Maximise your OneDrive: Recommended Profile Settings via Intune

Hello again, today’s topic is a practical one: how to deploy OneDrive profile settings using Microsoft Intune. This blog post aims to guide you through the process of setting up OneDrive on Windows devices in a way that’s both secure and user-friendly, complete with visual aids whenever possible. With Intune, you’ll be able to configure OneDrive’s Known Folder Move silently, ensuring a seamless user experience.

We’ll also discuss useful tips to maximise performance, like preventing OneDrive downloads when disk space is below 1500 MiB and avoiding the syncing of duplicate desktop shortcuts—especially helpful for those who transition between multiple devices. While this guide serves as a starting point, feel free to tailor the OneDrive settings via Intune to meet your specific needs.

Just give me the JSON file

Okay, okay, here’s the JSON file containing all of the settings listed in this blog post, remember to update it to match your tenant ID, you can use this script to upload the settings catalog profile into your tenant or import it via new settings catalogue option.

Prerequisites

You need a tiny bit of information before you proceed, gather your tenant ID and ensure that your tenant association key for the OneDrive sync reports is present.

Tenant ID

To gather this, go to your Entra admin console, on the overview page, your tenant ID will be listed, save this for later.

Tenant association key

Browse to the following location, ensure that a tenant association key is present, you do not need the key, just make sure it’s generated.

Verify the settings

I assume at this point you have managed to import the settings catalog policy, I personally name the profile PROD – Win11 – Catalog – Device – OneDrive, you should have the following:

Note: Remember to update your tenant ID and tenant association key!

Breaking down the deployed settings

Let’s get into some of the detail and why I tend to use the settings listed above.

Setting	Value	Description
Allow syncing OneDrive accounts for only specific organizations	Enabled – Enter in your tenant ID(s).	Obviously, a good idea, for security purposes we do not want to sync unauthorised organisations OneDrive accounts.
Block file downloads when users are low on disk space	Enabled – Minimum available disk space – 2000 MiB	Let’s not kill an overloaded drive! 🙂
Convert synced team site files to online-only files	Enabled	To save disk space, some libraries can be huge!
Disable the tutorial that appears at the end of OneDrive Setup (User)	Enabled	No need, we have a notification for when known folder move occurs.
Enable sync health reporting for OneDrive	Enabled	To view health status of the OneDrive sync client and gather data insights.
Exclude specific kinds of files from being uploaded	Enabled – keywords: *.lnk *.pst *.url *.exe *.msi *.appx	Three things here, .PST’s aren’t supported. Do we really need installation files from syncing using up disk space? Prevent shortcuts from syncing, this stops multiple shortcuts from appearing on the desktop (remember the Teams \ Edge issue?)
Hide the “Deleted files are removed everywhere” reminder	Enabled	A little intrusive I find.
Prevent users from redirecting their Windows known folders to their PC	Enabled	Lets keep things sync’d via OneDrive and not undo our configurations.
Prevent users from syncing libraries and folders shared from other organizations	Enabled	For security purposes, data leakage.
Prevent users from syncing personal OneDrive accounts (User)	Enabled	For security purposes, data leakage.
Prompt users when they delete multiple OneDrive files on their local computer	Enabled – Number of files = 50	Prefer this notification over the files are deleted everywhere reminder are each individual file deletion, less intrusive.
Require users to confirm large delete operations	Enabled	As above.
Set the sync app update ring	Enabled – Production	Good middle ground for broad use, obviously can create other profiles for Insider and Deferred rings, if needed.
Silently move Windows known folders to OneDrive	Enabled – Desktop, Documents, Pictures = True Show notification to users after folders have been redirected: (Device) = Yes Tenant ID.	This is setting that enables KFM, use this over the legacy setting of the same name, it will not have options for desktop, documents and pictures. Produce a prompt to inform users that this change has occured.
Silently sign in users to the OneDrive sync app with their Windows credentials	Enabled	Essentially, SSO into OneDrive. (Be vary of MFA requirements if not using Windows Hello).
Use OneDrive Files On-Demand	Enabled	Reduce disk space on devices. Download when needed (Tip, use Storage Spaces to convert back to online mode after period of time).
Warn users who are low on disk space	Enabled – 5000 MiB	Warn the user before this impacts the useability of the device.

Note: Make sure you test the above in your organisation before mass deployment.

OneDrive Admin Reports

As a side note, this is the kind of information you can gather when syncing OneDrive admin accounts, you gather this information from https://config.office.com using the tenant association key.

Until next time, happy OneDriving! 😊