration and ensures that corporate data remains within controlled environments, thereby reducing insider risk.

Scope​

This procedure applies to all University-managed Windows endpoints, including those managed via Active Directory Group Policy (GPO) and Microsoft Intune.

Essential Core Knowledge​

  • Understanding of Active Directory Group Policy Management.
  • Understanding of Microsoft Intune (Endpoint Manager) and Configuration Profiles (Settings Catalog).
  • Familiarity with OneDrive client behavior and tenant settings.
  • Administrative privileges for Group Policy Management and/or Microsoft Intune.
  • Knowledge of how to locate your organization's Microsoft 365 Tenant ID.

🔐 Understanding Key OneDrive Sync Policies​

To effectively manage OneDrive synchronization and mitigate data exfiltration risks on University-managed devices, it's crucial to comprehend the specific functions of the following policies:

  • Purpose: Suppresses prompts that encourage users to sync personal Microsoft accounts detected on the device.
  • Effect: Prevents the OneDrive sync client from displaying notifications suggesting the addition of personal accounts.
  • Limitation: Does not prevent users from manually adding personal accounts to OneDrive.
  • Use Case: Ideal for reducing user prompts without enforcing strict sync restrictions.

2. DisablePersonalSync (Optional)​

  • Purpose: Blocks the synchronization of personal OneDrive accounts on the device.
  • Effect: Prevents users from adding or syncing personal Microsoft accounts with OneDrive.
  • Strength: Provides a robust barrier against unauthorized personal account synchronization.
  • Use Case: Essential for organizations requiring strict separation between personal and corporate data.

3. AllowTenantList (Optional)​

  • Purpose: Restricts OneDrive synchronization to specified Microsoft 365 tenant IDs.
  • Effect: Allows syncing only for accounts associated with listed tenant IDs; blocks all others.
  • Configuration: Requires inputting the organization's tenant ID(s) into the policy settings.
  • Use Case: Useful for environments where multiple tenants exist, and synchronization needs to be limited to specific ones.

Note: The DisablePersonalSync and AllowTenantList policies are optional and can be implemented based on organizational requirements for enhanced security.

🛠️ Procedure Steps​

Part 1: Configuring via Group Policy (GPO) for Domain-Joined Devices​

  1. Obtain/Update OneDrive ADMX/ADML Templates:

    • Ensure you have the latest OneDrive administrative templates. These are typically included with the OneDrive sync client installation.
    • Look in %localappdata%\Microsoft\OneDrive\BuildNumber\adm\ (for per-user sync app) or %ProgramFiles(x86)%\Microsoft OneDrive\BuildNumber\adm\ / %ProgramFiles%\Microsoft OneDrive\BuildNumber\adm\ (for per-machine sync app). Replace BuildNumber with the actual version number folder.
    • Copy OneDrive.admx to your central store (e.g., \\yourdomain.com\SYSVOL\yourdomain.com\Policies\PolicyDefinitions).
    • Copy OneDrive.adml (from the appropriate language subfolder, e.g., en-us) to the corresponding language folder in your central store (e.g., \\yourdomain.com\SYSVOL\yourdomain.com\Policies\PolicyDefinitions\en-us).

  2. Create or Edit a Group Policy Object:

    • Open Group Policy Management (gpmc.msc).
    • Either create a new GPO and link it to the relevant Organizational Units (OUs), or edit an existing GPO.
    • Right-click the GPO and select Edit.

  3. Configure the "Hide the messages to sync Consumer OneDrive files" Policy Setting:

    • Navigate to: Computer Configuration > Policies > Administrative Templates > OneDrive.
    • Locate the setting: "Hide the messages to sync Consumer OneDrive files".
      • The underlying registry key for this is DisableNewAccountDetection.
    • Double-click the setting.
    • Set it to Enabled.
    • Click OK.

  4. (Optional) Configure "Prevent users from syncing personal OneDrive accounts" Policy Setting:

    • Navigate to: User Configuration > Policies > Administrative Templates > OneDrive.
    • Locate the setting: "Prevent users from syncing personal OneDrive accounts".
      • The underlying registry key for this is DisablePersonalSync.
    • Double-click the setting.
    • Set it to Enabled.
    • Click OK.

  5. (Optional) Configure "Allow syncing OneDrive accounts for only specific organizations" Policy Setting:

    • Navigate to: Computer Configuration > Policies > Administrative Templates > OneDrive.
    • Locate the setting: "Allow syncing OneDrive accounts for only specific organizations".
    • Set it to Enabled.
    • In the "Options" pane, click Show... next to "Tenant IDs".
    • Enter your Microsoft 365 Tenant ID(s) that you want to allow. Add one Tenant ID per line.
    • Click OK twice. This ensures only your corporate OneDrive accounts can be synced.
    • Note: This setting takes priority over "Block syncing OneDrive accounts for specific organizations". Do not enable both simultaneously.

  6. Apply and Verify GPO:

    • Allow time for GPO replication or force an update on a test client machine using gpupdate /force.
    • Restart the OneDrive sync client or reboot the machine.
    • Attempt to add a personal OneDrive account. It should be blocked.

Part 2: Configuring via Microsoft Intune​

If you want to hide the prompt to sync personal OneDrive accounts (without disabling seamless Entra sign-in or blocking personal accounts entirely):

  1. Log in to Intune Admin Center: https://intune.microsoft.com
  2. Go to Devices > Windows > Configuration profiles.
  3. Click + Create profile
    • Platform: Windows 10 and later
    • Profile type: Templates > Custom
  4. Name your profile and proceed to Configuration settings.
  5. Click Add and enter:
    • Name: Suppress OneDrive Personal Account Prompt (DisableNewAccountDetection)
    • OMA-URI: ./Device/Vendor/MSFT/Policy/Config/OneDrive~Policy~OneDriveNGSC/DisableNewAccountDetection
    • Data type: Integer
    • Value: 1
    • (Optional) Description: Prevents OneDrive from prompting to sync personal accounts, but does not block adding them manually.
  6. Assign the profile to your Windows device groups, then Create.

Result:

Users will no longer see the prompt to add personal OneDrive accounts, but can still add one manually. This preserves seamless organizational sign-in and keeps the user experience smooth.

B. Optional: Stricter Intune Policies via Settings Catalog​

If you need to strictly prevent personal sync or enforce tenant restrictions, you can use the Settings Catalog in Intune:

  1. Create a Settings Catalog Policy:
    • Go to Devices > Windows > Configuration profiles.
    • Click + Create profile
      • Platform: Windows 10 and later
      • Profile type: Settings catalog
  2. Add these settings as needed:
    • Prevent users from syncing personal OneDrive accounts
      • Settings catalog path: Administrative Templates > OneDrive
      • Setting: "Prevent users from syncing personal OneDrive accounts (User)"
      • Effect: Blocks all personal OneDrive accounts from being added or synced on the device.
    • Allow syncing OneDrive accounts for only specific organizations
      • Settings catalog path: Administrative Templates > OneDrive
      • Setting: "Allow syncing OneDrive accounts for only specific organizations (Device)"
      • Effect: Only allows accounts from specified Microsoft 365 Tenant ID(s). All other accounts (including personal) will be blocked.
  3. Configure the policy as needed and assign to device groups.

Result:

These settings fully block personal account sync (and can enforce tenant allow-listing), but may impact user workflows more than just suppressing the prompt.

📝 Summary Table​

MethodPolicy/SettingBlocks Personal Accounts?Suppresses Prompt?Preserves Entra ID Sign-in?Notes
OMA-URIDisableNewAccountDetection❌✅✅Hides the prompt, but does NOT block
Settings CatalogPrevent users from syncing personal OneDrive accounts✅✅✅Fully blocks personal account sync
Settings CatalogAllow syncing OneDrive accounts for only specific organizations✅✅✅Restricts sync to specific tenant(s)

✅ Expected Outcomes or Results​

  • The primary effect of the recommended configuration (e.g., using DisableNewAccountDetection OMA-URI) is to suppress the OneDrive client from automatically prompting users to sign in with or add known personal accounts on University-managed devices.
  • This addresses the behavior related to Roadmap ID 490064, preventing unsolicited prompts for personal account synchronization.
  • Users will still be able to manually attempt to add a personal OneDrive account unless more restrictive policies are also implemented.
  • If stricter policies are explicitly configured, such as:
    • "Prevent users from syncing personal OneDrive accounts": Attempts to add or subsequently sync any personal OneDrive account will be blocked, often resulting in an error or the option being unavailable.
    • "Allow syncing OneDrive accounts for only specific organizations": Only corporate OneDrive accounts belonging to the specified Tenant ID(s) can be added or synced. All other accounts, including all personal accounts and corporate accounts from other tenants, will be blocked.

🧰 Troubleshooting & Common Issues​

  • GPO Not Applying:

    • Use gpresult /r or gpresult /r /SCOPE COMPUTER to check if the policy is being applied.
    • Verify ADMX/ADML files are correct and present in the Central Store.
    • Ensure the GPO is linked to the correct OU and security filtering is accurate.
    • Check for policy conflicts or inheritance issues.
    • Reboot the computer or restart the OneDrive client after policy application.

  • Intune Policy Not Applying:

    • Confirm the device is assigned to the policy (check assignment in Intune).
    • Sync the device manually:
      • Settings > Accounts > Access work or school > [Org Account] > Info > Sync
    • Verify policy deployment status under Devices > [Device] > Device configuration in Intune.
    • Check for pending Windows updates that may impact MDM or OneDrive behavior.
    • Review device logs:
      • Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin
    • Reboot the device or restart OneDrive after policy assignment.

  • Settings Not Taking Effect:

    • Restart the OneDrive application and/or reboot the device to ensure settings take effect.
    • Double-check for typographical errors or incorrect values in the policy settings.
    • Ensure the correct tenant ID(s) are specified and formatted properly.
    • Confirm there are no conflicting GPO or Intune settings from other policies.

  • Existing Personal Accounts Not Signed Out:

    • These policies primarily block adding new personal accounts.
    • If personal accounts were configured before the policy, manual sign-out by the user may be required.
    • Removing and reinstalling the OneDrive client can help enforce new settings if issues persist.