| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| SharePoint | Allow Syncing Only On Specific Domains | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/allow-syncing-only-on-specific-domains.md | + + Title: "Allow syncing only on computers joined to specific domains" +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- ODB150 +- MET150 +ms.assetid: a3b03efd-ccd0-4d3c-b9ae-7f8f3f9485bc ++- admindeeplinkSPO +- onedrive-toc +description: "Learn how to restrict syncing to only devices on the domains you specify." +++# Allow syncing only on computers joined to specific domains ++To make sure that users sync OneDrive files only on managed computers, you can configure OneDrive to sync only on PCs that are joined to specific domains. + + **To allow syncing only on PCs joined to specific domains** + +> [!NOTE] +> These settings apply to SharePoint sites as well as OneDrive. +> In a multi-geo environment, this setting can be configured separately for each geo location to apply to users with that preferred data location. ++1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings in the SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Sharing page. ++2. Select **Sync**. ++  + +3. Select the **Allow syncing only on computers joined to specific domains** check box. ++4. Add the [GUID of each domain](/powershell/module/activedirectory/get-addomain) for the member computers that you want to be able to sync. + + > [!NOTE] + > Make sure to add the domain GUID of the computer domain membership. If users are in a separate domain, only the domain GUID that the computer account is joined to is required. ++ > [!IMPORTANT] + > This setting is only applicable to Active Directory domains. It does not apply to Azure AD domains. If you have devices which are only Azure AD joined, consider using a [Conditional Access Policy](/azure/active-directory/conditional-access/overview) instead. + +7. Select **Save**. + +For info about setting this sync app restriction by using PowerShell, see [Set-SPOTenantSyncClientRestriction](/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction). |
| SharePoint | B2b Sync | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/b2b-sync.md | + + Title: "B2B Sync" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- admindeeplinkSPO +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- MET150 +description: "Learn how the OneDrive sync app allows users to sync folders shared by users in other organizations. " +++# B2B Sync ++The OneDrive sync app now lets users sync libraries or folders in Microsoft SharePoint or Microsoft OneDrive that have been shared from other organizations. This scenario is often referred to as Business-to-Business (B2B) Collaboration. We're calling this new feature in the OneDrive sync app "B2B Sync". ++Azure Active Directory (AAD) guest accounts play a key role in making B2B Collaboration possible. A guest account at one organization links to a member account at another organization. Once created, a guest account allows Microsoft 365 services like OneDrive and SharePoint to grant a guest permission to sites and folders the same way a member within the organization is granted permission. Since the accounts at two organizations are linked, the user only needs to remember the username and password for the account at their organization. As a result, a single sign-in to their account enables access to content from their own organization and from any other organizations that have created guest accounts for them. ++> [!IMPORTANT] +> We recommend that you enable [SharePoint and OneDrive integration with Azure AD B2B](/sharepoint/sharepoint-azureb2b-integration) to help ensure that the required Azure AD guest account for the share recipient is created in your organization's directory. ++## B2B Sync requirements ++For people outside your organization to sync shared libraries and folders: ++- External sharing must be enabled for your organization. +- External sharing must be enabled for the site or OneDrive. +- The content must be shared with people outside the organization at the site or folder level. If a folder is shared, it must be through a link that requires sign-in. +- Sharing recipients must have a Microsoft 365 work or school account (in Azure AD). +- ADAL must not be enabled if using builds before 19.086.*. ++This article gives an overview of the B2B Sync experience and describes these requirements in more detail. ++## Known issues with this release ++- On the Mac, Files On-Demand thumbnails will not display from external organization's sites. Thumbnails will display correctly for files from the user's own organization. +- On the Mac, if the guest account was created with a different email address format than the form they are using with the sync app, the external site's content cannot be synced. For example, first.last@fabrikam.com vs alias@fabrikam.com. +- On the Mac, the external content may be placed on the local computer in the user's own organization's folder instead of one with the external organization's name. +- Multifactor authentication from an external organization is not yet supported. Only guest accounts that don't require MFA will sync. ++## Overview of the B2B Sync experience ++Here's an example of what happens after someone at "Contoso" shares a site or folder with someone at "Fabrikam": ++1. The Fabrikam recipient receives an email like the following. ++  ++2. When the recipient clicks the link in the email to go to the shared item, they need to click "Organizational account" to sign in with their Fabrikam account. Behind the scenes, this creates the Contoso guest account in Azure AD. ++  ++3. The recipient may need to enter their Fabrikam username or password, and then they can view the shared item. If they don't want to sync everything that was shared, they can browse to the library or folder they want to sync. To set up syncing, they need to click the Sync button. ++  ++4. The guest's browser will display up a message asking if they want to open "Microsoft OneDrive," and they will need to allow this. ++5. If this is the first time the guest has used the sync app with their Fabrikam account, they'll need to sign in. The email address will be automatically set to the Fabrikam account used in the previous steps. The guest needs to select "Sign in." ++6. The guest might be able to sign in to the sync app without entering their Fabrikam password if they're signed in to Windows with the same account. Otherwise they'll need to enter their password. ++7. The guest will confirm where they want to sync the shared item on their computer. ++ > [!NOTE] + > The content is placed in a folder whose name includes the name of the organization ("SharePoint - Contoso" in this example). If the user is syncing SharePoint content from Fabrikam as well, they'll also have a "SharePoint - Fabrikam" folder. ++8. The guest will continue through OneDrive sync app setup. ++9. After the guest completes setup, the site will begin syncing. The user can click the blue cloud icon in the notification area to open the OneDrive sync activity center and see the files syncing, open the local folder with the files, or open the SharePoint site in a web browser. ++## Enable external sharing for your organization ++In order for users at your organization to be able to share with their partners at other organizations, external sharing must be enabled at the organization level. To do this, you must be a global or SharePoint admin in Microsoft 365. After you enable external sharing at the organization level, you can restrict it site by site. A site's settings can be the same as the organization setting, or more restrictive, but not more permissive. ++You can change your organization-level sharing settings in two different places (both control the same thing): ++- On the Sharing page in the new SharePoint admin center. For more info, see [Change the organization-level external sharing setting](/sharepoint/turn-external-sharing-on-or-off#change-the-organization-level-external-sharing-setting) +- In the Microsoft 365 admin center, on the Org settings page > SharePoint. ++> [!IMPORTANT] +> If you allow Anyone links (sometimes referred to as "anonymous access" links), these links do not create guest accounts and therefore the external share recipient will not be able to leverage B2B Sync when receiving that link type. ++For more info, see [External sharing overview](/sharepoint/external-sharing-overview). ++### Control external sharing ++When you allow users to share content from your organization externally, you can use several features in Microsoft 365 to manage who has access to the content. Admins and site owners can review permissions and audit access to sites. For info, see [Searching for site content shared with people outside your organization](/microsoft-365/compliance/keyword-queries-and-search-conditions#searching-for-site-content-shared-with-external-users) and [Turn on external sharing notifications](turn-on-external-sharing-notifications.md). You can enable external sharing with only specific internet domains, or you can block specific domains. For info, see [Restricted domains sharing](/sharepoint/restricted-domains-sharing). You can also allow only members of specific security groups to share externally. For info, see [Turn external sharing on or off](/sharepoint/turn-external-sharing-on-or-off). ++We recommend creating separate sites (site collections, not subsites) for each unit of work that you want to share externally. This way, you can clearly annotate the sites to indicate that people outside the organization have access, and avoid unintentional disclosure of information. For individual users sharing content from their OneDrive, we recommend creating separate folders for different projects or collaboration groups. ++You can remove a guest's permission to a site or folder, or you can delete the guest account to remove their permission from all of your organization's content. ++> [!IMPORTANT] +> Any synced content will remain on the user's computer after permissions have been removed. ++## Enable external sharing for a site ++To view or change the sharing setting for any site, use the new SharePoint admin center. ++1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185220" target="_blank">Active sites in the SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. ++ >[!Note] + >If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Active sites page. ++2. Customize the view as necessary to see the External sharing column. ++3. If you need to, [change the external sharing setting for a site](/sharepoint/manage-sites-in-new-admin-center#change-the-external-sharing-setting-for-a-site). ++## Methods of sharing ++Sites and folders can be shared in different ways in SharePoint and OneDrive: ++- If users are syncing a folder, they can right-click it in File Explorer to share it. +- Users can go to the SharePoint site or folder on the web and click the Share button to share it. +- Users can share sites and folders in the SharePoint and OneDrive mobile apps. +- Admins can create guest accounts and use the admin center or PowerShell to add them to sites. ++> [!NOTE] +> For more info about these methods, see [Learn how to share a site](https://support.office.com/article/958771a8-d041-4eb8-b51c-afea2eae3658) and [Learn how to share a folder](https://support.office.com/article/1fe37332-0f9a-4719-970e-d2578da4941c). ++B2B Sync works with all these methods of sharing. It has only the following requirements: ++- For guests to sync shared content, the content must be shared at the site or folder level. Guests can't sync files that are shared individually (for example, from the Office apps). +- B2B sync works only when guest accounts are created in the organization, and when the recipient has an Azure AD account. It doesn't work when users share by creating an Anyone link (also known as "anonymous access" link), or when they share with people who have a Microsoft account or other personal account. ++### Add guests to SharePoint sites ++As an admin in Microsoft 365, you can share with people outside the organization by [creating guests individually in the Azure AD admin center](/azure/active-directory/b2b/b2b-quickstart-add-guest-users-portal), and then adding them to a SharePoint team site individually or by adding them to a security group that already has permissions to the site you want to share. If you grant permissions by using the advanced permissions page (instead of by using the Share site button), you'll need to inform the guest that you've given them permission to the site. They won't receive an invitation email. ++> [!IMPORTANT] +> If you use the advanced permissions page, we recommend granting permissions at the site level, not at the document library or folder level. ++### Use PowerShell to bulk create guest accounts and add them to a SharePoint group ++If you need to create and grant permissions to many guest accounts, you can use the following PowerShell script, which creates guest accounts and grants them permissions to a site. The script takes a CSV (comma-separated value) file as input, which contains a list of user display names and email addresses. For each name and email address, a guest account is created and that account is added to a security group to grant it permission. The script is designed so that you can feed the resulting output CSV as input to the script on a subsequent run. This lets you add more users to your CSV file or retry creating any failed account. ++As users are added to the Azure AD Group, they should receive an email welcoming them to the group. After running the script, you'll need to email the users with a direct link to the SharePoint site you gave them permissions to. When they click the link, they'll be presented with the below UI to accept the terms of the invitation. Once they accept, they will be taken to the site you shared with them. At that point they can click the Sync button to begin syncing the sites files to their PC or Mac. ++ ++```PowerShell +# first line of InviteGuests.ps1 PowerShell script +# requires latest AzureADPreview +# Get-Module -ListAvailable AzureAD* +# Uninstall-Module AzureAD +# Uninstall-Module AzureADPreview +# Install-Module AzureADPreview +++# customizable properties for this script ++$csvDir = '' +$csvInput = $csvDir + 'BulkInvite.csv' +$csvOutput = $csvDir + 'BulkInviteResults.csv' ++$domain = 'YourTenantOrganization.onmicrosoft.com' +$admin = "admin@$domain" +$redirectUrl = 'https://YourTenantOrganization.sharepoint.com/sites/SiteName/' +$groupName = 'SiteName' +++# CSV file expected format (with the header row): +# Name,Email +# Jane Doe,jane@contoso.com ++$csv = import-csv $csvInput ++# will prompt for credentials for the tenantorganization admin account +# (who has permissions to send invites and add to groups) +Connect-AzureAD -TenantDomain $domain -AccountId $admin ++$group = (Get-AzureADGroup -SearchString $groupName) ++foreach ($row in $csv) +{ + Try + { + if ((Get-Member -inputobject $row -name 'error') -and ` + ($row.error -eq 'success')) + { + $out = $row #nothing to do, user already invited and added to group + } + else + { + echo ("name='$($row.Name)' email='$($row.Email)'") ++ $inv = (New-AzureADMSInvitation -InvitedUserEmailAddress $row.Email -InvitedUserDisplayName $row.Name ` + -InviteRedirectUrl $redirectUrl -SendInvitationMessage $false) ++ $out = $row + $out|Add-Member -MemberType ScriptProperty -force -name 'time' -Value {$(Get-Date -Format u)} + $out|Add-Member -MemberType ScriptProperty -force -name 'status' -Value {$inv.Status} + $out|Add-Member -MemberType ScriptProperty -force -name 'userId' -Value {$inv.InvitedUser.Id} + $out|Add-Member -MemberType ScriptProperty -force -name 'redeemUrl' -Value {$inv.inviteRedeemUrl} + $out|Add-Member -MemberType ScriptProperty -force -name 'inviteId' -Value {$inv.Id} ++ # this will send a welcome to the group email + Add-AzureADGroupMember -ObjectId $group.ObjectId -RefObjectId $inv.InvitedUser.Id ++ $out|Add-Member -MemberType ScriptProperty -force -name 'error' -Value {'success'} + } + } + Catch + { + $err = $PSItem.Exception.Message + $out|Add-Member -MemberType ScriptProperty -force -name 'error' -Value {$err} + } + Finally + { + $out | export-csv -Path $csvOutput -Append + } +} ++# for more information please see +# https://learn.microsoft.com/azure/active-directory/b2b/b2b-tutorial-bulk-invite +# end of InviteGuests.ps1 powershell script +``` ++For more info, see: ++- [Redemption experience](/azure/active-directory/b2b/redemption-experience) +- [Add user without invite](/azure/active-directory/b2b/add-user-without-invite) ++## When a guest loses access to shared content ++If a person's guest account is deleted or their permission to shared content is removed, the sync app will display an error. ++- A notification will appear indicating that the library can't be synced. ++  ++- The OneDrive icon in the notification area will show an error. ++  ++ When the guest clicks the icon, they will see an error banner in the activity center. ++  +  ++## Policy Setting to Prevent B2B Sync ++The B2B Sync feature of the OneDrive sync app allows users at an organization to sync content shared with them from another organization. If you wish to prevent users at your organization from being able to use B2B Sync, you may set a policy value on your users' Windows PC or Mac to block external sync. ++You only need to take these actions if you wish to prevent users at your organization from using the B2B Sync feature (to prevent syncing libraries and folders shared from other organizations). ++The new BlockExternalSync setting is described in the adm\OneDrive.admx and OneDrive.adml files installed as part of the OneDrive sync product build 19.086.* or higher. If you use ADM to manage your sync app policies, import the new files as you normally would to see the new setting. ++If you are using other management systems to deploy policies to your users' Windows PCs, use the equivalent of the following command to prevent B2B Sync: ++```console +reg add "HKLM\SOFTWARE\Policies\Microsoft\OneDrive" /v BlockExternalSync /t REG_DWORD /d 1 +``` ++On a Mac with the Apple Store version of OneDrive, use the equivalent of the following command to prevent B2B Sync: ++```console +defaults write com.microsoft.OneDrive-mac BlockExternalSync -bool YES +``` ++On a Mac with the Standalone version of OneDrive, use the equivalent of the following command to prevent B2B Sync: ++```console +defaults write com.microsoft.OneDrive BlockExternalSync -bool YES +``` |
| SharePoint | Block File Types | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/block-file-types.md | + + Title: "Block syncing of specific file types" +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- admindeeplinkSPO +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- MET150 +ms.assetid: 7d7168dd-9015-4245-a971-61b504f834d6 +description: "In this article, you'll learn how to prevent users from uploading specific file types." +++# Block syncing of specific file types ++You can prevent users from uploading specific file types when they sync their OneDrive files. ++> [!NOTE] +> This setting prevents file types from being uploaded but not downloaded. If users already have blocked file types in their OneDrive, the files will sync to their computer, but any changes they make on their computer won't be uploaded. ++ + **To block uploading of specific file types** + +1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings in the SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Sharing page. ++2. Select **Sync**. ++  + +3. Select the **Block upload of specific file types** check box. ++4. Enter the file name extensions you want to block, for example: **exe** or **mp3**. ++ > [!IMPORTANT] + > Do not include the periods with the extensions, or any other punctuation, spaces, or special characters. + +5. Select **Save**. ++ > [!NOTE] + > When you configure this setting, it takes approximately 8 hours for the OneDrive sync app to detect it and apply the change. ++For info about setting this sync app restriction by using PowerShell, see [Set-SPOTenantSyncClientRestriction](/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction). For info about using a policy to block upload of specific files, see [Exclude specific kinds of files from being uploaded](use-group-policy.md#exclude-specific-kinds-of-files-from-being-uploaded). ++ |
| SharePoint | Change User Storage | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/change-user-storage.md | + + Title: "Change a specific user's OneDrive storage space" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +search.appverid: +- ODB160 +- ODB150 +- MET150 ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +ms.assetid: 7448173d-a38c-48cf-acbb-09ac1b6237d4 +description: In this article, you'll learn how to change a user's OneDrive storage space. +++# Change a specific user's OneDrive storage space ++As a global or SharePoint admin in Microsoft 365, you can set the OneDrive storage space for a specific user. + +> [!NOTE] +> For info about setting the default storage space, see [Set the default storage space for OneDrive users](set-default-storage-space.md). For info about the storage available for your Microsoft 365 subscription, see the [OneDrive service description](/office365/servicedescriptions/onedrive-for-business-service-description). ++> [!NOTE] +> If your organization is configured for multi-geo, you need to use PowerShell to change a user's OneDrive storage space. Editing storage limits isn't available in the Microsoft 365 admin center. ++>[!IMPORTANT] +> If a user has run out of storage, consider instructing them to proactively identify and review items that are taking up space by following the instructions at [Manage your OneDrive for work](https://support.microsoft.com/en-us/office/manage-your-onedrive-for-work-or-school-storage-31519161-059c-4764-b6f8-f5cd29f7fe68). ++## Change a user's storage space in the Microsoft 365 admin center ++1. Sign in to https://admin.microsoft.com as a global or SharePoint admin. (If you see a message that you don't have permission to access the page, you don't have Microsoft 365 admin permissions in your organization.) + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), sign in at https://login.partner.microsoftonline.cn/.<br/> + > Then select the Admin tile to open the admin center. + +2. In the left pane, select **Users** \> **Active users**. ++3. Select the user. ++4. Select the **OneDrive** tab. ++5. Under **Storage used** click **Edit**. ++6. Select the **Maximum storage for this user** option, and type the storage limit that you want to use. ++7. Click **Save**. + +  ++When you need cloud storage for individual users beyond the initial 5 TB, additional cloud storage will be granted as follows: ++- When a user has filled their 5 TB of OneDrive storage to at least 90% capacity, Microsoft will increase your default storage space in OneDrive to up to 25 TB per user (admins may set a lower per-user limit if they want to). ++- For any user that reaches at least 90% capacity of their 25 TB of OneDrive storage, additional cloud storage will be provided as 25 TB SharePoint team sites to individual users. For more information and assistance, contact [Microsoft Support](https://go.microsoft.com/fwlink/?linkid=869559). ++- Admins can check for OneDrive eligibility beyond 5 TB via [Check OneDrive site eligibility for increased storage](/sharepoint/troubleshoot/storage/check-storage-increase-eligibility). + + +## Change a user's storage space by using PowerShell ++1. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++2. Save the following script as a PowerShell file. For example, you could save it to a file named UpdateOneDriveStorage.ps1. + + ```PowerShell + $TenantUrl = Read-Host "Enter the SharePoint admin center URL" + Connect-SPOService -Url $TenantUrl + + $OneDriveSite = Read-Host "Enter the OneDrive Site URL" + $OneDriveStorageQuota = Read-Host "Enter the OneDrive Storage Quota in MB" + $OneDriveStorageQuotaWarningLevel = Read-Host "Enter the OneDrive Storage Quota Warning Level in MB" + Set-SPOSite -Identity $OneDriveSite -StorageQuota $OneDriveStorageQuota -StorageQuotaWarningLevel $OneDriveStorageQuotaWarningLevel + Write-Host "Done" + ``` ++3. Open the SharePoint Online Management Shell. Run the script in the location you saved it. ++ ```PowerShell + PS C:\>.\ UpdateOneDriveStorage.ps1 + ``` ++ > [!NOTE] + > If you get an error message about being unable to run scripts, you might need to change your execution policies. For more info about PowerShell execution policies, see [About Execution Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1&preserve-view=true). + +4. When prompted, enter the SharePoint admin center URL. For example, `https://contoso-admin.sharepoint.com` is the Contoso SharePoint admin center URL. ++5. Sign in as a global or SharePoint admin in Microsoft 365. ++6. Enter the OneDrive site URL: For example, `https://contoso-my.sharepoint.com/personal/user_contoso_onmicrosoft_com`. ++7. Enter the OneDrive Storage Quota in MB. ++8. Enter the OneDrive Storage Quota Warning Level in MB. ++ | MB | TB | + | - | - | + | 1048576 | 1 | + | 2097152 | 2 | + | 3145728 | 3 | + | 4194304 | 4 | + | 5242880 | 5 | + | 6291456 | 6 | + | 7340032 | 7 | + | 8388608 | 8 | + | 9437184 | 9 | + | 10485760 | 10 | +++> [!NOTE] +> To change the storage space for multiple users, use PowerShell to [Display a list of OneDrive accounts by using PowerShell](list-onedrive-urls.md) and use [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite?preserve-view=true&view=sharepoint-ps&preserve-view=true) to make the change. ++## Diagnose issues with changing the OneDrive storage ++If you are attempting to change the OneDrive storage for a user and are not able to do so or the storage amount reverts to the original value, a Microsoft 365 administrator can run tests to determine what may be preventing the storage from changing. ++> [!NOTE] +> If you're an administrator and you're having trouble changing the OneDrive storage for a user or the storage amount reverts to the original value, select **Run Tests** below, which will populate the OneDrive storage quota diagnostic in the Microsoft 365 admin center. These tests will help determine what may be preventing the storage from changing and recommend steps for a resolution. +>> [!div class="nextstepaction"] +>> [Run Tests: Check OneDrive Storage Quota](https://aka.ms/PillarOneDriveQuota) ++> [!NOTE] +> This feature is not available for Microsoft 365 Government and Microsoft 365 operated by 21Vianet. ++> To disable OneDrive creation for specific users, see [Manage user profiles in the SharePoint admin center](/sharepoint/manage-user-profiles). |
| SharePoint | Configure Sync Intune | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/configure-sync-intune.md | + + Title: "Use administrative templates in Intune" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +- onedrive-toc +search.appverid: +- MET150 +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +description: "In this article, you'll learn how to configure the Microsoft OneDrive sync app by using administrative templates in Microsoft Intune." +++# Use administrative templates in Intune ++Profiles in Microsoft Intune let you configure settings and push them to devices in your organization. The administrative templates built in to Microsoft Intune make configuring the Microsoft OneDrive sync app easier than ever. ++## Create a profile ++1. Go to [The Configuration profiles page of the Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/?ref=AdminCenter#blade/Microsoft_Intune_DeviceSettings/DevicesMenu/configurationProfiles). +2. Select **Create profile**. +3. Under **Platform**, select **Windows 10 and later**. +4. Under **Profile**, select **Administrative Templates**. ++  ++5. Select **Create**. +6. Enter a name for the profile, and optionally a description, and then select **Next**. +7. Under **Computer Configuration** or **User Configuration**, select **OneDrive**, and select the setting you want to configure. For info about these settings, see [Use OneDrive policies](use-group-policy.md). For info about the recommended settings, see [Recommended sync app configuration](ideal-state-configuration.md). ++  ++8. Configure the setting the way you want, and then select **OK**. Some settings require entering your tenant ID. [Learn how to find it](find-your-office-365-tenant-id.md). When you're done, select **Next**. +9. Select scope tags, and then select **Next**. For info about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). +10. In **Assignments**, include or exclude the profile from selected groups. For info about assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). ++ If the profile is assigned to user groups, then configured ADMX settings apply to any device that the user enrolls, and signs in to. If the profile is assigned to device groups, then configured ADMX settings apply to any user that signs into that device. This assignment happens if the ADMX setting is a computer configuration (`HKEY_LOCAL_MACHINE`), or a user configuration (`HKEY_CURRENT_USER`). With some settings, a computer setting assigned to a user may also impact the experience of other users on that device. For more info, see [User groups vs. device groups](/mem/intune/configuration/device-profile-assign#user-groups-vs-device-groups). ++ When you're done, select **Next**. ++11. Review the profile, and then select **Create**. ++## See also ++- [Use Windows 10 templates to configure Group Policy settings in Microsoft Intune](/mem/intune/configuration/administrative-templates-windows) +- [Understanding ADMX-backed policies](/windows/client-management/mdm/understanding-admx-backed-policies) +- [Monitor device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-monitor) +- [Deploy the OneDrive sync app to Windows 10 devices as part of Office 365](deploy-intune.md#deploy-the-onedrive-sync-app-to-windows-10-devices) |
| SharePoint | Deploy And Configure On Macos | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/deploy-and-configure-on-macos.md | + + Title: "Deploy and configure the OneDrive sync app for Mac" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- MET150 +ms.assetid: eadddc4e-edc0-4982-9f50-2aef5038c307 ++description: "Learn how to change settings when deploying or managing the OneDrive sync app on macOS." +++# Deploy and configure the OneDrive sync app for Mac ++> [!IMPORTANT] +> The standalone OneDrive sync app is necessary for deploying and configuring Folder Backup settings. The Mac App Store OneDrive sync app is not currently supported with regards to Folder Backup. ++There are two basic ways that you, as an administrator, can deploy the OneDrive sync app to Mac users in your organization: + +- Install and set up the OneDrive sync app by following the instructions in [Sync files with OneDrive on macOS](https://support.office.com/article/d11b9f29-00bb-4172-be39-997da46f913f). To install the OneDrive sync app for Mac, a user has to be an administrator on the Mac. ++- Download the installer package file to your local network, and then use your software distribution tools to deploy the app to your users. By using a software distribution tool, you have more control over the deployment, including which users get the sync app and when. The OneDrive sync app for Mac uses the Apple Installer technology for installation allowing you to use the software distribution tools that you normally use to deploy software to Mac users. You can use [Microsoft Intune](/mem/intune/apps/apps-add-office365-macOS). Other common tools are [Jamf Pro](https://www.jamf.com/products/jamf-pro/), [Munki](https://www.munki.org/), and [AutoPkg](https://github.com/autopkg/autopkg). You can also use [Apple Remote Desktop](https://www.apple.com/remotedesktop/) and [AppleScript](https://developer.apple.com/library/mac/documentation/AppleScript/Conceptual/AppleScriptX/AppleScriptX.html). + +## Manage OneDrive settings on macOS using property list (.plist) files ++After the OneDrive sync app for Mac is installed, users can configure settings for the app. These settings are called preferences. As an administrator, you might want to provide users in your organization with a standard set of preferences. Preferences for the OneDrive sync app for Mac are stored in property list (.plist) files. + +|| Standalone | Mac App Store | +|:--|:--|:--| +|**.plist location** |~/Library/Preferences/com.microsoft.OneDrive.plist |~/Library/Containers/com.microsoft.OneDrive-mac/Data/Library/Preferences/com.microsoft.OneDrive-mac.plist | +|**Domain** |com.microsoft.OneDrive |com.microsoft.OneDrive-mac | + +## Configure sync app settings ++Configure the settings on macOS as follows: + +1. Define the settings you want to change by creating a .plist file with the values needed. You can use a script to set the values. ++1. Quit the OneDrive app. ++1. Deploy the settings onto the local computer. ++1. Refresh the preferences cache. ++On the next start of OneDrive, the new settings will be picked up. ++## Overview of settings ++Use the following keys to pre-configure or change settings for your users. The keys are the same whether you run the standalone or Mac App Store edition of the sync app. However, the .plist file name and domain name will be different. When you apply the settings, ensure that you target the appropriate domain depending on the edition of the sync app. ++## List of settings ++- [AllowTenantList](deploy-and-configure-on-macos.md#allowtenantlist) +- [AutomaticUploadBandwidthPercentage](deploy-and-configure-on-macos.md#automaticuploadbandwidthpercentage) +- [BlockExternalSync](deploy-and-configure-on-macos.md#blockexternalsync) +- [BlockTenantList](deploy-and-configure-on-macos.md#blocktenantlist) +- [DefaultFolderLocation](deploy-and-configure-on-macos.md#defaultfolderlocation) +- [DisableAutoConfig](deploy-and-configure-on-macos.md#disableautoconfig) +- [DisableHydrationToast](deploy-and-configure-on-macos.md#disablehydrationtoast) +- [DisablePersonalSync](deploy-and-configure-on-macos.md#disablepersonalsync) +- [DisableTutorial](deploy-and-configure-on-macos.md#disabletutorial) +- [DownloadBandwidthLimited](deploy-and-configure-on-macos.md#downloadbandwidthlimited) +- [EnableAllOcsiClients](deploy-and-configure-on-macos.md#enableallocsiclients) +- [EnableODIgnore](deploy-and-configure-on-macos.md#enableodignore) +- [FilesOnDemandEnabled](deploy-and-configure-on-macos.md#filesondemandenabled) +- [HideDockIcon](deploy-and-configure-on-macos.md#hidedockicon) +- [HydrationDisallowedApps](deploy-and-configure-on-macos.md#hydrationdisallowedapps) +- [KFMBlockOptIn](deploy-and-configure-on-macos.md#kfmblockoptin) +- [KFMBlockOptOut](deploy-and-configure-on-macos.md#kfmblockoptout) +- [KFMOptInWithWizard](deploy-and-configure-on-macos.md#kfmoptinwithwizard) +- [KFMSilentOptIn](deploy-and-configure-on-macos.md#kfmsilentoptin) +- [OpenAtLogin](deploy-and-configure-on-macos.md#openatlogin) +- [SharePointOnPremFrontDoorUrl](deploy-and-configure-on-macos.md#sharepointonpremfrontdoorurl) +- [SharePointOnPremPrioritizationPolicy](deploy-and-configure-on-macos.md#sharepointonpremprioritizationpolicy) +- [SharePointOnPremTenantName](deploy-and-configure-on-macos.md#sharepointonpremtenantname) +- [Tier](deploy-and-configure-on-macos.md#tier) +- [UploadBandwidthLimited](deploy-and-configure-on-macos.md#uploadbandwidthlimited) ++### AllowTenantList ++<a name="AllowTenantList"> </a> ++This setting prevents the users from uploading files to other organizations by specifying a list of allowed tenant IDs. If you enable this setting, the user gets an error if they attempt to add an account from an organization that isn't in the allowed tenants list. If the user has already added the account, the files stop syncing. This setting takes priority over the **BlockTenantList** setting. Do **NOT** enable both settings at the same time. ++The parameter for the **AllowTenantList** key is **TenantID** and its value is a string, which determines the tenants for whom the **Allow Tenant** setting is applicable. For the setting to be complete, this parameter also requires a boolean value to be set to it. If the boolean value is set to **True**, the tenant is allowed to sync. ++The example for this setting in the .plist file is: +```xml +<key>AllowTenantList</key> +<dict> +<key>TenantId1</key> +<true/> +<key>TenantId2</key> +<true/> +</dict> +``` + +### AutomaticUploadBandwidthPercentage ++<a name="AutomaticUploadBandwidthPercentage"> </a> ++This setting enables the sync app to automatically set the amount of bandwidth that can be used for uploading files, based on available bandwidth. ++To enable this setting, you must define a number between 1 and 99 that determines the percentage of bandwidth the sync app can use out of the total available bandwidth. ++The example for this setting in the .plist file is: +```xml +<key>AutomaticUploadBandwidthPercentage</key> +<integer>(Bandwidth)</integer> +``` ++### BlockExternalSync ++<a name="BlockExternalSync"> </a> ++This setting prevents the sync app from syncing libraries and folders shared from other organizations. ++Set the setting's value to **True**, to prevent the users from syncing OneDrive, SharePoint libraries, and folders with organizations other than the user's own organization. Set the value to **False** or don't enable the setting to allow the OneDrive, and SharePoint files to be synced with other organizations also. ++The example for this setting in the .plist file is: +```xml +<key>BlockExternalSync</key> +<(Bool)/> +``` ++### BlockTenantList ++<a name="BlockTenantList"> </a> +This setting prevents the users from uploading files to organizations that are included in the **blocked tenant IDs** list. ++If you enable this setting, the users get an error if they attempt to add an account from an organization that is blocked. If a user has already added an account for a blocked organization, the files stop syncing. This setting does **NOT** work if you've the **AllowTenantList** setting enabled. Do **NOT** enable both settings at the same time. ++Enable this setting by defining IDs for the **TenantID** parameter, which determines the tenants to whom the **block tenant** setting is applicable. Also set the boolean value to **True** for the ID of every tenant you want to prevent from syncing with the OneDrive and SharePoint files and folders. ++> [!NOTE] +> In the list, inclusion of the tenant ID alone doesn't suffice. It's mandatory to set the boolean value to **True** for the ID of each tenant who is to be blocked. ++The example for this setting in the .plist file is: +```xml +<key>BlockTenantList</key> +<dict> +<key>TenantId1</key> +<true/> +<key>TenantId2</key> +<true/> +</dict> +``` ++### DefaultFolderLocation ++<a name="DefaultFolderLocation"> </a> +This setting specifies the default location of the OneDrive folder for each organization. ++The parameters are **TenantID** and **DefaultFolderPath**. +The **TenantID** value is a string that determines the tenants to whom the **default folder location** setting is applicable. +The **DefaultFolderPath** value is a string that specifies the default location of the folder. ++The following are the conditions governing the default folder location: +-**Mac App Store**: The path must already exist when the user is setting up the sync app. +-**Standalone**: The path will be created (if it doesn't already exist) after the user sets up the sync app. Only with the Standalone sync app you can prevent users from changing the location. ++The example for this setting in the .plist file is: +```xml +<key>DefaultFolder</key> +<dict> +<key>Path</key> +<string>(DefaultFolderPath)</string> +<key>TenantId</key> +<string>(TenantID)</string> +</dict> +``` ++### DisableAutoConfig ++<a name="DisableAutoConfig"> </a> ++This setting determines whether or not the sync app can automatically sign in. ++If you set this setting's value to 1, the sync app is prevented from automatically signing with an existing Microsoft Azure Active Directory (Azure AD) credential that is made available to Microsoft applications. ++The example for this setting in the .plist file is: +```xml +<key>DisableAutoConfig</key> +<integer>1</integer> +``` ++### DisableHydrationToast ++<a name="DisableHydrationToast"> </a> ++This setting prevents toasts from appearing when applications cause file contents to be downloaded. ++If you set the setting's value to **True**, toasts don't appear when applications trigger the download of file contents. ++The example for this setting in the .plist file is: +```xml +<key>DisableHydrationToast</key> +<(Bool)/> +``` ++### DisablePersonalSync ++<a name="DisablePersonalSync"> </a> ++This setting blocks users from signing in and syncing files in personal OneDrive accounts. If this setting has been configured after a user has set up sync with a personal account, the user gets signed out. ++If you set the setting's value to **True**, users are prevented from adding or syncing personal accounts. ++The example for this setting in the .plist file is: +```xml +<key>DisablePersonalSync</key> +<(Bool)/> +``` ++### DisableTutorial ++<a name="DisableTutorial"> </a> ++This setting prevents the tutorial from being shown to the users after they set up OneDrive. ++If you set this setting's value to **True**, the tutorial is blocked from being shown to the users after they set up the OneDrive sync app. ++The example for this setting in the .plist file is: +```xml +<key>DisableTutorial</key> +<(Bool)/> +``` +++### DownloadBandwidthLimited ++<a name="DownloadBandwidthLimited"> </a> ++This setting sets the maximum download throughput rate in kilobytes (KB)/sec for computers running the OneDrive sync app. ++Set this setting's value to an integer between 50 and 100000 to specify the download throughput in KB/sec that the sync app can use. ++The example for this setting in the .plist file is: +```xml +<key>DownloadBandwidthLimited</key> +<integer>(Download Throughput Rate in KB/sec)</integer> +``` ++### EnableAllOcsiClients ++<a name="EnableAllOcsiClients"> </a> ++This setting lets multiple users use the Microsoft 365 Apps for enterprise, Office 2019, or Office 2016 desktop apps to simultaneously edit an Office file stored in OneDrive. It also lets users share files from the Office desktop apps. ++> [!IMPORTANT] +> We recommend keeping this setting enabled to make syncing faster and reduce network bandwidth usage. [See all our recommendations for configuring the sync app](ideal-state-configuration.md). ++If you set this setting to **True** or don't set this setting, the **Office** tab appears in OneDrive sync preferences, and **Use Office applications to sync Office files that I open** is selected, by default. ++If you set this setting to **False**, the **Office** tab is hidden in the sync app, and coauthoring and in-app sharing for Office files are disabled. The **User can choose how to handle Office files in conflict** setting is disabled, and when file conflicts occur, both copies of the file are kept. For more information about the settings in the sync app, see [Use Office applications to sync Office files that I open](https://support.office.com/article/8a409b0c-ebe1-4bfa-a08e-998389a9d823). ++The example for this setting in the .plist file is: +```xml +<key>EnableAllOcsiClients</key> +<(Bool)/> +``` ++### EnableODIgnore ++<a name="EnableODIgnore"> </a> ++This setting lets you enter keywords to prevent the OneDrive sync app from uploading certain files to OneDrive or SharePoint. You can enter complete names, such as "setup.exe" or use the asterisk (*) as a wildcard character to represent a series of characters, such as *.pst. Keywords aren't case-sensitive. ++If you enable this setting, the sync app doesn't upload new files that match the keywords you specified. No errors appear for the skipped files, and the files remain in the local OneDrive folder. In Finder, the files appear with an "Excluded from sync" icon. ++Users will also see a message in the OneDrive activity center that explains why the files aren't syncing. ++The example for this setting in the .plist file is: +```xml +<key>EnableODIgnore</key> +<array> +<string>(Keyword such as *.PST)</string> +</array> +``` ++### FilesOnDemandEnabled ++<a name="FilesOnDemandEnabled"> </a> ++This setting specifies whether Files On-Demand is enabled. ++> [!NOTE] +> Beginning in macOS Monterey 12.1, Files On-Demand will be permanently enabled and this setting will no longer have any effect. ++#### macOS versions prior to Monterey 12.1 ++If you set this setting to **True**, **FilesOnDemand** is enabled and the users who set up the sync app can view the online-only files, by default. ++If you set this setting to **False**, **FilesOnDemand** is disabled and the users won't be able to turn it on. ++The example for this setting in the .plist file is: +```xml +<key>FilesOnDemandEnabled</key> +<(Bool)/> +``` ++> [!NOTE] +> We recommend keeping Files On-Demand enabled. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) ++### HideDockIcon ++<a name="HideDockIcon"> </a> ++This setting specifies whether a dock icon for OneDrive is shown. ++If you set this setting's value to **True**, the OneDrive dock icon is hidden even if the app is running. ++The example for this setting in the .plist file is: +```xml +<key>HideDockIcon</key> +<(Bool)/> +``` ++### HydrationDisallowedApps ++<a name="HydrationDisallowedApps"> </a> ++This setting prevents apps from automatically downloading online-only files. You can use this setting to lock down apps that don't work correctly with your deployment of Files On-Demand. ++To enable this setting, you must define a string in JSON format as described below: +<br/>`[{"ApplicationId":"appId","MaxBundleVersion":"1.1","MaxBuildVersion":"1.0"}]`<br/> +"appID" can be either the BSD process name or the bundle display name. "MaxBuildVersion" denotes the maximum build version of the app that will be blocked. "MaxBundleVersion" denotes the maximum bundle version of the app that will be blocked. ++The example for this setting in the .plist file is: +```xml +<key>HydrationDisallowedApps</key> +<string>[{"ApplicationId":"appId","MaxBundleVersion":"1.1","MaxBuildVersion":"1.0"}, {"ApplicationId":"appId2","MaxBundleVersion":"3.2","MaxBuildVersion":"2.0"}]</string> +<(Bool)/> +``` ++### KFMBlockOptIn ++<a name="KFMBlockOptIn"> </a> ++This setting prevents users from moving their Documents and Desktop folders to any OneDrive account. + +If you enable KFMBlockOptIn, users aren't prompted to protect their Desktop and Documents folders, and the *Manage backup* command is disabled. If the user has already moved their Desktop and Documents folders, the files in those folders will remain in OneDrive. This setting doesn't take effect if you've enabled **KFMOptInWithWizard**" or **KFMSilentOptIn**. ++If you set this setting's value to 1, it will prevent Folder Backup. If you set the value to 2, it will redirect any folders previously used for Folder Backup back to the userΓÇÖs device and stop the setting from running further. ++The example for this setting in the .plist file is: +```xml +<key>KFMBlockOptIn</key> +<integer>(1 or 2)</integer> +``` ++### KFMBlockOptOut ++<a name="KFMBlockOptOut"> </a> ++This setting forces users to keep their Documents and Desktop folders directed to OneDrive. ++If you enable this setting, the **Stop Backup** button in the **Manage Folder Backup** window is disabled, and users receive an error if they try to stop syncing their Desktop or Documents folder. + +The example for this setting in the .plist file is: +```xml +<key>KFMBlockOptOut</key> +<(Bool)/> +``` ++### KFMOptInWithWizard ++<a name="KFMOptInWithWizard"> </a> ++This setting displays a wizard that prompts users to move their Documents and Desktop folders to OneDrive. ++If you enable this setting and provide your tenant ID, users who are syncing their OneDrive will see the Folder Backup wizard window when they're signed in. If they close the window, a reminder notification appears in the Sync Activity Center until they move their Desktop and Documents folders. + +The example for this setting in the .plist file is: +```xml +<key>KFMOptInWithWizard</key> +<string>(TenantID)</string> +``` ++### KFMSilentOptIn ++<a name="KFMSilentOptIn"> </a> ++Use this setting to redirect and move your users' Documents and/or Desktop folders to OneDrive without any user interaction. + +You can move both folders at once or select which folder you want to move. After a folder is moved, this setting won't affect that folder again. ++The example for this setting in the .plist file is: +```xml +<key>KFMSilentOptIn</key> +<string>(TenantID)</string> +``` ++If you enable this setting and provide your tenant ID, you can choose whether to display a notification to users after their folders have been redirected: +```xml +<key>KFMSilentOptInWithNotification</key> +<(Bool)/> +``` ++If you don't set any of the following settings, then the default setting will move both folders into OneDrive. If you want to specify which folder to move, you should set any combination of the following settings: +```xml +<key>KFMSilentOptInDesktop</key> +<(Bool)/> +<key>KFMSilentOptInDocuments</key> +<(Bool)/> +``` ++### OpenAtLogin ++<a name="OpenAtLogin"> </a> ++This setting specifies whether OneDrive starts automatically when the user logs in. ++If you set this setting's value to **True**, OneDrive starts automatically when the user logs in to their Mac. ++The example for this setting in the .plist file is: +```xml +<key>OpenAtLogin</key> +<(Bool)/> +``` ++### SharePointOnPremFrontDoorUrl ++<a name="SharePointOnPremFrontDoorUrl"> </a> ++This setting specifies the SharePoint Server 2019 on-premises URL that the OneDrive sync app must try to authenticate and sync against. ++To enable this setting, you must define a string containing the URL of the on-premises SharePoint Server. ++The example for this setting in the .plist file is: +```xml +<key>SharePointOnPremFrontDoorUrl</key> +<string>https://Contoso.SharePoint.com</string> +``` ++[More info about configuring the OneDrive sync app for SharePoint Server 2019](/sharepoint/install/configure-syncing-with-the-onedrive-sync-app) ++### SharePointOnPremPrioritizationPolicy ++<a name="SharePointOnPremPrioritizationPolicy"> </a> ++This setting determines whether or not the sync app should set up sync for SharePoint Server on-premises or SharePoint in Microsoft 365 first during the first-run scenario when the account is the same for both SharePoint Server and SharePoint in Microsoft 365 in a hybrid scenario. ++If you set this setting's value to **1**, the OneDrive sync app will set up SharePoint Server first, followed by SharePoint in Microsoft 365. ++The example for this setting in the .plist file is: +```xml +<key>SharePointOnPremPrioritizationPolicy</key> +<integer>(0 or 1)</integer> +``` ++### SharePointOnPremTenantName ++<a name="SharePointOnPremTenantName"> </a> ++This setting enables you to specify the name of the folder created for syncing the SharePoint Server 2019 files specified in the Front Door URL. ++If this setting is enabled, you can specify a TenantName that is the name the folder will use in the following convention: + OneDrive ΓÇô TenantName (specified by you) + TenantName (specified by you) ++If you don't specify any TenantName, the folder will use the first segment of the FrontDoorURL as its name. For example, https<span>://</span>Contoso.SharePoint.com will use Contoso as the Tenant Name in the following convention: + OneDrive ΓÇô Contoso + Contoso ++The example for this setting in the .plist file is: +```xml +<key>SharePointOnPremTenantName</key> +<string>Contoso</string> +``` ++[More info about configuring the OneDrive sync app for SharePoint Server 2019](/sharepoint/install/configure-syncing-with-the-onedrive-sync-app) ++### Tier ++<a name="Tier"> </a> ++This setting lets you specify the sync app update ring for users in your organization. The OneDrive sync app updates to the public through three rings; first to Insiders, then to Production, and finally to Deferred. When you enable this setting and select a ring, users aren't able to change it. ++We recommend selecting several people in your IT department as early adopters to join the Insiders ring and receive features early. We also recommend leaving everyone else in the organization in the default Production ring to ensure they receive bug fixes and new features in a timely fashion. [See all our recommendations for configuring the sync app](ideal-state-configuration.md). ++**Insiders**: The Insiders ring users receive builds that let them preview new features coming to OneDrive. ++**Production**: The Production ring users get the latest features as they become available. This ring is the default. ++**Enterprise** (also known as "Deferred"): The Enterprise ring users get new features, bug fixes, and performance improvements last. This ring lets you deploy updates from an internal network location, and control the timing of the deployment (within a 60-day window). ++For more information on the builds currently available in each ring, see the [OneDrive release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0?). For more information about the update rings and how the sync app checks for updates, see the [OneDrive sync app update process](sync-client-update-process.md). ++|.plist Location |Domain | +|:--|:--| +| ~/Library/Preferences/com.microsoft.OneDriveUpdater.plist |com.microsoft.OneDriveUpdater | ++The example for this setting in the .plist file is: +```xml +<key>Tier</key> +<string>(UpdateRing)</string> +``` ++> [!NOTE] +> If you want to hide the option "Get pre-release Microsoft internal updates to display", you will need to opt into the Deferred update ring. +> For example, `default write com.microsoft.OneDrive Tier -string "Deferred"`. ++### UploadBandwidthLimited ++<a name="UploadBandwidthLimited"> </a> ++This setting defines the maximum upload throughput rate for computers running the OneDrive sync app. ++To enable this setting, set a value between 50 and 100000 that is the upload throughput rate in KB/sec the sync app can use. ++The example for this setting in the .plist file is: +```xml +<key>UploadBandwidthLimited</key> +<integer>(Upload Throughput Rate in KB/sec)</integer> +``` ++## Related articles ++[Find your Microsoft 365 tenant ID](find-your-office-365-tenant-id.md) |
| SharePoint | Deploy Intune | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/deploy-intune.md | + + Title: "Deploy OneDrive apps using Intune" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- MET150 +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +ms.assetid: 3f3a511c-30c6-404a-98bf-76f95c519668 +description: "In this article, you'll learn how you can use Intune to deploy the OneDrive mobile app to iOS and Android devices and the OneDrive sync app to Windows 10." +++# Deploy OneDrive apps by using Intune ++If you're a global admin or assigned [a role in Intune](/mem/intune/fundamentals/role-based-access-control) that gives you the necessary permissions, you can use Intune to deploy OneDrive apps. Before you begin deploying, make sure you review the planning information and deployment options in the [Plan file sync for SharePoint and OneDrive in Microsoft 365](plan-file-sync.md). ++## Deploy the OneDrive app for iOS or Android ++To deploy apps in Intune, you use the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/?ref=AdminCenter#blade/Microsoft_Intune_DeviceSettings/AppsMenu/allApps). For the steps to deploy apps to iOS devices, see [Add iOS store apps to Microsoft Intune](/mem/intune/apps/store-apps-ios). For the steps to deploy apps to Android devices, see [Add Android store apps to Microsoft Intune](/mem/intune/apps/store-apps-android). Use **https://play.google.com/store/apps/details?id=com.microsoft.skydrive** as the Appstore URL. For info about assigning apps to groups, see [Assign apps to groups with Microsoft Intune](/mem/intune/apps/apps-deploy). ++## Deploy the OneDrive sync app to Windows 10 devices ++Although the sync app comes with Windows 10, you might choose to switch to [per-machine installation](per-machine-installation.md). ++For info about configuring sync app settings using Intune, see [Use administrative templates in Intune](configure-sync-intune.md). |
| SharePoint | Deploy On Windows | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/deploy-on-windows.md | + + Title: "Deploy OneDrive apps using Microsoft Endpoint Configuration Manager" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- MET150 +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +ms.assetid: 3f3a511c-30c6-404a-98bf-76f95c519668 +description: "In this article, you'll learn how to deploy OneDrive apps using Microsoft Endpoint Configuration Manager." +++# Deploy OneDrive apps using Microsoft Endpoint Configuration Manager ++You can use Microsoft Endpoint Configuration Manager to deploy the new OneDrive sync app (OneDrive.exe), as well as the mobile apps for iOS and Android. Before you begin deploying, make sure you have reviewed the planning information and deployment options in the [Plan file sync for SharePoint and OneDrive in Microsoft 365](plan-file-sync.md).<br/><br/> ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE2CnSr] + +## Deploy the OneDrive sync app for Windows ++ The OneDrive sync app (OneDrive.exe) can be installed on Windows 7 and later. It can also be installed on macOS. For info about deploying the OneDrive sync app on macOS, see [Configure the new OneDrive sync app on macOS](deploy-and-configure-on-macos.md). + +The new OneDrive sync app can be used with SharePoint Server 2019, but not earlier versions of SharePoint Server. For more information about the restrictions and limitations of the OneDrive sync app, see [Invalid file names and file types in OneDrive and SharePoint](https://support.office.com/article/64883a5d-228e-48f5-b3d2-eb39e07630fa). ++### Make sure that WNS is set up correctly ++The OneDrive sync app uses Windows Push Notification Services (WNS) for optimum performance and battery life. Make sure you allow access from your network to the [endpoints that OneDrive uses](/office365/enterprise/urls-and-ip-address-ranges#sharepoint-online-and-onedrive-for-business). To see all our recommendations for configuring the sync app, see [Recommended sync app configuration](ideal-state-configuration.md). + +### Check if users already have the OneDrive sync app ++If the computers in your organization are running Windows 10, they already have the new sync app installed. If the computers have Office 2016 or Office 2013 (Home & Student, Home & Business, Professional, Personal, Home, or University) installed, they might also have the new sync app. ++> [!NOTE] +> Office is installed per machine, whereas OneDrive is installed per user by default. [Learn about installing OneDrive per machine](per-machine-installation.md). + +### Deploy any administrative settings ++To set registry keys on computers in your domain, install OneDrive and copy the OneDrive.admx and OneDrive.adml files from %localappdata%\Microsoft\OneDrive\BuildNumber\adm\ to your Group Policy central store. For more info, see [Use OneDrive policies to control OneDrive sync app settings](use-group-policy.md). + +### Use Microsoft Endpoint Configuration Manager to deploy the OneDrive sync app ++1. In Configuration Manager, select **Create Device Collection**, and follow the steps in the Create Device Collection wizard. ++2. Save the OneDriveSetup.exe installer for Windows to your local computer or a network share. [Download the Production ring OneDriveSetup.exe installer for Windows](https://go.microsoft.com/fwlink/?linkid=844652) or [download the Deferred ring OneDriveSetup.exe installer for Windows](https://go.microsoft.com/fwlink/p/?linkid=860987). + +3. Download the [sample Configuration Manager package](https://go.microsoft.com/fwlink/p/?LinkId=824069). It's a .zip file that contains the script installer deployment type. For more information about packages and programs in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). ++ > [!NOTE] + > The script installer deployment type already has a detection method script and will correctly assess the installation. Also, there is an uninstall switch, which means that you can easily remove the OneDrive sync app, if necessary. ++ +4. Copy the installer to a folder in the Configuration Manager source content share. ++5. In Configuration Manager, select the **Software Library** workspace. Under **Application Management**, right-click **Applications**, and then select **Import Application**. ++ > [!div class="mx-imgBorder"] + >  ++6. Select the sample package. ++7. On the bottom of Configuration Manager, select the **Deployment Types** tab, right-click the deployment, and to update the **Content location**, edit the properties. ++8. Right-click the package, select **Deploy**, and follow the steps in the Deploy Software Wizard. +++If you don't use the sample package, run the following command using Microsoft Endpoint Configuration + +``` +Execute <pathToExecutable>\OneDriveSetup.exe /silent +``` ++(where pathToExecutable is a location on the local computer or an accessible network share). + +> [!NOTE] +> This command must be run at user logon and using Administrator permissions. It must be run for each user on a machine. For an example of how to deploy an .exe on every user account, see [How to deploy the OneDrive sync app with Configuration Manager](/archive/blogs/paulodias/how-to-deploy-onedrive-next-generation-sync-client-with-sccm). +> +> If you run the command with no command-line parameter, users will see the installation status. After installation, OneDriveSetup.exe will automatically execute OneDrive.exe and display OneDrive Setup to users. If you run the command with the **/silent** parameter, OneDrive.exe will be installed transparently and OneDrive Setup won't appear. You'll need to run OneDrive.exe with an additional command. If you want to control the launch of OneDrive across your organization, we recommend using the **/silent** parameter. + +[Learn more about application management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699373(v=technet.10)). +The installer will install the OneDrive executable file under **%localappdata%\Microsoft\OneDrive**. + +### Deploy the RMS client to enable syncing IRM-protected files ++The new OneDrive sync app for Windows now supports syncing IRM-protected SharePoint document libraries and OneDrive locations. To create a seamless IRM sync experience for your users, deploy to your users' computers the latest [Rights Management Service (RMS) client](https://aka.ms/odirm) from the Microsoft Download Center. Even if these computers have the Azure Information Protection client installed, which includes the RMS client, the OneDrive sync app still needs a separate installation of the RMS client from the Microsoft Download Center. + +To silently install the RMS client on computers, use the /qn switch as part of the command-line options of the Microsoft Windows Installer Tool (Msiexec.exe). For example, the following command shows the silent mode installation (assuming the RMS Client installer package is already downloaded to C:\Downloads). + +```console +msiexec /qn c:\downloads\setup.msi +``` ++You can have the setup file on a network share and use managed software deployment to run the msiexec command. + +> [!NOTE] +> The sync app does not support IRM policies that expire document access rights. + +## Help users sign in +<a name="step3"> </a> ++To help users sign in, you can use [silent account configuration](use-silent-account-configuration.md) or one of these methods: + +- Use the following URL to start OneDrive Setup on users' computers. When users click to begin Setup, a sign-in window will appear for users can enter email address. + + ``` + odopen://launch + ``` ++- Use the following URL with each user's email address to start Setup and prepopulate user email addresses in the sign-in window. + + ``` + odopen://sync?useremail=youruseremail@organization.com + ``` ++- Run the following command using Configuration Manager script: + + ``` + %localappdata%\Microsoft\OneDrive\OneDrive.exe + ``` ++ It starts the OneDrive process. If users haven't set up any accounts, it displays OneDrive Setup. To display OneDrive Setup specifically to users who haven't set up an account for your organization, use the command-line parameter: + + ``` + /configure_business:<tenantId> + ``` ++> [!NOTE] +> When you use Microsoft Endpoint Configuration Manager, make sure you run OneDrive.exe with User permissions (not as an Administrator). </br> For help finding your tenant ID, see [Find your Microsoft 365 tenant ID](find-your-office-365-tenant-id.md). + + +## Auto-configure SharePoint site synchronization ++If you want to auto-configure a SharePoint site to be synced, you can use the URL below as a guide to build the path to the SharePoint site you want to sync automatically. You can also use a policy to sync sites automatically. For info, see [Configure team site libraries to sync automatically](use-group-policy.md#configure-team-site-libraries-to-sync-automatically). ++``` +odopen://sync/?siteId=<siteId>&webId=<webId>&webUrl=<webURL>&listId=<listId>&userEmail=<userEmail>&webTitle=<webTitle>&listTitle=<listTitle> +``` ++where: +- **\<siteId\>** is the SharePoint site siteId GUID, enclosed in curly brackets. You can get this GUID visiting https://\<TenantName\>.sharepoint.com/sites/\<SiteName\>/_api/site/id. +- **\<webId\>** is the SharePoint site webId GUID, enclosed in curly brackets. You can get this GUID visiting https://\<TenantName\>.sharepoint.com/sites/\<SiteName\>/_api/web/id. +- **\<webUrl\>** is the SharePoint site URL. You can get this URL visiting https://\<TenantName\>.sharepoint.com/sites/\<SiteName\>/_api/web/url. +- **\<listId\>** is the SharePoint site documents library GUID, enclosed in curly brackets. You can get this GUID visiting the document library in the browser, click in the gear icon and choosing "Library Settings". The URL will show the listId GUID at the end of URL, i.e. https://\<tenant\>.sharepoint.com/sites/\<SiteName\>/_layouts/15/listedit.aspx?List=%7B**xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx**%7D (a GUID with escaped curly brackets). +- **\<userEmail\>** is the OneDrive's user email address used to sign in into OneDrive. +- **\<webTitle\>** and **\<listTitle\>** are used to compose the name of the local folder where the OneDrive content is synchronized. By default, when you use the "Sync" button when in the browser to synchronize a document library, OneDrive uses the SharePoint site name and the document library name to compose the local folder name, in the form of %userprofile%\\<TenantName\>\\<SiteName\> - \<DocumentLibraryName\>. You could use any other values if you prefer to. If you do not use these parameters, the local folder will be named "\<TenantName\> - Documents", despite of site and library names. ++For example, if you want to synchronize `https://contoso.sharepoint.com/sites/SalesTeam-01/ProjectX`, where "ProjectX" is the documents library to synchronize, to "%userprofile%\Contoso\Sales - Unicorn" folder, you will need the following parameters to compose the odopen:// URL: +- siteId: {ssssssss-ssss-ssss-ssss-ssssssssssss} +- webId: {wwwwwwww-wwww-wwww-wwww-wwwwwwwwwwww} +- webUrl: `https://contoso.sharepoint.com/sites/SalesTeam-01` +- listId: {llllllll-llll-llll-llll-llllllllllll} +- userEmail: user@contoso.com +- webTitle: Sales (you would use *SalesTeam-01* to mimic Sync button behavior instead) +- listTitle: Unicorn (you would use *ProjectX* to mimic Sync button behavior instead) ++The resulting odopen:// URL will be: ++``` +odopen://sync/?siteId={ssssssss-ssss-ssss-ssss-ssssssssssss}&webId={wwwwwwww-wwww-wwww-wwww-wwwwwwwwwwww}&webUrl=https://contoso.sharepoint.com/sites/SalesTeam-01&listId={llllllll-llll-llll-llll-llllllllllll}&userEmail=user@contoso.com&webTitle=Sales&listTitle=Unicorn +``` ++> [!NOTE] +> You will need Client Side Object Model (CSOM) knowledge if you want to automate querying the team site to determine the appropriate siteId, webId, and listId to build the appropriate URL. +++ +## Deploy the OneDrive app on mobile devices running iOS or Android ++You can use Microsoft Endpoint Configuration Manager to deploy apps to mobile devices. Before you do, however, you need to complete a few prerequisite steps because integration with Intune is required to manage mobile devices in Configuration Manager. For information about managing mobile devices with Configuration Manager and Intune, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](/previous-versions/system-center/system-center-2012-R2/jj884158(v=technet.10)). ++### Deploy the OneDrive app for iOS ++1. In Configuration Manager, on the Home ribbon, select **Create Application**. ++2. In the **Type** box, select **App Package for iOS from App Store**. ++3. In the **Location** box, enter the app store URL, https://itunes.apple.com/us/app/onedrive/id823766827?mt=12. + + > [!div class="mx-imgBorder"] + >  ++4. Target the app to users. ++For more info, see [Create iOS applications with Configuration Manager](/configmgr/mdm/deploy-use/creating-ios-applications/), and use as the app location, as shown below. ++### Deploy the OneDrive app for Android ++1. In Configuration Manager, on the Home ribbon, select **Create Application**. ++2. In the **Type** box, select **App Package for Android on Google Play**. ++3. In the **Location** box, enter the app store URL, https://play.google.com/store/apps/details?id=com.microsoft.skydrive&hl=en. ++ > [!div class="mx-imgBorder"] + >  ++4. Target the app to users. ++For more info, see [Create Android applications with Configuration Manager](/configmgr/mdm/deploy-use/creating-android-applications/). +++## See also +<a name="cad"> </a> ++[Invalid file names and file types in OneDrive and SharePoint](https://support.office.com/article/64883a5d-228e-48f5-b3d2-eb39e07630fa) + |
| SharePoint | Disable Contact Support Send Feedback | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/disable-contact-support-send-feedback.md | + + Title: "Prevent users from contacting Microsoft directly" +++++audience: Admin +f1.keywords: +- NOCSH +++++ms.localizationpriority: medium +description: "This article describes how global and SharePoint admins in Microsoft 365 can disable the 'Contact support' and 'Send feedback' features in the OneDrive sync app." +++# Prevent users from contacting Microsoft directly ++The OneDrive sync app (OneDrive.exe) allows users to contact Microsoft directly from within the app. Users can: ++- Create a support ticket by selecting **Get help** and then selecting the **Contact support** link in the help pane. +- Send positive or negative feedback directly to Microsoft by selecting **Send feedback**. ++ ++As a global or SharePoint admin in Microsoft 365, you might want to disable these support features to prevent people in your organization from contacting Microsoft directly. ++If you disable these features, users can still select Get help to view help articles, but the Contact support link will no longer appear. ++The following screenshots show the changes after you disable the support features. ++ ++ ++> [!NOTE] +> If you disable "Contact support" and "Send feedback" but allow users to sync personal accounts, they can still contact support and send feedback directly to Microsoft from the OneDrive sync app when they're signed in with their personal account. ++## Disable "Contact support" and "Send feedback" in Windows ++To disable these features in Windows, you can: ++- Use the [Set-SPOTenantSyncClientRestriction](/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction) in Microsoft PowerShell +- Edit the registry ++### Use PowerShell ++1. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++2. Connect to SharePoint as a [global admin or SharePoint admin](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). + +3. Run the following command: + + ```PowerShell + Set-SPOTenantSyncClientRestriction -DisableReportProblemDialog $true + ``` ++### Edit the registry ++Follow these steps to disable the features on a PC by editing the registry. ++> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756/how-to-back-up-and-restore-the-registry-in-windows) in case problems occur. ++1. In Registry Editor, locate the following subkey: **HKEY_CURRENT_USER\Software\Microsoft\OneDrive** ++2. Right-click **OneDrive**, select **New**, and then select **DWORD (32-bit) Value**. ++3. Enter **DisableReportProblemDialog** for the name. ++4. Right-click the new registry key, enter **1** for **Value data**, and then select **OK**. ++## Disable "Contact support" and "Send feedback" on Mac ++To disable the features in the OneDrive sync app for Mac, add a preference to defaults. ++For the standalone Mac sync app: +**defaults write com.microsoft.OneDrive DisableReportProblemDialog 1** ++For the Mac sync app installed through the Mac App Store: ++**defaults write com.microsoft.OneDrive-mac DisableReportProblemDialog 1** |
| SharePoint | Enable Conditional Access | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/enable-conditional-access.md | + + Title: "Enable conditional access support in the OneDrive sync app" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +search.appverid: +- ODB160 +- ODB150 +- MET150 ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +ms.assetid: 028d73d7-4b86-4ee0-8fb7-9a209434b04e +description: "In this article, you'll learn how to enable conditional access in the new OneDrive sync app." +++# Enable conditional access support in the OneDrive sync app ++Conditional access control capabilities in Azure Active Directory offer simple ways for you to secure resources in the cloud. The new OneDrive sync app works with the conditional access control policies to ensure syncing is only done with compliant devices. For example, you might require sync to be available only on domain-joined devices or devices that meet compliance as defined by the Mobile Device Management system (like Intune). + +For information about how conditional access works, see: + +- [Azure Active Directory conditional access](/azure/active-directory/conditional-access/) + +- [Require managed devices for cloud app access with conditional access](/azure/active-directory/conditional-access/require-managed-devices) + +- [Configure hybrid Azure Active Directory join for managed domains](/azure/active-directory/devices/hybrid-azuread-join-managed-domains) ++- [Control access from unmanaged devices](/sharepoint/control-access-from-unmanaged-devices#block-or-limit-access-to-a-specific-sharepoint-site-or-onedrive) + +## Recommendations for Windows ++We recommend using this feature on Windows together with [silent account configuration](use-silent-account-configuration.md) for the best experience. The OneDrive sync app will automatically use ADAL, and will support both device-based and location-based conditional access policies. ++If you don't use silent account configuration, set the EnableADAL registry key: ++[HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive] +"EnableADAL"=dword:1 ++Setting this registry key configures the OneDrive sync app to use ADAL directly. + +## Known issues ++The following are known issues with this release: + +- If you create a new access policy after the device has authenticated, it may take up to twenty-four hours for the policy to take effect. + +- In some cases, the user may be prompted for credentials twice. We are working on a fix for this issue. + +- Certain AD FS configurations may require additional setup to work with this release. Please run the following command on your AD FS server to ensure FormsAuthentication is added to the list of PrimaryIntranetAuthenticationProvider: + + `Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider @('WindowsAuthentication', 'FormsAuthentication')` + +- If you enable location-based conditional access, users will get a prompt about every 90 to 120 minutes by default when they leave the set of approved IP address ranges. The exact timing depends on the access token expiry duration (60 minutes by default), when their computer last obtained a new access token, and any specific conditional access timeouts put in place. + +## Reporting problems ++Please let us know if you run into any problems while using this release. + + **To report a problem** + +1. Right-click the blue OneDrive cloud icon in the Windows taskbar notification area or macOS menu bar. + +2. Click **Get help**. + +3. Type a brief description of your issue, and then click **Submit**. |
| SharePoint | Exclude Or Uninstall Previous Sync Client | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/exclude-or-uninstall-previous-sync-client.md | + + Title: "Control Groove.exe installation when deploying Office using Click-to-Run" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +search.appverid: +- ODB160 +- OFF160 +- ODB150 +- MET150 ++- Strat_OD_admin +- M365-collaboration ++ms.assetid: 3eff17b9-c709-462f-946c-17719af68aca +description: "Learn how the previous OneDrive for Business sync app (Groove.exe) is excluded or uninstalled with Office Click-to-Run installations." +++# Control Groove.exe installation when deploying Office using Click-to-Run ++> [!IMPORTANT] +> Support for the previous OneDrive for Business sync app (Groove.exe) ended on January 11, 2021. As of February 1, 2021, users can longer sync OneDrive or SharePoint files in Microsoft 365 by using Groove.exe. Groove.exe will continue to work only for files in SharePoint Server. ++Starting in October 2017, we changed how the previous OneDrive for Business sync app installs for enterprise customers who deploy Office 2013 or 2016 by using Click-to-Run. + +- The previous sync app (Groove.exe) is no longer installed by default with Office 2016 Click-to-Run. If your organization provides an Office deployment configuration file to Setup.exe, you need to update your file to exclude Groove.exe from the install. ++- When not in use or running, the previous sync app (Groove.exe) is uninstalled, unless: (a) Groove.exe is already configured to sync one or more SharePoint or SharePoint Server libraries or (b) a "PreventUninstall" registry key is present on the computer. ++These changes don't affect your organization if you're already using the new OneDrive sync app (OneDrive.exe) to sync OneDrive and SharePoint files. These changes also don't affect your organization if you deploy Office using the traditional Windows Installer-based (MSI) method. + +> [!NOTE] +> The new OneDrive sync app (OneDrive.exe) is the recommended option for SharePoint Server 2019 customers. However, the previous sync app (Groove.exe) is still used and supported for earlier versions of SharePoint Server. [Which version of OneDrive am I using?](https://support.office.com/article/19246eae-8a51-490a-8d97-a645c151f2ba) + +## Ensure Groove.exe is no longer installed ++If your organization provides an Office deployment configuration file to Setup.exe, add this to your config file to exclude Groove in your deployment: + +``` +<Product ID="O365ProPlusRetail" > + <Language ID="en-us" /> + <ExcludeApp ID="Groove" /> +</Product> +``` ++For more info about configuration options, see [Configuration options for the Office Deployment Tool](/deployoffice/office-deployment-tool-configuration-options). + +To override the default behavior and make sure the previous OneDrive for Business sync app installs and stays installed, you must provide a config file that doesn't exclude Groove.exe. Also, you must set the "PreventUninstall" registry key on all computers where you need Groove.exe installed, so that the process doesn't uninstall Groove.exe. + +## Uninstall Groove.exe when not in use ++On Office upgrade, the installer runs on each computer to detect whether Groove.exe is currently in use or the "PreventUninstall" registry key is set. If either Groove.exe is in use or the registry key is set, Groove.exe is left in place. Otherwise, if Groove.exe isn't in use and the registry key isn't set, Groove.exe gets uninstalled automatically on that computer. + +### Prevent uninstallation (registry key) ++[HKLM\SOFTWARE\Microsoft\Office\Groove] "PreventUninstall"=dword:00000001 + +## Timeline ++The following table shows more detail about which Office installations were affected by these changes and when. +++|**Office version**|**Groove.exe is no longer installed by default**|**Groove.exe is uninstalled on next update if not in use for 30 days**| +|||| +|MSI (all versions) <br/> |Not applicable <br/> |Not applicable <br/> | +|Office 2013 Click-to-Run <br/> |Not applicable <br/> |Not applicable <br/> | +|Office 2016 Click-to-Run - Office Insider <br/> |Sept. 2017 - Version 1710 (Build 8530.1000) <br/> |Sept. 2017 - Version 1710 (Build 8530.1000) <br/> | +|Office 2016 Click-to-Run - Monthly Channel <br/> |Oct. 2017 - Version 1709 (Build 8528.2139) <br/> |Oct. 2017 - Version 1709 (Build 8528.2139) <br/> | +|Office 2016 Click-to-Run - Semi-Annual Enterprise Channel (Preview) <br/> |Sept. 2018 - Version 1808 (Build 10730.20102) <br/> |Sept. 2018 - Version 1808 (Build 10730.20102) <br/> | +|Office 2016 Click-to-Run - Semi-Annual Enterprise Channel <br/> |Jan. 2019 - Version 1808 (Build 10730.20264) <br/> |Jan. 2019 - Version 1808 (Build 10730.20264) <br/> | ++For more info about Office channels, see [Overview of update channels for Microsoft 365 Apps for enterprise]( /deployoffice/overview-update-channels). + +## Related topics ++[Learn more about the Sync button update on SharePoint sites](https://support.office.com/article/9762aef3-d17f-4486-aae3-9c20bb979cbf) |
| SharePoint | Files On Demand Mac | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/files-on-demand-mac.md | + + Title: "Set Files On-Demand states on Mac" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- OFF160 +- ODB150 +- MET150 +ms.assetid: 3eff17b9-c709-462f-946c-17719af68aca +description: "Learn how to query and set file and folder states when you use OneDrive Files On-Demand on Mac." +++# Query and set Files On-Demand states on Mac ++With OneDrive Files On-Demand, files can be in one of three states. Each of these states corresponds to a file attribute state. +To query the current state of a file or folder, use the following command: ++- /Applications/OneDrive.App/Contents/MacOS/OneDrive /getpin \<Path to file or folder> ++## Scriptable commands ++Use the following commands to set file and folder states. Quit the OneDrive sync app before running these commands. ++|**Files On-Demand state**|**File attribute state**|**Command**| +|:--|:--|:--| +|Always available <br/> |Pinned <br/> |/Applications/OneDrive.App/Contents/MacOS/OneDrive /setpin \<path\><br/> | +|Locally available <br/> |Clearpin <br/> |/Applications/OneDrive.App/Contents/MacOS/OneDrive /clearpin \<path\>| +|Online-only <br/> |Unpinned <br/> |/Applications/OneDrive.App/Contents/MacOS/OneDrive /unpin \<path\>| ++ > [!NOTE] +> To set the file attribute state for all items within a folder, add the /r parameter.<br>Pinning an online-only file makes the sync app download the file contents, and unpinning a downloaded file frees up space on the device by not storing the file contents locally.<br>To set an online-only file or folder to "locally available," you must first set it to "always available." + |
| SharePoint | Files On Demand Windows | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/files-on-demand-windows.md | + + Title: "Set Files On-Demand states in Windows" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- OFF160 +- ODB150 +- MET150 +ms.assetid: 3eff17b9-c709-462f-946c-17719af68aca +description: "Learn how to query and set file and folder states when you use OneDrive Files On-Demand on Windows." +++# Query and set Files On-Demand states in Windows ++With OneDrive Files On-Demand, files can be in one of three states. Each of these states corresponds to a file attribute state. To query the current state of a file or folder, use the following command: ++- attrib \<Path to file or folder> ++## Scriptable commands ++Use the following commands to set file and folder states. ++|**Files On-Demand state**|**File attribute state**|**Command**| +|:--|:--|:--| +|Always available <br/> |Pinned <br/> |attrib +p \<path\><br/> | +|Locally available <br/> |Clearpin <br/> |attrib -p \<path\> <br/> | +|Online-only <br/> |Unpinned <br/> |attrib +u \<path\><br/> | ++ > [!NOTE] +> Pinning an online-only file makes the sync app download the file contents, and unpinning a downloaded file frees up space on the device by not storing the file contents locally.<br> +To set an online-only file or folder to "locally available," you must first set it to "always available."<br>If you meet the [Sync app requirements](https://support.office.com/article/cc0cb2b8-f446-445c-9b52-d3c2627d681e) and still can't see the Files On-Demand option under "Settings", make sure the service "Windows Cloud Files Filter Driver" start type is set to 2 (AUTO_START). Enabling this feature sets the following registry key value to 2.`[HKLM\SYSTEM\CurrentControlSet\Services\CldFlt]"Start"="dword:00000002"` + |
| SharePoint | Find Settings | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/find-settings.md | + + Title: "Find OneDrive admin settings" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- admindeeplinkSPO +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- MET150 +description: "Learn where to find features from the OneDrive admin center. " +++# Find OneDrive admin settings ++This article covers all the features in the OneDrive admin center and where you can find them in other places. ++## Sharing page ++Go to the <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">Sharing page in the new SharePoint admin center</a>. ++| OneDrive admin center | SharePoint admin center | +|:--|:--| +|| | ++## Sync page ++Go to the <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings page in the new SharePoint admin center</a>, and select **Sync**. ++| OneDrive admin center | SharePoint admin center | +|:--|:--| +|| | ++To change the setting "Block sync on Mac OS," you can use the following PowerShell command. [Learn more about this command](/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction) ++```PowerShell +Set-SPOTenantSyncClientRestriction -BlockMacSync:$true +``` ++## Storage page ++Go to the <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings page in the new SharePoint admin center</a>. To change the default storage setting, select **Storage limit**. To change the retention setting for deleted users, select **Retention**. ++| OneDrive admin center | SharePoint admin center | +|:--|:--| +|| | ++## Device access page ++Go to the <a href="https://go.microsoft.com/fwlink/?linkid=2185071" target="_blank">Access control page in the new SharePoint admin center</a>. To control access based on network location, select **Network location**. To control access from apps that can't enforce device-based restrictions, select **Apps that don't use modern authentication**. ++| OneDrive admin center | SharePoint admin center | +|:--|:--| +|| | ++The policy settings under "Mobile application management" are no longer being updated. We recommend [creating app protection policies](https://endpoint.microsoft.com/?ref=AdminCenter#blade/Microsoft_Intune_DeviceSettings/AppsMenu/appProtection) in the Microsoft Endpoint Manager admin center. [Learn how](/mem/intune/apps/app-protection-policies). Refer to the following table to identify the Intune settings that correspond with the settings in the OneDrive admin center. ++| OneDrive | Intune | +|:--|:--| +|Block downloading files in the apps |Save copies of org data <br/> | +|Block taking screenshots in the Android apps <br/> |Screen capture and Google Assistant <br/> | +|Block copying files and content within files <br/> |Restrict cut, copy, and paste between other apps <br/> | +|Block printing files in the apps <br/> |Printing org data <br/> | +|Block backing up app data <br/> |Prevent backups <br/> | +|Require an app passcode <br/>Number of attempts before app is reset <br/>Passcode length <br/>Require complex passcode <br/>Allow fingerprint instead of passcode (iOS only) <br/> |PIN for access <br/> MAX PIN attempts<br/>Select minimum PIN length<br/>Simple PIN<br/>Allow fingerprint instead of PIN<br/>| +|Block opening OneDrive and SharePoint files in other apps <br/> |Send org data to other apps <br/> | +|Encrypt app data when the device is locked <br/> |Encrypt org data <br/> | +|Require Office 365 sign-in every 7 days <br/> |Recheck the access requirements after (minutes of inactivity) <br/> | +|When a device is offline: Minutes to verify user access after <br/> |Offline grace period (for "Block access") <br/> | +|When a device is offline: Days to wipe app data after <br/> |Offline grace period (for "Wipe data") <br/> | ++## Compliance ++This page contains links to Office 365 Security & Compliance. [View the compliance and risk management solutions available in Microsoft 365](https://compliance.microsoft.com/solutioncatalog) ++- [Search the audit log](https://compliance.microsoft.com/auditlogsearch?viewid=Search) +- [Create a DLP policy](https://compliance.microsoft.com/datalossprevention?viewid=policiesn) +- [View DLP policy match reports](https://compliance.microsoft.com/reports/dlppolicymatchesreport) +- [Create a retention policy](https://compliance.microsoft.com/informationgovernance?viewid=retention) +- [Create an eDiscovery case](https://compliance.microsoft.com/classicediscovery) +- [Create an alert](https://compliance.microsoft.com/compliancealerts) ++## Notifications ++For the "Display device notifications to users when OneDrive files are shared with them" setting, Go to the <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings page in the new SharePoint admin center</a>, and select the OneDrive **Notifications** setting. ++| Classic | New | +|:--|:--| +|| | ++For info about the "E-mail OneDrive owners when" settings, refer to the following table. ++| Classic | New | +|:--|:--| +|Other users invite additional external users to shared files <br/> |This setting is available in PowerShell (`Set-SPOTenant -NotifyOwnersWhenItemsReshared`). <br/> | +|External users accept invitations to access files <br/> |This setting no longer works for the new sharing experience that appears in most places. <br/> | +|An anonymous access link is created or changed <br/> |This setting is available in PowerShell (`Set-SPOTenant -OwnerAnonymousNotification`). <br/> | ++## Data migration ++This page redirects to the <a href="https://go.microsoft.com/fwlink/?linkid=2185075" target="_blank">Migration page in the new SharePoint admin center</a>. [Learn about migrating content to Microsoft 365](/sharepointmigration/migrate-to-sharepoint-online). ++## Geo locations ++Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Geo locations page in the new SharePoint admin center</a>. ++| OneDrive admin center | SharePoint admin center | +|:--|:--| +||| |
| SharePoint | Find Your Office 365 Tenant Id | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/find-your-office-365-tenant-id.md | + + Title: "Find your Microsoft 365 tenant ID" +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Adm_O365 +- onedrive-toc +search.appverid: +- MET150 +- BCS160 ++- Strat_OD_admin +- M365-collaboration +ms.assetid: 6891b561-a52d-4ade-9f39-b492285e2c9b +description: "Learn how to find the Microsoft 365 tenant ID." +++# Find your Microsoft 365 tenant ID ++Your Microsoft 365 tenant ID is a globally unique identifier (GUID) that is different than your organization name or domain. You may need this identifier when you configure OneDrive policies. + +**To find your Microsoft 365 tenant ID in the Azure AD admin center** ++Your tenant ID can be found in the **Tenant ID** box on the [Properties page](https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties). ++ + +> [!NOTE] +> For info about finding your tenant ID by using PowerShell instead, first read [Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2?view=azureadps-2.0&preserve-view=true) and then use [Get-AzureADTenantDetail](/powershell/module/azuread/Get-AzureADTenantDetail). |
| SharePoint | Ideal State Configuration | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/ideal-state-configuration.md | + + Title: "Recommended sync app configuration" +++++audience: ITPro +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +ms.assetid: b664e743-ae8b-4a93-aefd-1b20c584a93a +description: "View our recommendations for deploying and configuring the OneDrive sync app." +++# Recommended sync app configuration ++For the best performance, reliability, and user experience, follow these "ideal state" recommendations when you configure the OneDrive sync app. +++|</br>Updates and rings |</br>Windows Notification Service | </br>Files On-Demand and Storage Sense | <br>Office integration |</br>Silent account configuration |</br>Known Folder Move| +||||||| +|Allow traffic. Select some people for the Insiders ring and leave the rest in Production | Allow traffic | Keep Files On-Demand enabled and enable Storage Sense policies | Keep Office collaboration enabled | Enable the policy | Enable the policies | +++## Updates and rings ++- **Allow access to oneclient.sfx.ms and g.live.com**. Computers must be able to reach these URLs to apply updates and bug fixes, and enable or disable features. Updates are installed automatically, so you don't need to package and deploy them. Because OneDrive runs in the background, updates are also installed silently and don't impact users. +- **Use the Insiders and Production rings**. Select several people in your IT department as early adopters to join the Insiders ring and receive features early. Leave everyone else in the organization on the default Production ring to ensure they receive bug fixes and new features in a timely fashion. This recommendation applies even if you are on the Semi-Annual Enterprise Channel for Windows and Office. For more info about the rings, see [Sync app update process](sync-client-update-process.md). To set the update ring on Windows, see [Set the sync app update ring](use-group-policy.md#set-the-sync-app-update-ring). To set it on Mac, see [Deploy and configure the new OneDrive sync app for Mac](deploy-and-configure-on-macos.md#tier). ++## Windows Notification Service + +- **Make sure connection to the service is enabled**. Work with your network team to make sure proxies: ++ - Allow network traffic to bypass *.wns.windows.com + - Avoid HTTPS decryption for *.wns.windows.com. + + This applies to both Windows and Mac. [See the complete list of required URL and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#sharepoint-online-and-onedrive-for-business). ++## Files On-Demand and Storage Sense ++- **Keep Files On-Demand enabled**. OneDrive Files On-Demand helps users access all their files (individual or shared) without having to download them and use storage space. This setting is on by default for Windows 10 and Mac. To check this setting for Windows, see [Use OneDrive Files On-Demand](use-group-policy.md#use-onedrive-files-on-demand). To check it for Mac, see [Deploy and configure the new OneDrive sync app for Mac](deploy-and-configure-on-macos.md). +- **Use Storage Sense policies on PCs**. These policies let you automatically clean up "locally available" files users haven't explicitly pinned as "always available". [More info about Storage policies](/windows/client-management/mdm/policy-csp-storage) ++ +## Office integration ++- **Keep Office file collaboration enabled** Office uses differential sync to sync only changes instead of the entire file each time. This makes sync faster and reduces network bandwidth. This setting is on by default on Windows and Mac. For more info, see [Coauthor and share in Office desktop apps](use-group-policy.md#coauthor-and-share-in-office-desktop-apps). For info about this setting for Mac, see [Deploy and configure the new OneDrive sync app for Mac](deploy-and-configure-on-macos.md). ++## Silent account configuration ++- **Silently configure user accounts on PCs**. When you enable the silent account configuration policy, users are signed in automatically so they don't need to open OneDrive or enter their password. For more info, see [Use silent account configuration](use-silent-account-configuration.md). ++## Known Folder Move ++Windows users are familiar and comfortable with saving files to their Desktop, Documents, and Pictures folders from years of developing it as a habit. When you redirect and move these folders to OneDrive, users can continue saving files to these locations and they're backed up and available from any device. For more info, see [Redirect known folders](redirect-known-folders.md). ++- **On new PCs, enable the silent policy**. [Silently move Windows known folders to OneDrive](use-group-policy.md#silently-move-windows-known-folders-to-onedrive) +- **On existing PCs, gradually enable the prompt and/or silent policy**. [About the Known Folder Move Group Policy objects](redirect-known-folders.md#about-the-known-folder-move-policies) +++ |
| SharePoint | Onedrive Content Updates | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/includes/onedrive-content-updates.md | +<!-- This file is generated automatically each week. Changes made to this file will be overwritten.--> ++++## Week of August 15, 2022 +++| Published On |Topic title | Change | +|||--| +| 8/16/2022 | [OneDrive sync reports in the Apps Admin Center](/OneDrive/sync-health) | modified | +| 8/19/2022 | [Redirect and move macOS known folders to OneDrive](/OneDrive/redirect-known-folders-macos) | added | +| 8/19/2022 | [Install the sync app per-machine (Windows)](/OneDrive/per-machine-installation) | modified | +| 8/19/2022 | [Redirect and move Windows known folders to OneDrive](/OneDrive/redirect-known-folders) | modified | +| 8/20/2022 | [Overview of OneDrive Sync admin reports in the Microsoft 365 Apps admin center](/OneDrive/sync-health) | modified | +| 8/20/2022 | [OneDrive sync reports in the Apps Admin Center](/OneDrive/sync-health) | modified | +++## Week of July 25, 2022 +++| Published On |Topic title | Change | +|||--| +| 7/29/2022 | [Use OneDrive policies to control sync settings](/OneDrive/use-group-policy) | modified | +++## Week of July 18, 2022 +++| Published On |Topic title | Change | +|||--| +| 7/18/2022 | Sync | removed | |
| SharePoint | Information Barriers Onedrive | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/information-barriers-onedrive.md | + + Title: "Use information barriers with OneDrive" +description: "Learn about associating segments with a OneDrive, and what happens when segments are associated with a OneDrive." +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- tier2 +- purview-compliance +- M365-collaboration ++search.appverid: +- ODB160 +- ODB150 +- MET150 +++# Use information barriers with OneDrive ++[Microsoft Purview Information Barriers](/microsoft-365/compliance/information-barriers) are policies in Microsoft 365 that a compliance admin can configure to prevent users from communicating and collaborating with each other. This solution is useful if, for example, one division is handling information that shouldn't be shared with specific other divisions, or a division needs to be prevented, or isolated, from collaborating with all users outside of the division. Information barriers are often used in highly regulated industries and those organizations with compliance requirements, such as finance, legal, and government. ++For OneDrive, information barriers can determine and prevent the following kinds of unauthorized collaborations: ++- User access to OneDrive or stored content +- Sharing OneDrive or stored content with other users ++## Information barriers modes and OneDrive ++When information barriers are enabled on SharePoint and OneDrive, the OneDrive of segmented users are automatically protected with IB policies. [Information barriers modes](/microsoft-365/compliance/information-barriers-policies#step-6-information-barriers-modes) help strengthen access, sharing, and membership of a OneDrive site based on its IB mode and segments associated with the OneDrive. ++When using information barriers with OneDrive, the following IB modes are supported: ++| **Mode** | **Description** | +|:- |:-| +| **Open** | When a non-segmented user provisions their OneDrive, the site's IB mode is set as Open, by default. There are no segments associated with the site. | +| **Owner Moderated** | When a OneDrive is used for collaboration with incompatible users in the presence of the site owner/moderator, the OneDrive's IB mode can be set as Owner Moderated. See [this section](#manage-the-ib-mode-of-a-users-onedrive-preview) for details on Owner Moderated site. | +| **Explicit** | When a segmented user provisions their OneDrive within 24 hours of enablement, the site's IB mode is set as *Explicit* by default. The user's segment and other segments that are compatible with the user's segment and with each other get associated with the user's OneDrive. | +| **Mixed (preview)** | When a segmented user's OneDrive is allowed to be shared with unsegmented users, the site's IB mode can be set as *Mixed*. This is an opt-in mode that the SharePoint admin can set on OneDrive of a segmented user. | ++>[!NOTE] +>Starting July 12, 2022, *Inferred* mode has changed to *Mixed* mode. The functionality for the mode remains the same. ++## Sharing files from OneDrive ++### Open ++When a OneDrive has no segments and IB mode as *Open*: ++- The user can share files and folders based on the information barrier policy applied to the user and the sharing setting for the OneDrive. ++### Owner Moderated ++When a site has information barriers mode is set to *Owner Moderated*: ++- The option to share with *Anyone with the link* is disabled. +- The option to share with *Company-wide link* is disabled. +- The site and its content can be shared with existing members. +- The site and its content can be shared only by the OneDrive owner per their IB policy. ++### Explicit ++When a OneDrive has information barriers segments and the mode is set to *Explicit*: ++- The option to share with *Anyone with the link* is disabled. +- The option to share with *Company-wide link* is disabled. +- Files and folders can be shared only with users whose segment matches that of the OneDrive. ++### Mixed (preview) ++When a OneDrive has information barriers segments and the mode is set to *Mixed*: ++- The option to share with Anyone with the link is disabled. +- The option to share with Company-wide link is disabled. +- Files and folders can be shared with users whose segment matches that of the OneDrive and unsegmented users in the tenant. ++## Accessing shared files from OneDrive ++### Open mode ++For a user to access content in a OneDrive that has no segments associated and IB mode as *Open*: ++- The files must be shared with the user. ++### Owner Moderated mode ++For a user to access a SharePoint site with site's information barriers mode is set to *Owner Moderated*: ++- The user has site access permissions. ++### Explicit mode ++For a user to access content in a OneDrive that has segments and the IB mode set to *Explicit*: ++1. The user's segment must match a segment that is associated with the OneDrive. ++ AND ++2. The files must be shared with the user. ++>[!NOTE] +>By default, non-segment users can access shared OneDrive files only from other non-segment users with IB modes as *Open*. They can't access shared files from OneDrive that have segment(s) applied and the IB mode is *Explicit*. ++### Mixed mode (preview) ++For a segmented user to access content in a OneDrive that has segments and the IB mode set as *Mixed*: ++1. The user's segment must match a segment that is associated with the OneDrive. ++ AND ++2. The files must be shared with the user. ++For an unsegmented user to access content in a OneDrive that has segments and the IB mode set as *Mixed*: ++- The user must have site access permissions. ++## Example scenario ++The following example illustrates three segments in an organization: HR, Sales, and Research. An information barrier policy has been defined that blocks communication and collaboration between the Sales and Research segments. ++ ++With information barriers in OneDrive, when a segment is applied to a user, within 24 hours that segment is automatically associated with the user's OneDrive. Other segments that are compatible with the user's segment and with each other will also get associated with the OneDrive. A OneDrive can have up to 100 segments associated with it. A global or SharePoint admin can manage these segments using PowerShell, as described later in the section [Associate or remove additional segments on a user's OneDrive](#manage-segments-on-a-users-onedrive). ++The following table shoes the effects of this example configuration: ++| Components | HR users | Sales users | Research users | Non-segment users | +|:--|:|:|:|:| +| Segments associated with OneDrive | HR | Sales, HR | Research, HR | None | +| IB mode on OneDrive | Explicit | Explicit | Explicit | Open | +| OneDrive content can be shared with | HR only | Sales and HR | Research and HR | Anyone based on the sharing settings selected | +| OneDrive content can be accessed by | HR only | Sales and HR | Research and HR | Anyone with whom the content has been shared | ++## Enable SharePoint and OneDrive information barriers in your organization ++Enabling information barriers for SharePoint and OneDrive are configured in a single action. Information barriers for the services canΓÇÖt be enabled separately. To enable information barriers for OneDrive, see [Enable SharePoint and OneDrive information barriers in your organization](/sharepoint/information-barriers#enable-sharepoint-and-onedrive-information-barriers-in-your-organization). After you've enabled information barriers for SharePoint and OneDrive, continue with the OneDrive guidance in this article. ++## Prerequisites ++1. Make sure you meet the [licensing requirements for information barriers](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#information-barriers). +2. [Create information barrier policies](/office365/securitycompliance/information-barriers-policies) that allow or block communication between the segments and activate the policies. Create segments and define the users in each. +3. After you've configured and activated your information barrier policies, wait 24 hours for the changes to propagate through your organization. +4. Enable information barriers for OneDrive. Enabling information barriers for SharePoint and OneDrive are configured in a single action and these services canΓÇÖt be enabled separately. To enable information barriers for OneDrive, see the guidance and steps in the [Use information barriers with SharePoint](/sharepoint/information-barriers) article. +5. Complete the steps in the following sections to customize and manage information barriers for OneDrive in your organization. ++## Use PowerShell to view the segments associated with a OneDrive ++A global or SharePoint admin can view and change the segments associated with a user's OneDrive. ++1. Connect to the [Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell) as a global admin. ++2. Run the following command to get the list of segments and their GUIDs. ++ ```PowerShell + Get-OrganizationSegment | ft Name, EXOSegmentID + ``` ++3. Save the list of segments. ++ |**Name**|**EXOSegmentId**| + |:-|:| + | Sales | a9592060-c856-4301-b60f-bf9a04990d4d | + | Research | 27d20a85-1c1b-4af2-bf45-a41093b5d111 | + | HR | a17efb47-e3c9-4d85-a188-1cd59c83de32 | ++4. If not previously completed, [download](https://go.microsoft.com/fwlink/p/?LinkId=255251) and install the latest SharePoint Online Management Shell. If you installed a previous version of the SharePoint Online Management Shell, follow the instructions in the [Enable SharePoint and OneDrive information barriers in your organization](/sharepoint/information-barriers#enable-sharepoint-and-onedrive-information-barriers-in-your-organization) article. ++5. Connect to SharePoint as a [global admin or SharePoint admin](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++6. Run the following command: ++ ```PowerShell + Get-SPOSite -Identity <site URL> | Select InformationSegment + ``` ++ For example: ++ ```powershell + Get-SPOSite -Identity https://contoso-my.sharepoint.com/personal/John_contoso_onmicrosoft_com | Select InformationSegment + ``` ++## Manage segments on a user's OneDrive ++> [!WARNING] +> If the segments associated with a user's OneDrive don't match the segment applied to the user, the user won't be able to access their OneDrive. Be careful not to associate any segments with the OneDrive of a non-segment user. ++> [!NOTE] +> Any changes you make will be overwritten if the user's segment changes. ++To associate a segment with a OneDrive, run the following command in the SharePoint Online Management Shell. A OneDrive can have up to 100 associated segments. ++```PowerShell +Set-SPOSite -Identity <site URL> -AddInformationSegment <segment GUID> + ``` ++For example: ++```powershell +Set-SPOSite -Identity https://contoso-my.sharepoint.com/personal/John_contoso_onmicrosoft_com -AddInformationSegment 27d20a85-1c1b-4af2-bf45-a41093b5d111 +``` ++When you add segments to a OneDrive, the site's IB mode is automatically updated to *Explicit*. An error will appear if you attempt to associate a segment that isn't compatible with the existing segments on the OneDrive. ++To remove segment from a OneDrive, run the following command. ++```PowerShell +Set-SPOSite -Identity <site URL> -RemoveInformationSegment <segment GUID> + ``` ++For example: ++```powershell +Set-SPOSite -Identity https://contoso-my.sharepoint.com/personal/John_contoso_onmicrosoft_com -RemoveInformationSegment 27d20a85-1c1b-4af2-bf45-a41093b5d111 +``` ++If all the segments of a OneDrive site are removed, the IB mode of the OneDrive is automatically updated to *Open*. ++## Manage the IB mode of a user's OneDrive (preview) ++To view the IB mode of a OneDrive site, run the following command in the SharePoint Online Management Shell as a SharePoint admin or global administrator: ++```powershell +Get-SPOSite -Identity <site URL> | Select InformationBarriersMode +``` + +For example: ++```powershell +Get-SPOSite -Identity https://contoso-my.sharepoint.com/personal/John_contoso_onmicrosoft_com | Select InformationBarriersMode +``` ++A SharePoint admin or global administrator also has the ability to manage the IB mode of a OneDrive site to meet the needs of your organization with new IB modes: ++### Owner Moderated mode example ++Allow an incompatible segment user access to a OneDrive. For example, you want to allow HR user's OneDrive to be accessed by both Sales and Research segment users in your tenant. ++*Owner Moderated* is a mode applicable to OneDrive site that allows incompatible segment users access to OneDrive in the presence of a moderator/owner. Only the site owner has the capability to invite incompatible segment users on the same site. ++To update a OneDrive site IB mode to *Owner Moderated*, run the following PowerShell command: ++```powershell +Set-SPOSite -Identity <siteurl> InformationBarriersMode OwnerModerated +``` ++Owner Moderated IB mode canΓÇÖt be set on a site with segments. Remove the segments before setting the IB mode as Owner Moderated. Access to an Owner Moderated site is allowed for users who have site access permissions. Sharing of an Owner Moderated OneDrive and its contents is only allowed by the site owner per their IB policy. ++### Mixed mode example ++Allow unsegmented users to access OneDrive associated with segments. For example, you want to allow HR user's OneDrive to be accessed by HR segment and unsegmented users in your tenant. Mixed mode applicable to OneDrive site that allows segmented and unsegmented users access to OneDrive. ++To update a OneDrive site IB Mode to Mixed, run the following PowerShell command: ++```powershell +Set-SPOSite -Identity <siteurl> InformationBarriersMode Mixed +``` ++Mixed IB mode can't be set on a site without segments. Add segments before setting the IB mode as Mixed. ++## Effects of changes to user segments ++If a user's segment changes, the OneDrive's segment and IB mode will be automatically updated within 24 hours as described in the section above OneDrive information barriers ++Example 1: User's segment updated from Research to Sales, the user's OneDrive will be as follows within 24 hours: ++- Segment: Sales, HR +- IB mode: *Explicit* ++Example 2: User's segment updated from HR to None, the user's OneDrive will be as follows within 24 hours: ++- Segment: None +- IB mode: *Open* ++## Effects of changes to information barrier policies ++If a compliance administrator changes an existing policy, the change may impact the compatibility of the segments associated with the OneDrive. ++For example, segments that were once compatible may no longer be compatible. A SharePoint admin must change the segments associated with an affected site accordingly. Learn how to create an [information barriers policy compliance report in PowerShell](/sharepoint/info-barriers-report). ++If a policy changes after files are shared, the sharing links will work only if the user attempting to access the shared files has a segment applied that matches a segment associated with the OneDrive. ++## Auditing ++Audit events are available in the Microsoft Purview compliance portal to help you monitor information barrier activities. Audit events are logged for the following activities: ++- Enabled information barriers for SharePoint and OneDrive +- Applied segment to site +- Changed segment of site +- Removed segment of site +- Applied information barriers mode to site +- Changed information barriers mode of site +- Disabled information barriers for SharePoint and OneDrive ++For more information about OneDrive segment auditing in Office 365, see [Search the audit log in the compliance center](/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance#information-barriers-activities). ++## Resources ++- [Information barriers in Microsoft Teams](/microsoftteams/information-barriers-in-teams) +- [Information barriers in SharePoint](/sharepoint/information-barriers) |
| SharePoint | Install Previous Sync App | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/install-previous-sync-app.md | + + Title: "Install the previous OneDrive sync app" +++++audience: Admin +f1.keywords: +- NOCSH +++++ms.localizationpriority: high +description: "In this article, you'll learn how to install the previous OneDrive sync app (Groove.exe) for use with SharePoint Server." +++# Install the previous OneDrive sync app ++If your organization still uses SharePoint Server 2016 or earlier, users can't use the new OneDrive sync app (OneDrive.exe) to sync files. They need to use the previous OneDrive for Business sync app (Groove.exe). This article helps you install Groove.exe. If your organization uses SharePoint Server 2019, users should use the new OneDrive sync app (OneDrive.exe). [Learn more](/sharepoint/install/configure-syncing-with-the-onedrive-sync-app) ++> [!IMPORTANT] +> Support for the previous OneDrive for Business sync app (Groove.exe) with Microsoft 365 ended on January 11, 2021. Groove.exe will continue to work for files in SharePoint Server. [Learn how to transition to the new sync app](transition-from-previous-sync-client.md) ++## Install Groove.exe with Office 2016 ++The previous sync app (Groove.exe) is no longer installed by default with Office 2016 Click-to-run. You need to use a custom installation to extract OneDrive. ++1. Download the [Office Deployment Tool](https://www.microsoft.com/download/details.aspx?id=49117), and then save the file to your desktop. +2. From your desktop, double-click **OfficeDeploymentTool.exe**, and then extract the files to your desktop. + The following files will be displayed on your desktop: ++ - Setup.exe + - Configuration.xml ++3. Create a file named **AddODB.txt** as follows: ++ a. Start Notepad, and then paste the following text into a new file: ++ ```XML + <Configuration> + <Add SourcePath="http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/" OfficeClientEdition="32" > + <Product ID="O365BusinessRetail"> + <Language ID="en-us" /> + <ExcludeApp ID="Access" /> + <ExcludeApp ID="Excel" /> + <ExcludeApp ID="Lync" /> + <ExcludeApp ID="OneNote" /> + <ExcludeApp ID="Outlook" /> + <ExcludeApp ID="PowerPoint" /> + <ExcludeApp ID="Publisher" /> + <ExcludeApp ID="Word" /> + </Product> + </Add> + <Display Level="None" AcceptEULA="TRUE" /> + </Configuration> + ``` ++ > [!NOTE] + > This file will install the 32-bit US English edition of OneDrive. To install the 64-bit edition, change the value of OfficeClientEdition to 64. To install OneDrive in a different language, change the Language ID to a different language tag (ll-CC) by referring to the list of [Language identifiers](/DeployOffice/office2016/language-identifiers-and-optionstate-id-values-in-office-2016). ++ b. Save the file to your desktop, and name it **AddODB**. ++4. Open a command prompt as an administrator as follows: ++ a. Select **Start**. ++ b. In the **Start Search** box, enter **cmd**, and then press Ctrl+Shift+Enter. ++ c. If the **User Account Control** dialog box appears, confirm that the action displayed is what you want, and then select **Continue**. ++5. At the command prompt, navigate to the folder into which you extracted the Office Deployment tool. ++ ```DOS + cd /d %userprofile%\desktop + ``` + +6. Run the following command. ++ ```DOS + setup.exe /configure AddODB.txt + ``` + + > [!NOTE] + > The installation occurs silently in the background and can take 20 minutes or more to complete, depending on the speed of your Internet connection. Don't close the Command Prompt window during the installation. When the installation is completed, a new command line appears at the command prompt. ++7. Select **Start**. In the **Start Search** box, type **OneDrive**, and then start OneDrive. ++ > [!NOTE] + > After you set up OneDrive, you might not see sync icons on files until you restart your computer. ++8. Close the command prompt. You can now safely delete the following files from your desktop: ++ - OfficeDeploymentTool.exe + - Setup.exe + - Configuration.xml + - AddODB.txt ++## Install Groove.exe with Office 2013 ++To install the previous OneDrive for Business sync app with Office 2013, follow these steps. ++ > [!NOTE] + > If you have Office Professional Plus 2013, Office 365 Enterprise E3, Office 365 Midsize Business, or Office 365 Small Business Premium, then you already have the OneDrive sync app installed. ++1. Uninstall any earlier versions of the previous OneDrive for Business sync app. ++2. Select one of the installer links below to download the installer for your language and system edition. If the 32-bit or 64-bit edition of Office is already installed, you must select the same edition for OneDrive. ++|Language |32-bit download link |64-bit download link | +|||| +|Arabic |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ar-sa&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ar-sa&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Bulgarian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=bg-bg&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=bg-bg&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Chinese (Simplified) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=zh-cn&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=zh-cn&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Chinese (Traditional) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=zh-tw&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=zh-tw&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Croatian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hr-hr&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hr-hr&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Czech |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=cs-cz&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=cs-cz&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Danish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=da-dk&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=da-dk&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Dutch |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=nl-nl&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=nl-nl&platform=]x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|English |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=en-us&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=en-us&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Estonian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=et-ee&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=et-ee&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Finnish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=fi-fi&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=fi-fi&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|French |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=fr-fr&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=fr-fr&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|German |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=de-de&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=de-de&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Greek |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=el-gr&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=el-gr&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Hebrew |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=he-il&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=he-il&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Hindi |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hi-in&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hi-in&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Hungarian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hu-hu&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=hu-hu&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Indonesian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=id-id&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=id-id&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Italian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=it-it&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=it-it&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Japanese |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ja-jp&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ja-jp&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Kazakh |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=kk-kz&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=kk-kz&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15g) | +|Korean |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ko-kr&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ko-kr&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Latvian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=lv-lv&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=lv-lv&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Lithuanian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=lt-lt&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=lt-lt&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Malay(Malaysia) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ms-my&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ms-my&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Norwegian(Bokmal) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=nb-no&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=nb-no&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Polish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pl-pl&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pl-pl&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Portuguese(Brazil) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pt-br&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pt-br&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Portuguese(Portugal) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pt-pt&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=pt-pt&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Romanian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ro-ro&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ro-ro&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Russian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ru-ru&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15gaa) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=ru-ru&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Serbian(Latin) |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sr-latn-cs&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sr-latn-cs&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Slovak |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sk-sk&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sk-sk&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Slovenian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sl-si&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sl-si&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Spanish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=es-es&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=es-es&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Swedish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sv-se&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15gaga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=sv-se&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Thai |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=th-th&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=th-th&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Turkish |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=tr-tr&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=tr-tr&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Ukrainian |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=uk-ua&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=uk-ua&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | +|Vietnamese |[OneDrive for Business [32-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=vi-vn&platform=x86&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) |[OneDrive for Business [64-bit]](https://c2rsetup.officeapps.live.com/c2r/download.aspx?productreleaseid=grooveretail&language=vi-vn&platform=x64&token=3v9n8-w93cc-fqpb8-y9wvf-tvgj3&taxregion=pr&source=olsfcrequest&version=o15ga) | ++3. Run the downloaded file to start the Setup program. ++4. Follow the instructions to complete the installation. ++5. If you're asked to provide a license key, enter **3V9N8-W93CC-FQPB8-Y9WVF-TVGJ3**. ++ > [!NOTE] + > The OneDrive sync app ships together with two components that are not selected for installation by default. We recommend that you do not change these default settings. |
| SharePoint | Introduction | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/introduction.md | Title: "Introduction to SharePoint" + Title: "Introduction to SharePoint and OneDrive" -description: "Learn about SharePoint in Microsoft 365, which is a cloud-based service that helps organizations share and manage content, and collaborate with others." +description: "Learn about SharePoint and OneDrive in Microsoft 365, which are cloud-based services that help organizations share and manage content, and collaborate with others." -# Introduction to SharePoint in Microsoft 365 +# Introduction to SharePoint and OneDrive in Microsoft 365 -Microsoft SharePoint is a cloud-based service that helps organizations share and manage content, knowledge, and applications to: +SharePoint and OneDrive in Microsoft 365 are cloud-based services that helps organizations share and manage content, knowledge, and applications to: - Empower teamwork - Quickly find information - Seamlessly collaborate across the organization- -The resources on this page are designed to get you started. Depending on the needs of your organization, you may want to read about [migration](#migration) and [governance](#governance) options before you start rolling SharePoint out to your users. If you're ready to get started with SharePoint, read about [collaboration](#collaboration) options and how to create a [modern intelligent intranet](#modern-intranet). As you roll out SharePoint to your organization, remember to [train your users](#training) to help them get the most out of these tools. -If you're just starting out with SharePoint, learn about the [FastTrack onboarding and adoption services](https://fasttrack.microsoft.com/office), [find a SharePoint certified partner](https://products.office.com/sharepoint/sharepoint-partners-sharepoint-support), or [visit the SharePoint community](https://techcommunity.microsoft.com/t5/SharePoint/ct-p/SharePoint). +The resources on this page are designed to get you started. Depending on the needs of your organization, you may want to read about [migration](#migration) and [governance](#governance) options before you start rolling SharePoint and OneDrive out to your users. -Once you're using SharePoint, get the [OneDrive sync app](https://onedrive.live.com/about/download) and the [mobile app](https://products.office.com/sharepoint/mobile-app). +If you're ready to get started with SharePoint and OneDrive, read [Plan for SharePoint and OneDrive in Microsoft 365](plan-for-sharepoint-onedrive.md) and follow the planning and rollout articles that are listed in that article. ++If you're just starting out with SharePoint and OneDrive, learn about the [FastTrack onboarding and adoption services](https://fasttrack.microsoft.com/office), [find a SharePoint certified partner](https://products.office.com/sharepoint/sharepoint-partners-sharepoint-support), or [visit the SharePoint community](https://techcommunity.microsoft.com/t5/SharePoint/ct-p/SharePoint). ++Once you're using SharePoint and OneDrive, get the [OneDrive sync app](https://onedrive.live.com/about/download) and the [mobile app](https://products.office.com/sharepoint/mobile-app). ## Migration -If you have files that you need to move to SharePoint in Microsoft 365, the resources in this section can help you get started. +If you have files that you need to move to SharePoint and OneDrive, the resources in this section can help you get started. | If you're looking for this information: | Go to this resource: | |:--|:--|+|Learn how to include migration as part of your plan to roll out SharePoint and OneDrive|[Migration planning for SharePoint and OneDrive rollout](plan-rollout-migration.md)| |How to migrate content from file shares or other cloud providers using Migration Manager|[Migrate your content to Microsoft 365](/sharepointmigration/migrate-to-sharepoint-online)| |How to migrate SharePoint Server sites and content|[Overview of the SharePoint Migration Tool (SPMT)](/sharepointmigration/introducing-the-sharepoint-migration-tool)| If your organization has legal or other requirements that govern the handling of | If you're looking for this information: | Go to this resource: | |:--|:--|-|How to ensure that you retain files for a specified period of time, or delete them on a specified schedule|[Overview of retention policies](/microsoft-365/compliance/retention-policies)<br><br>[OneDrive retention and deletion](/onedrive/retention-and-deletion)| +|How to plan your compliance requirements for SharePoint and OneDrive |[Plan compliance requirements for SharePoint and OneDrive](compliant-environment.md)| +|How to ensure that you retain files for a specified period of time, or delete them on a specified schedule|[Overview of retention policies](/microsoft-365/compliance/retention-policies)<br><br>[OneDrive retention and deletion](retention-and-deletion.md)| |How to classify documents based on the sensitivity of the information|[Overview of sensitivity labels](/microsoft-365/compliance/sensitivity-labels)<br><br>[Enable sensitivity labels for Office files in SharePoint and OneDrive](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files)| |How to prevent the loss or exfiltration of important data in documents emails|[Learn data loss prevention](/microsoft-365/compliance/dlp-learn-about-dlp)| |Search for in-place items such as email, documents, and instant messaging conversations|[Content Search in Microsoft 365](/microsoft-365/compliance/content-search)| If you use OneDrive in your organization and you want to protect important files | If you're looking for this information: | Go to this resource: | |:--|:--|-|Protect important files on users' desktops or in their Documents folder|[Redirect and move Windows known folders to OneDrive](/onedrive/redirect-known-folders)| -|Control how users sync files to their devices|[Use Group Policy to control OneDrive sync settings](/onedrive/use-group-policy)| -|Configure the amount of storage space users have in OneDrive|[Set the default storage space for OneDrive users](/onedrive/set-default-storage-space)| +|Protect important files on users' desktops or in their Documents folder|[Redirect and move Windows known folders to OneDrive](redirect-known-folders.md) and [Redirect and move macOS Desktop and Documents folders to OneDrive](redirect-known-folders-macos.md)| +|Control how users sync files to their devices|[Use Group Policy to control OneDrive sync settings](use-group-policy.md) and [Deploy and configure the OneDrive sync app for Mac](deploy-and-configure-on-macos.md)| +|Configure the amount of storage space users have in OneDrive|[Set the default storage space for OneDrive users](set-default-storage-space.md)| ++## Microsoft Teams ++SharePoint is deeply integrated into Teams. Files that are stored in Teams are stored in SharePoint sites. When you administer SharePoint sites in the SharePoint admin center, you may find that many of them are connected to teams. Use these resources to understand how SharePoint and Teams are integrated. ++| If you're looking for this information: | Go to this resource: | +|:--|:--| +|Learn about how Teams and SharePoint work together|[Overview of Teams and SharePoint integration](teams-connected-sites.md)| +|Learn how to manage settings and permissions when Teams and SharePoint are integrated together|[Manage settings and permissions when SharePoint and Teams are integrated](manage-teams-sharepoint-experiences.md)| ## Collaboration -SharePoint provides a rich collaboration environment where people inside and outside your organization can work together, coauthoring document. Microsoft 365 provides a variety of options to help you create a secure and productive file collaboration environment that meets the needs of your organization. Use these resources to get started. +SharePoint and OneDrive provide a rich collaboration environment where people inside and outside your organization can work together, coauthoring documents. Microsoft 365 provides a variety of options to help you create a secure and productive file collaboration environment that meets the needs of your organization. Use these resources to get started. | If you're looking for this information: | Go to this resource: | |:--|:--| SharePoint provides a rich set of tools to help you create and maintain your org ## Training -Administrators are often called upon to teach others in the organization how to use new technologies. Use these resources to help your users be successful with SharePoint in Microsoft 365. +Administrators are often called upon to teach others in the organization how to use new technologies. Use these resources to help your users be successful with SharePoint and OneDrive. | If you're looking for this information: | Go to this resource: | |:--|:--|+|Get a list of training resources for your users|[Training and change management for rolling out SharePoint and OneDrive](training-change-management.md)| |Set up a customizable training portal with Microsoft training content for your organization|[Microsoft 365 learning pathways](/office365/customlearning/)|-|Show your users the basics of SharePoint|[SharePoint training](https://support.office.com/article/cb8ef501-84db-4427-ac77-ec2009fb8e23)| +|Show your users the basics of SharePoint|[SharePoint help & learning](https://support.office.com/sharepoint)| +|Show your users the basics of OneDrive|[OneDrove help & learning](https://support.office.com/onedrive)| ## Customization |
| SharePoint | Limit Access | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/limit-access.md | + + Title: "Limit access" ++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +ms.assetid: ++- admindeeplinkSPO +- onedrive-toc +description: "In this article, you'll learn how to all only users in specified security groups to access OneDrive." +++# Limit OneDrive access by security group ++Use this setting if you want to allow only users in specified security groups to access OneDrive. Even if other users outside of these security groups are licensed for OneDrive, they wonΓÇÖt have access to their own OneDrive or any shared OneDrive content. ++## Requirements ++To access and use this feature, your organization must have one of the following subscriptions: ++- Office 365 E5/A5 +- Microsoft 365 E5/A5 +- Microsoft 365 E5 Compliance/A5 Compliance ++## Enablement ++To enable this feature: ++1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185071" target="_blank">Access control in the SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. ++2. Select **Limit OneDrive access**. ++3. Select **Limit OneDrive access to only users in specified security groups**. ++  ++4. Add the security groups you want to be able to use OneDrive. ++5. Select **Save**. ++> [!NOTE] +> Users who aren't included in the security groups you added will lose access to their own OneDrive and any shared OneDrive content. |
| SharePoint | List Onedrive Urls | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/list-onedrive-urls.md | + + Title: "View the list of OneDrive URLs for users in your organization" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +search.appverid: +- SPO160 +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +++- seo-marvel-apr2020 +- onedrive-toc +ms.assetid: 8e200cb2-c768-49cb-88ec-53493e8ad80a +description: "In this article, you'll learn how to view the OneDrive URLs for users in your organization." +++# View the list of OneDrive URLs for users in your organization ++This article is for global and SharePoint admins in Microsoft 365 who want to confirm the OneDrive URLs for users in their organization. ++## About OneDrive URLs ++The URL for a user's OneDrive is usually in the following format: `https://<tenant name>-my.sharepoint.com/personal/<user principal name>`. For the user principal name (UPN), any special characters such as a period, comma, space, and the at sign ("@") are converted to underscores ("_"). See the following table for examples. ++|Domain |UPN |OneDrive URL | +|||| +|`onmicrosoft.com` | `rsimone@contoso.onmicrosoft.com` | `https://contoso-my.sharepoint.com/personal/rsimone_contoso_onmicrosoft_com` | +|custom | `rsimone@contoso.com` | `https://contoso-my.sharepoint.com/personal/rsimone_contoso_com` | ++Numbers or GUIDs might be appended to the URL if a conflict is detected, so it's always best to confirm a user's OneDrive URL if you need to specify it. ++> [!NOTE] +> Unless OneDrive accounts are [pre-provisioned](pre-provision-accounts.md), the URL isn't created until a user accesses their OneDrive for the first time. +> +> Also, the OneDrive URL will automatically change if the user's [UPN changes](upn-changes.md). For example, if the user changes their name or the domain name changes for a rebranding or business restructuring. + +## Use the OneDrive usage report to view the list of OneDrive users and URLs ++1. Go to the [OneDrive usage report in the Microsoft 365 admin center](https://admin.microsoft.com/#/reportsUsage/OneDriveSiteUsage) and sign in as a SharePoint admin, global admin, global reader, or reports reader. (If you see a message that you don't have permission to access the page, you don't have one of these roles in your organization.) + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), browse to **Reports** \> **Usage**. Under **OneDrive files**, select **View more**. ++2. Scroll to the table below the charts. ++  ++ If you see GUIDs in the table instead of URLs and names, go to the [Reports setting](https://admin.microsoft.com/Adminportal/Home?source=applauncher#/Settings/Services/:/Settings/L1/Reports) and clear the box **In all reports, display de-identified names for users, groups, and sites**. + +You can copy individual OneDrive URLs from the URL column. For easier searching and copying, export the table as a .csv file. In the upper left of the table, select **Export**. ++[Learn more about the Microsoft OneDrive usage report](/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww) + +## Use PowerShell to create a list of all the OneDrive URLs in your organization +<a name="BKMK_Step2"> </a> ++The list you create in these steps will be saved to a text file. + +1. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++2. Save the following text to a PowerShell file. For example, you could save it to a file named OneDriveSites.ps1. + + ```PowerShell + $TenantUrl = Read-Host "Enter the SharePoint admin center URL" + $LogFile = [Environment]::GetFolderPath("Desktop") + "\OneDriveSites.log" + Connect-SPOService -Url $TenantUrl + Get-SPOSite -IncludePersonalSite $true -Limit all -Filter "Url -like '-my.sharepoint.com/personal/'" | Select -ExpandProperty Url | Out-File $LogFile -Force + Write-Host "Done! File saved as $($LogFile)." + ``` ++3. Open the SharePoint Online Management Shell. Navigate to the directory where the script has been saved and run: ++ ```PowerShell + PS C:\>.\OneDriveSites.ps1 + ``` ++ > [!NOTE] + > If you get an error message about being unable to run scripts, you might need to change your execution policies. For info, see [About Execution Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies). + +4. The script will prompt you for the SharePoint admin center URL. For example, `https://contoso-admin.sharepoint.com` is the Contoso SharePoint admin center URL. ++5. You will then be prompted to sign in. Use a SharePoint admin or global admin account. ++After the script successfully completes, a text file is created in the location specified by the **$LogFile** variable in the script. This file contains a list of all OneDrive URLs in your organization. The following text provides an example of how the list of URLs in this file should be formatted. + +```https +https://contoso-my.sharepoint.com/personal/annb_contoso_onmicrosoft_com/ +https://contoso-my.sharepoint.com/personal/carolt_contoso_onmicrosoft_com/ +https://contoso-my.sharepoint.com/personal/esterv_contoso_onmicrosoft_com/ +https://contoso-my.sharepoint.com/personal/hollyh_contoso_onmicrosoft_com/ +``` ++Once you have the URL for a user's OneDrive, you can get more info about it by using the [Get-SPOSite](/powershell/module/sharepoint-online/get-sposite) cmdlet, and change settings by using the [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite) cmdlet. |
| SharePoint | Network Utilization Planning | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/network-utilization-planning.md | + + Title: "Network utilization planning for the OneDrive sync app" +++++audience: ITPro +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +ms.assetid: b664e743-ae8b-4a93-aefd-1b20c584a93a +description: "Learn how IT admins can estimate the network bandwidth that users will need to sync their files with the OneDrive sync app." +++# Network utilization planning for the OneDrive sync app ++This article is for IT admins planning to deploy the OneDrive sync app and wanting to estimate the network bandwidth users will need for syncing. If you're not an IT admin, follow the steps in this article to limit the network bandwidth used for syncing your files: [Change the OneDrive sync app upload or download rate](https://support.office.com/article/71cc69da-2371-4981-8cc8-b4558bdda56e). + +## Estimate the network bandwidth you need in your organization ++Follow these steps to estimate the bandwidth that will be used when you fully deploy the sync app. + +1. Assess the number of users and computers per user to which you'll deploy the sync app. Each installation multiplies the bandwidth used, so a user who has three syncing computers uses three times the bandwidth as a user who has a single syncing computer. + +2. [Assess the available bandwidth and network conditions](network-utilization-planning.md#AssessAvailableBandwidth). + +3. [Measure the network utilization of the sync app for a pilot group](network-utilization-planning.md#MeasureNetworkUtilization). + +When you deploy, [Control sync throughput](network-utilization-planning.md#ControlSyncThroughput). + +### Assess the available bandwidth and network conditions +<a name="AssessAvailableBandwidth"> </a> ++You can use third-party speed test tools, like Wireshark or Fiddler, to understand the actual download and upload throughput that the users experience. + +Packet loss, latency, and other factors can also impact OneDrive upload and download experience. For example, a high-latency network or network experiencing a lot of loss could result in a degraded OneDrive upload and download experience even on high-bandwidth networks (1000 Mbps, for example). The loss and latency will likely vary based on the number of users that are on the same network and what those users are doing (like downloading or uploading large files). + +The bandwidth used by the sync app is predominantly file upload and download traffic and is usually closely correlated with file size and the number of files being synced. Therefore, the bandwidth used depends on the number of files in the user's OneDrive and in SharePoint document libraries they choose to sync, multiplied by the size of files, and then by the rate of change of any file. Other sync app traffic (such as checking for file changes and checking for app updates) is minimal. + +### Measure the network utilization of the sync app for a pilot group +<a name="MeasureNetworkUtilization"> </a> ++When you create a pilot group, make sure the users are representative of the different profiles of people in your organization as well as the different geographic locations. To establish a group: + +- Estimate the number of files, typical file sizes, file types, total size of each library, how frequently files are modified, and how frequently new files are added. + +- Evaluate network utilization during each sync state as described below. + +- Use the measurements from the pilot group to extrapolate the entire organization's needs and re-test to validate the estimations. Each organization is different. + +#### Initial deployment and initial sync of team sites ++When users download locations for the first time, bandwidth usage will spike. To avoid this spike, enable [Learn about OneDrive Files On-Demand](https://support.office.com/article/0e6860d3-d9f3-4971-b321-7092438fb38e). This allows users to browse their files in File Explorer without downloading them. + +The following image illustrates the network utilization over time with Files On-Demand enabled and not enabled. + + + +#### Operational sync ++After the initial sync is complete, the network usage will decrease and then level out. ++The OneDrive sync app provides differential sync for all file types stored in OneDrive and SharePoint. Differential sync enables the sync app to sync only the parts of large files that have changed, instead of the entire file. During everyday usage, when users change files, only the changes are uploaded or downloaded and not the whole file. This makes the file synchronization process faster for these files. It reduces the time it takes to upload and download the file as well as the bandwidth sync consumes. ++> [!NOTE] +> Windows Notification Service or WNS plays an important role in efficient network utilization. Instead of the sync app constantly pulling to check for remote changes, WNS ensures that any changes from the cloud get pushed down to the device as fast as possible. It saves both network bandwidth and device battery life. This benefits both Windows and macOS. Make sure the connection to the service is enabled. Work with your network team to make sure proxies allow network traffic to bypass \*.wns.windows.com and avoid HTTPS decryption for \*.wns.windows.com. ++A spike in upload traffic is expected if you deploy the Known Folder Move setting in your organization. If your organization is large and your users have a lot of files in their known folders, make sure you roll out the policies slowly to minimize the network impact of uploading files. For detailed deployment guidance on Known Folder Move, see [Redirect and move Windows known folders to OneDrive](./redirect-known-folders.md). + +## Control sync throughput +<a name="ControlSyncThroughput"> </a> ++If you need to control sync app traffic, we recommend using network throughput policies provided by the OneDrive sync app. You can also use your network quality of service (QoS) policies or Windows QoS policies, or let users choose their throughput settings. For info about the network settings you can make available to your users, see [Change the OneDrive sync app upload or download rate](https://support.office.com/article/71cc69da-2371-4981-8cc8-b4558bdda56e). ++### Use OneDrive policies ++You can use policies included with the OneDrive sync app to control network throughput. These policies are available in the OneDrive installation directory `%localappdata%\Microsoft\OneDrive\BuildNumber\adm\` where `BuildNumber` is the number displayed in sync app settings on the About tab. + +For info about these policies, see: ++ - [Enable automatic upload bandwidth management for OneDrive](use-group-policy.md#enable-automatic-upload-bandwidth-management-for-onedrive) - Recommended for best user experience ++ - [Limit the sync app upload speed to a fixed rate](use-group-policy.md#limit-the-sync-app-upload-speed-to-a-fixed-rate) + + - [Limit the sync app download speed to a fixed rate](use-group-policy.md#limit-the-sync-app-download-speed-to-a-fixed-rate) + + - [Limit the sync app upload rate to a percentage of throughput](use-group-policy.md#limit-the-sync-app-upload-rate-to-a-percentage-of-throughput) + +### Prioritize traffic by using Windows Quality of Service (QoS) policy ++To define the priority of outbound network traffic, you can configure a QoS policy with a specific differentiated services code point (DSCP) value. Network routers use the DSCP value to classify network packets and determine the appropriate queue. A higher value indicates a higher priority for the packet. The number of queues and their prioritization behavior needs to be designed as part of your organization's QoS strategy. ++To manage the use of network bandwidth, you can configure a QoS policy with a specific throttle rate for outbound traffic. With throttling, a QoS policy will limit the outgoing network traffic to a specified rate. + +1. Open the Group Policy Management Console. + +2. Browse to the location where you want to create the new policy. For example, if all your client computers are located in an OU (Organizational Unit) named "Clients" then the new policy should be created in the "Clients" OU. + +3. Right-click the location, select **Create a GPO in this domain**, and then select **Link it here**. + +4. In the **New GPO** dialog, enter a name for the new Group Policy object in the **Name** box (for example, "OneDrive sync app") and then select **OK**. + +5. Right-click the policy, and then select **Edit**. + +6. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, right-click **Policy-based QoS**, and then select **Create new policy**. + +7. In the **Policy-based QoS** dialog, enter a name for the new policy in the **Name** box (for example, "OneDrive sync app"). + +8. Select **Specify DSCP Value** and set the appropriate value between 0 and 63 based on your organization's QoS strategy. + +9. In the **Outbound Throttle Rate** box, enter a rate in KBps, and select **Next**. + +10. Select **Only applications with this executable name** and to apply the QoS policy to only the OneDrive sync app process, enter "onedrive.exe". Select **Next**. + +11. Make sure that both **Any source IP address** and **Any destination IP address** are selected, and then select **Next**. These two settings ensure that packets will be managed regardless of which computer (IP address) sent those packets and which computer (IP address) will receive those packets. + +12. In the **Select the protocol this QoS policy applies to** list, select **TCP**. Leave **from any source port** and **to any destination** selected. ++13. Select **Finish**. + +## See also +<a name="ControlSyncThroughput"> </a> ++[Network planning and performance tuning for Microsoft 365](/office365/enterprise/network-planning-and-performance) |
| SharePoint | Per Machine Installation | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/per-machine-installation.md | + + Title: Install the sync app per-machine (Windows) +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Adm_O365 +- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- MET150 +- BCS160 ++- Strat_OD_admin +- M365-collaboration +ms.assetid: 6891b561-a52d-4ade-9f39-b492285e2c9b +description: In this article, you'll learn how to install the OneDrive sync app once for a Windows PC with multiple users. +++# Install the sync app per-machine ++By default, the OneDrive sync app installs per-user, meaning that you'll need to install the app for each user on a machine. With the per-machine installation option, you'll only need to install the app once on a PC. This option is especially useful for computers with multiple users and for when you don't want executable files running from a user profile. ++Other than where the sync app is installed, the behavior is the same. ++**Updates** ++The OneDrive sync app with the installation option of either per-machine or per-user both use the [same release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0), support the same update rings, and update in the same time-frame. [More info about the sync app update process](sync-client-update-process.md). ++If you're moving from per-user to per-machine, update settings aren't affected. ++## Requirements ++The per-machine installation's system requirements will be the same as the per-user installation. ++The per-machine installation option supports syncing OneDrive and SharePoint files in Microsoft 365 and in SharePoint Server 2019. ++The per-machine installation option provides automatic transitioning from the [previous OneDrive for Business sync app (Groove.exe)](transition-from-previous-sync-client.md). ++## Deployment instructions ++1. Download OneDriveSetup.exe. +2. Run "OneDriveSetup.exe /allusers" from a command prompt window (this will result in a User Account Control prompt) or by using Microsoft Endpoint Configuration Manager. ++While the per-user option installs OneDrive for each user account on a PC under the %localappdata% folder, the per-machine option will install OneDrive under the "Program Files (x86)" or "Program Files" directory (depending on the OS architecture). ++When setup completes, OneDrive will start. If accounts were added on the computer, they'll be migrated automatically. ++## Verify per-machine installation ++To verify that you have the per-machine installation, you can use the following registry detection rule in Configuration ++|Field|Value| +||| +|Hive|HKEY_LOCAL_MACHINE| +|Key|SOFTWARE\Microsoft\OneDrive| +|Name|Version| +|32bit on 64bit| TRUE| +|Type|REG_SZ| +|Value|19.043.0304.0007| ++## Revert back to the per-user sync app ++We don't support automated migration from per-machine to per-user. To revert back after installing per-machine, uninstall the sync app and [install the latest released version](https://go.microsoft.com/fwlink/?linkid=844652) without the "/allusers" parameter. |
| SharePoint | Pre Provision Accounts | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/pre-provision-accounts.md | + + Title: "Pre-provision OneDrive for users in your organization" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +search.appverid: +- SPO160 +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 ++- Strat_OD_admin +- M365-collaboration +ms.assetid: ceef6623-f54f-404d-8ee3-3ce1e338db07 ++- seo-marvel-apr2020 +- onedrive-toc +description: "Learn how to use PowerShell to create OneDrive file storage for your users instead of waiting for the storage space to be automatically provisioned by the service." +++# Pre-provision OneDrive for users in your organization ++By default, the first time that a user browses to their OneDrive it's automatically created (provisioned) for them. In some cases, such as the following, you might want your users' OneDrive locations to be ready beforehand, or pre-provisioned: ++- Your organization has a custom process for adding new employees, and you want to create a OneDrive when you add a new employee. ++- Your organization plans to migrate from SharePoint Server on-premises to Microsoft 365. ++- Your organization plans to migrate from another online storage service. ++This article describes how to pre-provision OneDrive for your users by using PowerShell. ++- For info about setting the default storage size, see [Set the default storage space for OneDrive users](set-default-storage-space.md). ++- For info about the storage you get with each plan, see [OneDrive Service Description](/office365/servicedescriptions/onedrive-for-business-service-description). ++> [!IMPORTANT] +> The user accounts that you're pre-provisioning must be allowed to sign in and must also have a SharePoint license assigned. +> To provision OneDrive by using this cmdlet, you must be a global or SharePoint administrator and must be assigned a SharePoint license. +++> [!NOTE] +> If you're pre-provisioning OneDrive for a large number of users, it might take multiple days for the OneDrive locations to be created. ++## Pre-provision OneDrive for users ++1. If you're pre-provisioning OneDrive for many users, create a list of these users and save it as a file. For example, create a text file named Users.txt that contains: ++ ``` + user1@contoso.com + user2@contoso.com + user3@contoso.com + ``` ++2. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++3. Connect to SharePoint as a [global admin or SharePoint admin](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++ > [!NOTE] + > The PowerShell command Request-SPOPersonalSite works only for users who are allowed to sign in. If you've blocked users from signing in, you can allow them to sign in by running the PowerShell command **Set-MsolUser** using the text file you created in Step 1. + > + >```PowerShell + >Get-Content -path "C:\Users.txt" | ForEach-Object { Set-MsolUser -UserPrincipalName $_ -BlockCredential $False } + >``` ++4. Run the PowerShell command [Request-SPOPersonalSite](/powershell/module/sharepoint-online/request-spopersonalsite?view=sharepoint-ps&preserve-view=true), consuming the text file you previously created in Step 1. ++ ```PowerShell + $users = Get-Content -path "C:\Users.txt" + Request-SPOPersonalSite -UserEmails $users + ``` ++To verify that OneDrive has been created for your users, see [Get a list of all user OneDrive URLs in your organization](list-onedrive-urls.md). +++## Pre-provision OneDrive for all licensed users in your organization ++The following code snippet will pre-provision OneDrive in batches of 199. ++```PowerShell +$Credential = Get-Credential +Connect-MsolService -Credential $Credential +Connect-SPOService -Credential $Credential -Url https://contoso-admin.sharepoint.com ++$list = @() +#Counters +$i = 0 +++#Get licensed users +$users = Get-MsolUser -All | Where-Object { $_.islicensed -eq $true } +#total licensed users +$count = $users.count ++foreach ($u in $users) { + $i++ + Write-Host "$i/$count" ++ $upn = $u.userprincipalname + $list += $upn ++ if ($i -eq 199) { + #We reached the limit + Request-SPOPersonalSite -UserEmails $list -NoWait + Start-Sleep -Milliseconds 655 + $list = @() + $i = 0 + } +} ++if ($i -gt 0) { + Request-SPOPersonalSite -UserEmails $list -NoWait +} +``` ++## Related topics ++[Plan hybrid OneDrive](/SharePoint/hybrid/plan-hybrid-onedrive-for-business) |
| SharePoint | Prevent Installation | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/prevent-installation.md | + + Title: "Prevent users from installing the OneDrive sync app" ++++ Last updated : 06/21/2018+audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium +++- admindeeplinkSPO +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- MET150 +ms.assetid: b59cf952-f5a3-40ae-9159-36d5f869422c +description: "Learn how to hide the Sync button to prevent users from downloading and installing the new OneDrive sync app." +++# Prevent users from installing the OneDrive sync app ++The Sync button helps users install and set up the new OneDrive sync app. If you want to manage the rollout of the sync app to your organization, you can hide the Sync button on the OneDrive website to prevent your users from downloading the sync app themselves. + + **To prevent users from downloading the OneDrive sync app** + +1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">Settings in the new SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Sharing page. ++2. Select **Sync**. ++  ++3. Clear the **Show the Sync button on the OneDrive website** check box. + +4. Select **Save**. + +## See also ++[Use OneDrive policies to control sync settings](use-group-policy.md) |
| SharePoint | Redirect Known Folders Macos | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/redirect-known-folders-macos.md | + + Title: "Redirect and move macOS known folders to OneDrive" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +- m365initiative-healthyonedrive +- onedrive-toc ++search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +description: In this article, you'll learn how to redirect users' Desktop and Documents folders to OneDrive on macOS using Folder Backup (Known Folder Move). ++# Redirect and move macOS Desktop and Documents folders to OneDrive ++> [!NOTE] +> Folder Backup is available in the Insiders ring. Find out [how to set the update ring for the OneDrive sync app](use-group-policy.md#set-the-sync-app-update-ring) and [how we release updates through multiple rings](sync-client-update-process.md#how-we-release-updates-through-multiple-rings). ++This article is for IT admins managing the OneDrive sync app for macOS. + +There are two primary advantages of moving or redirecting macOS Desktop and Documents folders to Microsoft OneDrive for the users in your organization: + +- Your users can continue using the folders they're familiar with. They don't have to change their daily work habits to save files to OneDrive. ++- Saving files to OneDrive backs up your users' data in the cloud and gives them access to their files from any device. ++For these reasons, we recommend moving (redirecting) Desktop and Documents folders to OneDrive with Folder Backup if you're an enterprise or large organization. [See all our recommendations for configuring the sync app](ideal-state-configuration.md). Small or medium businesses may also find this useful, but keep in mind you'll need some experience configuring settings. For info about the end-user experience, see [Protect your files by saving them to OneDrive](https://support.office.com/article/d61a7930-a6fb-4b95-b28a-6552e77c3057). ++> [!NOTE] +> OneDrive sync for macOS runs natively on Apple silicon. This support is generally available starting with build 22.022. ++## Prepare to move Desktop and Documents folders on existing devices ++The [standalone OneDrive sync app](https://support.microsoft.com/office/845dcf18-f921-435e-bf28-4e24b95e5fc0#OSVersion=Mac) (not from the Mac App Store) is required for Folder Backup. This app requires Full Disk Access, which can be granted and deployed by IT admins. For more information, see [Configure device restriction settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-configure). ++We recommend that you upgrade to the latest available build before you deploy. ++<! +For information on issues that can prevent folders from being moved, see [Fix problems with folder protection](https://support.office.com/article/d61a7930-a6fb-4b95-b28a-6552e77c3057#BKMK_FixProblems). +> ++> [!IMPORTANT] +> If your organization is large and your users have a lot of files in their Desktop and Documents folders, make sure you roll out the configuration slowly to minimize the network impact of uploading files. For users who have a lot of files in their folders, consider using the setting [AutomaticUploadBandwidthPercentage](deploy-and-configure-on-macos.md#automaticuploadbandwidthpercentage) temporarily to minimize the network impact and then disable the setting once uploads are complete. ++### Folders redirected to other organizations ++If a userΓÇÖs Desktop and Documents folders are currently redirected to OneDrive in a different organization, redirecting to your organizationΓÇÖs OneDrive will create new Desktop and Documents folders and the user will see an empty desktop. The user will have to manually migrate files from the other organizationΓÇÖs OneDrive to OneDrive in your organization. We recommend that you disable the redirect to the other organization before redirecting to your organization if possible. + +## About the Folder Backup settings ++You can set OneDrive settings using software distribution tools such as [Microsoft Intune](/mem/intune/apps/apps-add-office365-macOS) as well as [Jamf Pro](https://www.jamf.com/products/jamf-pro/), [Munki](https://www.munki.org/), [AutoPkg](https://github.com/autopkg/autopkg), [Apple Remote Desktop](https://support.apple.com/guide/remote-desktop/welcome/mac), and [AppleScript](https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptX/AppleScriptX.html). You can also configure settings in a .plist file. For a full reference of available preferences and their settings, see [Deploy and configure the OneDrive sync app for macOS](deploy-and-configure-on-macos.md). ++For new machines, Folder Backup can be configured from the start, so all new files are uploaded to the cloud. This is great for organizations as it increases user engagement with OneDrive, and admins can easily protect files with enterprise-level security and compliance that comes built in. ++The following settings control the Folder Backup feature: + +- [Prompt users to move Desktop and Documents folders to OneDrive (KFMOptInWithWizard)](deploy-and-configure-on-macos.md#kfmoptinwithwizard) ++ Use **KFMOptInWithWizard** to give the users a call to action to move their Desktop and Documents macOS folders. ++ :::image type="content" source="media/redirect-macos-manage-folder-backup.png" alt-text="Screenshot of the dialog that prompts users to back up their important folders."::: ++ If users dismiss the prompt, a reminder notification will appear in the Sync Activity Center until they move all available folders. ++ :::image type="content" source="media/redirect-macos-folder-backup.png" alt-text="Screenshot of the notification that reminds users to protect their important folders."::: ++ > [!IMPORTANT] + > We recommend deploying the prompt setting for existing devices only, and limiting the deployment to 5,000 devices a day and not exceeding 20,000 devices a week between macOS and Windows. + +- [Silently move macOS Desktop and Documents folders to OneDrive (KFMSilentOptIn)](deploy-and-configure-on-macos.md#kfmsilentoptin) ++ Use **KFMSilentOptIn** to redirect and move folders to OneDrive without any user interaction. Move all the folders or select the desired individual folders. By default, the Desktop and Documents folders will be moved. After a folder is moved, the setting won't affect the folder again, even if the selection for the folder changes. ++ You can choose to display a notification to users after their folders have been redirected. ++ We also recommend using this setting together with **[KFMOptInWithWizard](deploy-and-configure-on-macos.md#kfmoptinwithwizard)**. If moving the Desktop and Documents folders silently does not succeed, users will be prompted to correct the error and continue. ++ > [!IMPORTANT] + > We recommend deploying the silent setting for existing devices and new devices while limiting the deployment of existing devices to 1,000 devices a day and not exceeding 4,000 devices a week between macOS and Windows. ++- [Prevent users from turning off Folder Backup (KFMBlockOptOut)](deploy-and-configure-on-macos.md#kfmblockoptout) ++ Use **KFMBlockOptOut** to force users to keep their Desktop and Documents folders directed to OneDrive. ++ > [!NOTE] + > Users can direct their Desktop and Documents folders by opening OneDrive sync app preferences, clicking the **Backup tab**, and then clicking **Manage Backup**. + +- [Prevent users from moving their macOS Desktop and Documents folders to OneDrive (KFMBlockOptIn)](deploy-and-configure-on-macos.md#kfmblockoptin) ++ Use **KFMBlockOptIn** to prevent users from moving their Desktop and Documents folders to any OneDrive account. ++For info about using the OneDrive sync settings, see [Deploy and configure the OneDrive sync app for macOS](deploy-and-configure-on-macos.md). |
| SharePoint | Redirect Known Folders | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/redirect-known-folders.md | + + Title: "Redirect and move Windows known folders to OneDrive" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +ms.assetid: e1b3963c-7c6c-4694-9f2f-fb8005d9ef12 +description: In this article, you'll learn how to redirect users' Documents folders or other known folders to OneDrive. +++# Redirect and move Windows known folders to OneDrive ++This article is for IT admins managing the OneDrive sync app. ++There are two primary advantages of moving or redirecting Windows known folders (Desktop, Documents, Pictures, Screenshots, and Camera Roll) to Microsoft OneDrive for the users in your domain: ++- Your users can continue using the folders they're familiar with. They don't have to change their daily work habits to save files to OneDrive. ++- Saving files to OneDrive backs up your users' data in the cloud and gives them access to their files from any device. ++For these reasons, we recommend moving (redirecting) known folders to OneDrive if you're an enterprise or large organization. [See all our recommendations for configuring the sync app](ideal-state-configuration.md). Small or medium businesses may also find this useful, but keep in mind you'll need some experience configuring policies. For info about the end-user experience, see [Protect your files by saving them to OneDrive](https://support.office.com/article/d61a7930-a6fb-4b95-b28a-6552e77c3057). ++## Prepare to move known folders on existing devices ++We recommend that you upgrade to the latest available build before you deploy. ++To check eligibility on existing devices, data volume, and item counts as you decide on a rollout plan, and to later monitor progress of the rollout, use the Known Folder Move PowerShell script. ++For information on issues that can prevent folders from being moved, see [Fix problems with folder protection](https://support.office.com/article/d61a7930-a6fb-4b95-b28a-6552e77c3057#BKMK_FixProblems). Note that Known Folder Move doesn't work for users syncing OneDrive files in SharePoint Server. ++> [!IMPORTANT] +> If your organization is large and your users have a lot of files in their known folders, make sure you roll out the configuration slowly to minimize the network impact of uploading files. For users who have a lot of files in their known folders, consider using the policy [Limit the sync app upload rate to a percentage of throughput](use-group-policy.md#limit-the-sync-app-upload-rate-to-a-percentage-of-throughput) temporarily to minimize the network impact and then disable the policy once uploads are complete. ++### Folders redirected to other organizations ++If a user's Documents, Pictures, or Desktop folders are currently redirected to OneDrive in a different organization, redirecting to your organizationΓÇÖs OneDrive will create new Documents, Pictures, or Desktop folders and the user will see an empty desktop. The user will have to manually migrate files from the other organizationΓÇÖs OneDrive to OneDrive in your organization. We recommend that you disable the redirect to the other organization before redirecting to your organization if possible. ++## About the Known Folder Move policies ++OneDrive policies can be set using Group Policy, [Intune Windows 10 Administrative Templates](configure-sync-intune.md), or by configuring registry settings. For a full reference of available policies and their registry settings, see [Use OneDrive policies to control sync settings](use-group-policy.md). ++The following policies control the Known Folder Move feature: ++- [Prompt users to move Windows known folders to OneDrive](use-group-policy.md#prompt-users-to-move-windows-known-folders-to-onedrive) ++ Use this setting to give the users a call to action to move their Windows known folders. ++ :::image type="content" source="media/kfm-prompt-windows.png" alt-text="Screenshot of the dialog that prompts users to back up their important folders."::: ++ If users dismiss the prompt, a reminder notification will appear in the activity center until they move all known folders or an error occurs with the move, in which case the reminder notification will be dismissed. ++ :::image type="content" source="media/redirect-windows-kfm.png" alt-text="Screenshot of the notification that reminds users to protect their important folders."::: ++ > [!IMPORTANT] + > We recommend deploying the prompt policy for existing devices only, and limiting the deployment to 5,000 devices a day and not exceeding 20,000 devices a week between macOS and Windows. ++- [Silently move Windows known folders to OneDrive](use-group-policy.md#silently-move-windows-known-folders-to-onedrive) ++ Use this setting to redirect and move known folders to OneDrive without any user interaction. Move all the folders or select the desired individual folders. After a folder is moved, the policy won't affect the folder again, even if the selection for the folder changes. ++ You can choose to display a notification to users after their folders have been redirected. ++ We also recommend using this setting together with [Prompt users to move Windows known folders to OneDrive.](use-group-policy.md#prompt-users-to-move-windows-known-folders-to-onedrive). If moving the known folders silently does not succeed, users will be prompted to correct the error and continue. ++ > [!IMPORTANT] + > We recommend deploying the silent policy for existing devices and new devices while limiting the deployment of existing devices to 1,000 devices a day and not exceeding 4,000 devices a week between macOS and Windows. ++- [Prevent users from turning off Known Folder Move](use-group-policy.md#prevent-users-from-redirecting-their-windows-known-folders-to-their-pc) ++ Use this setting to require users to keep their known folders directed to OneDrive. ++ > [!NOTE] + > Users can direct their known folders by opening OneDrive sync app settings, clicking the **Backup** tab, and then clicking **Manage backup**. ++- [Prevent users from moving their Windows known folders to OneDrive](use-group-policy.md#prevent-users-from-moving-their-windows-known-folders-to-onedrive) ++ Use this setting to prevent users from moving their known folders to any OneDrive account. ++For info about using the OneDrive policies, see [Use Group Policy to control OneDrive sync app settings](use-group-policy.md). ++## Transition from the Windows Folder Redirection Group Policy objects ++The OneDrive Known Folder Move Group Policy objects won't work if you previously used [Windows Folder Redirection Group Policy objects](/windows-server/storage/folder-redirection/deploy-folder-redirection) to redirect the Documents, Pictures, or Desktop folders to a location other than OneDrive. The OneDrive Group Policy objects won't affect the Music and Videos folders, so you can keep them redirected with the Windows Group Policy objects. Follow these steps to switch to using the Known Folder Move Group Policy objects. ++- If folders have been redirected to OneDrive using Windows Folder Redirection Group Policy: ++ 1. Disable the Window Folder Redirection Group Policy and make sure to leave the folder and contents on OneDrive. + 2. Enable KFM Group Policy. Known folders remain in OneDrive. ++- If folders have been redirected to a location on a local PC: ++ 1. Disable the Window Folder Redirection Group Policy and make sure to leave the folder and contents at the redirected location. + 2. Enable KFM Group Policy. Known folders move to OneDrive. ++- If folders have been redirected to a network file share: + + 1. [Use Migration Manager](/sharepointmigration/mm-get-started) to copy contents in the network file share location to a user's OneDrive, making sure that all contents go into the existing Documents, Pictures, or Desktop folders. ++ > [!NOTE] + > If Migration Manager will create the Documents, Pictures, or Desktop folders, ensure that **Preserve file share permissions** is not selected when performing the migration. ++ 2. Disable the Window Folder Redirection Group Policy and make sure to leave the folder and contents on the network file share. + 3. Enable KFM Group Policy. Known folders move to OneDrive and will merge with the existing Desktop, Documents, and Pictures folders, which contain all the file share content that you moved in the first step. |
| SharePoint | Required Urls And Ports | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/required-urls-and-ports.md | + + Title: "Required URLs and ports for OneDrive consumer" ++++ Last updated : 04/3/2018+audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++search.appverid: +- ODC160 +- MET150 ++ms.assetid: ce15d2cc-52ef-42cd-b738-d9c6f9b03f3a +description: "Learn the FQDNs and ports to include in your allowlists to let users use the consumer version of OneDrive." +++# Required URLs and ports for OneDrive ++ This reference article lists all endpoints used by the consumer version of Microsoft OneDrive. If your organization restricts computers on your network from connecting to the Internet, this article lists the Fully Qualified Domain Names (FQDNs) and ports that you should include in your outbound allowlists to ensure your computers can successfully use the consumer version of OneDrive. + +> [!IMPORTANT] +> Filtering internet traffic requires advanced networking knowledge and isn't suitable for all customers. + + **If you are looking for a listing of endpoints used by OneDrive in Microsoft 365, see [Microsoft 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges).** + +## Supported hosts and ports for OneDrive ++To use OneDrive, the following endpoints need to be accessible to client computers. + +|**Row**|**Destination host**|**Destination Port**| +|:--|:--|:--| +|1 <br/> |onedrive.com <br/> \*.onedrive.com <br/> onedrive.live.com <br/> login.live.com <br/> g.live.com <br/> spoprod-a.akamaihd.net <br/> \*.mesh.com <br/> p.sfx.ms <br/> oneclient.sfx.ms <br/> \*.microsoft.com <br/> fabric.io <br/> \*.crashlytics.com <br/> vortex.data.microsoft.com <br/> posarprodcssservice.accesscontrol.windows.net <br/> redemptionservices.accesscontrol.windows.net <br/> token.cp.microsoft.com/ <br/> tokensit.cp.microsoft-tst.com/ <br/> \*.office.com <br/> \*.officeapps.live.com <br/> \*.aria.microsoft.com <br/> \*.mobileengagement.windows.net <br/> \*.branch.io <br/> \*.adjust.com <br/> \*.servicebus.windows.net <br/> vas.samsungapps.com <br/> odc.officeapps.live.com <br/> login.windows.net <br/> login.microsoftonline.com <br/> |TCP 80, TCP 443 <br/> | +|2 <br/> |\*.files.1drv.com <br/> \*.onedrive.live.com <br/> \*.\*.onedrive.live.com <br/> storage.live.com <br/> \*.storage.live.com <br/> \*.\*.storage.live.com <br/> \*.groups.office.live.com <br/> \*.groups.photos.live.com <br/> \*.groups.skydrive.live.com <br/> favorites.live.com <br/> oauth.live.com <br/> photos.live.com <br/> skydrive.live.com <br/> api.live.net <br/> apis.live.net <br/> docs.live.net <br/> \*.docs.live.net <br/> policies.live.net <br/> \*.policies.live.net <br/> settings.live.net <br/> \*.settings.live.net <br/> skyapi.live.net <br/> snapi.live.net <br/> \*.livefilestore.com <br/> \*.\*.livefilestore.com <br/> storage.msn.com <br/> \*.storage.msn.com <br/> \*.\*.storage.msn.com <br/> |TCP 80, TCP 443 <br/> | |
| SharePoint | Restore Deleted Onedrive | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/restore-deleted-onedrive.md | + + Title: "Restore a deleted OneDrive" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- admindeeplinkSPO +- onedrive-toc +search.appverid: +- ODB160 +- MET150 +ms.assetid: e487f40d-5321-46a8-9504-92b600b65cb9 +description: Learn how to restore a deleted user's OneDrive when the deleted user no longer appears in the Microsoft 365 admin center. +++# Restore a deleted OneDrive ++When you delete a user in the Microsoft 365 admin center (or when a user is removed through Active Directory synchronization), the user's OneDrive will be retained for the number of days you specify in the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target="_blank">SharePoint admin center</a>. (For info, see [Set the default file retention for deleted OneDrive users](set-retention.md).) The default is 30 days. During this time, shared content can still be accessed by other users. At the end of the time, the OneDrive will be in a deleted state for 93 days and can only be restored by a global or SharePoint admin. ++For info about using Files Restore to restore a OneDrive to a previous point in time, see [Restore your OneDrive](https://support.office.com/article/fa231298-759d-41cf-bcd0-25ac53eb8a15). ++For info about restoring items from the recycle bin in OneDrive, see [Restore deleted files or folders](https://support.office.com/article/949ada80-0026-4db3-a953-c99083e6a84f). + +## Restore a deleted OneDrive when the deleted user no longer appears in the Microsoft 365 admin center ++If the user was deleted within 30 days, you can restore the user and all their data from the Microsoft 365 admin center. To learn how, see [Restore a user in Microsoft 365](/office365/admin/add-users/restore-user). If you deleted the user more than 30 days ago, the user will no longer appear in the Microsoft 365 admin center, and you'll need to use PowerShell to restore the OneDrive. + +1. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++2. Connect to SharePoint as a [global admin or SharePoint admin](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++3. Determine if the OneDrive is available for restore. ++ - If you know the URL of the OneDrive, run the following command: ++ ```PowerShell + Get-SPODeletedSite -Identity <URL> + ``` ++ A user's OneDrive URL is based on their username. For example, + `https://contoso-my.sharepoint.com/personal/user1_contoso_com`. You can find their username on the Active users (or Deleted users) page in the Microsoft 365 admin center. ++ - If you don't know the URL of the deleted OneDrive, run the following command: ++ ```PowerShell + Get-SPODeletedSite -IncludeOnlyPersonalSite | FT url + ``` ++ - If the OneDrive appears in the results, it can be restored. ++4. Restore the OneDrive to an active state: ++ ```PowerShell + Restore-SPODeletedSite -Identity <URL> + ``` ++5. Assign an administrator to the OneDrive to access the needed data: ++ ```PowerShell + Set-SPOUser -Site <URL> -LoginName <UPNofDesiredAdmin> -IsSiteCollectionAdmin $True + ``` ++For more info about these cmdlets, see [Get-SPODeletedSite](/powershell/module/sharepoint-online/get-spodeletedsite) and [Restore-SPODeletedSite](/powershell/module/sharepoint-online/restore-spodeletedsite). ++> [!NOTE] +> When a OneDrive is restored, it will continue to remain available until it's explicitly deleted. + +## Permanently delete a OneDrive ++After you recover the data you need from the OneDrive, we recommend that you permanently delete the OneDrive by running the following command: + +```PowerShell +Remove-SPOSite -Identity <URL> +Remove-SPODeletedSite -Identity <URL> +``` ++> [!CAUTION] +> When you permanently delete a OneDrive, you will not be able to restore it. + +## See also ++[OneDrive retention and deletion](retention-and-deletion.md) |
| SharePoint | Retention And Deletion | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/retention-and-deletion.md | + + Title: "OneDrive retention and deletion" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- MET150 +ms.assetid: ef883c48-332c-42f5-8aea-f0e2366c15f9 +description: Learn what happens to a user's OneDrive when the user's Office 365 account for the organization is deleted. ++- seo-marvel-apr2020 +- admindeeplinkSPO +- onedrive-toc +++# OneDrive retention and deletion ++This article describes how you can manage a user's OneDrive when you delete the user's Microsoft 365 account for your organization, and what steps happen automatically. + +## Deleting a user from the Microsoft 365 admin center ++When you delete a user from the Active users page in the Microsoft 365 admin center, you can choose what you want to do with the user's product licenses, email, and OneDrive. For more info, see [Delete a user from your organization](/office365/admin/add-users/delete-a-user). ++ ++If you give another user access to the OneDrive, that user will have 30 days by default to access and download the files they want to keep. (To change the retention time, see [Set the OneDrive retention for deleted users](set-retention.md).) They'll receive an email with a link to these instructions for accessing the deleted user's OneDrive: [Copy files from another user's OneDrive](https://support.office.com/article/7eb33f7d-6540-488f-afaf-56043828e47b.aspx). + +## Configure automatic access delegation ++By default, when a user is deleted, the user's manager is automatically given access to the user's OneDrive. Follow these steps to confirm that this automatic access delegation is enabled for your organization, and to set a secondary owner in case a user doesn't have a specified manager. If access delegation is disabled or a manager or secondary owner isn't set for a user, no one will have automatic access when the user is deleted or be warned that the OneDrive will be deleted. + +1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185077" target="_blank">More features in the new SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. ++ >[!Note] + >If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the More features page. ++2. Under **User profiles**, select **Open**. ++3. Under **My Site Settings**, select **Setup My Sites**. ++4. Next to **My Site Cleanup**, make sure **Enable access delegation** is selected. ++5. We recommend that you also specify a secondary owner account in the **My Site Cleanup** section. This account will be the appointed owner of the OneDrive if the user's manager isn't set in Azure AD. Email notifications will also be sent to the secondary owner account when the value is populated. ++6. Select **OK**. + +## The OneDrive deletion process ++1. A user is deleted from the Microsoft 365 admin center or is removed through Active Directory synchronization. ++2. The account deletion is synchronized to SharePoint. ++3. The OneDrive Clean Up Job runs, and the OneDrive is marked for deletion. The deleted user will appear in the Microsoft 365 admin center for 30 days. The default retention period for OneDrive is also 30 days, but you can change this in the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target="_blank">SharePoint admin center</a> (see [Set the OneDrive retention for deleted users](set-retention.md)) or by using the PowerShell cmdlet `SetSPOTenant -OrphanedPersonalSitesRetentionPeriod <int32>`. For more information about using this cmdlet, see [Set-SPOTenant](/powershell/module/sharepoint-online/set-spotenant). ++4. If a manager is specified for the deleted user, the manager will receive an email telling them they have access to the OneDrive, and that the OneDrive will be deleted at the end of the retention period. For info about specifying a user's manager in the Azure Active Directory admin center, see [Add or update a user's profile information](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal). ++ If a manager isn't specified for the user account, but a secondary owner was entered in the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target="_blank">SharePoint admin center</a>, the secondary owner will receive an email telling them they have access to the OneDrive, and that the OneDrive will be deleted at the end of the retention period. ++5. Seven days before the retention period expires, a second email will be sent to the manager or secondary owner as a reminder that the OneDrive will be deleted in seven days. ++6. After seven days, the OneDrive for the deleted user is moved to the site collection recycle bin, where it is kept for 93 days. During this time, users will no longer be able to access any shared content in the OneDrive. To restore the OneDrive, you need to use PowerShell. For info, see [Restore a deleted OneDrive](restore-deleted-onedrive.md). ++ > [!NOTE] + > The Recycle Bin is not indexed and therefore searches do not find content there. This means that an eDiscovery hold can't locate any content in the Recycle Bin in order to hold it. + +  ++> [!NOTE] +> Retention policies always take precedence to the standard OneDrive deletion process, so content included in a policy could be deleted before 30 days or retained for longer than the OneDrive retention. For more info, see [Overview of retention policies](/office365/securitycompliance/retention-policies). Likewise, if a OneDrive is put on hold as part of an eDiscovery case, managers and secondary owners will be sent email about the pending deletion, but the OneDrive won't be deleted until the hold is removed. <br>The retention period for cleanup of OneDrive begins when a user account is deleted from Azure Active Directory. No other action will cause the cleanup process to occur, including blocking the user from signing in or removing the user's license. For info about removing a user's license, see [Remove licenses from users in Microsoft 365 for business](/office365/admin/subscriptions-and-billing/remove-licenses-from-users). |
| SharePoint | Set Default Storage Space | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/set-default-storage-space.md | + + Title: "Set the default storage space for OneDrive users" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- ODB150 +- MET150 ++- seo-marvel-apr2020 +- admindeeplinkSPO +- onedrive-toc +ms.assetid: cec51d07-d7e0-42a3-b794-9c00ad0f0083 +description: "In this article, you'll learn how to change the default storage space for OneDrive users." +++# Set the default storage space for OneDrive users ++For most subscription plans, the default storage space for each user's OneDrive is 1 TB. Depending on your plan and the number of licensed users, you can increase this storage up to 5 TB. For info, see the [OneDrive service description](/office365/servicedescriptions/onedrive-for-business-service-description). If you change a user's license, the available storage space is updated automatically within 24 hours after they access OneDrive. + +If your organization has a qualifying Microsoft 365 subscription and five (5) or more users, you can change the storage space to more than 5 TB. To discuss your needs, contact Microsoft support. You must assign at least one license to a user before you can increase the default OneDrive storage space. The new storage limit is applied the next time a user accesses OneDrive. + +> [!NOTE] +> For help finding out which subscription you have, see [What Microsoft 365 Apps for business subscription do I have?](/office365/admin/admin-overview/what-subscription-do-i-have) ++## Set the default OneDrive storage space in the SharePoint admin center +This storage space setting applies to all new and existing users who are licensed for a qualifying plan and for whom you haven't set specific storage limits. (To check if a user has a specific storage limit, see the next section.) To change the storage space for specific users, see [Change a specific user's OneDrive storage space](change-user-storage.md). ++> [!WARNING] +> If you decrease the storage limit and a user is over the new limit, their OneDrive will become read-only. ++1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">**Settings** in the new SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Settings page. ++2. Select the OneDrive **Storage limit** setting. ++  + +3. In the **Default storage limit** box, enter the default storage amount (in GB), and then select **Save**. ++ > [!NOTE] + > The minimum storage is 1 GB. ++ +## Check if a user has the default storage limit or a specific limit ++1. Sign in to https://admin.microsoft.com as a global or SharePoint admin. (If you see a message that you don't have permission to access the page, you don't have Microsoft 365 admin permissions in your organization.) + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), sign in at https://login.partner.microsoftonline.cn/. Then select the Admin tile to open the admin center. + +2. In the left pane, select **Users** \> **Active users**. ++3. Select the user. ++4. Select the **OneDrive** tab. ++5. Next to "Storage used," look at the max value (for example, 3 GB **of 1024 GB**). + + +## Set the default OneDrive storage space using PowerShell ++1. [Download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++2. Connect to SharePoint as a [global admin or SharePoint admin](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). + +3. Run the following command: + + ```PowerShell + Set-SPOTenant -OneDriveStorageQuota <quota> + ``` ++ Where _\<quota\>_ is the value in megabytes for the storage space. For example, 1048576 for 1 TB or 5242880 for 5 TB. You can specify any value that you want, however, if you specify a value greater than that allowed by a given user's license, that user's storage space will be rounded down to the maximum value allowed by their license. + + To reset an existing user's OneDrive to the new default storage space, run the following command: + + ```PowerShell + Set-SPOSite -Identity <user's OneDrive URL> -StorageQuotaReset + ``` + + > [!NOTE] + > When you set site storage limits in PowerShell, you enter them in MB. The values are converted and rounded down to the nearest integer to appear in the admin centers in GB, so a value of 5000 MB becomes 4 GB. If you set a value of less than 1024 MB using PowerShell, it will be rounded up to 1 GB. ++## See also ++[More info about using Set-SPOTenant](/powershell/module/sharepoint-online/set-spotenant) |
| SharePoint | Set Retention | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/set-retention.md | + + Title: "Set the OneDrive retention for deleted users" +++++audience: Admin +f1.keywords: +- CSH +++- 'O365E_ODACStorage' +- 'seo-marvel-apr2020' +- admindeeplinkSPO +- onedrive-toc ++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- ODB150 +- MET150 +ms.assetid: fa1641ea-9f03-4f34-a826-dbd8697e76fe +description: "Learn how to specify how long the OneDrive files of deleted users are preserved. " +++# Set the OneDrive retention for deleted users ++If a user's Microsoft 365 account is deleted, their OneDrive files are preserved for a period of time. You can set this time period. + + **To set the retention time for OneDrive accounts** + +1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">**Settings** in the new SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), [sign in to the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=850627), then browse to the SharePoint admin center and open the Sharing page. ++2. Select the **Retention** setting. ++  + +3. Enter a value from 30 through 3650 in the **Days to retain files a deleted user's OneDrive** box. ++ The setting is activated for the next user that is deleted as well as any users that are in the process of being deleted. The count begins as soon as the user account was deleted in the Microsoft 365 admin center, even though the deletion process takes time. ++4. Select **Save**. ++## Related articles ++[Delete a user from your organization](/office365/admin/add-users/delete-a-user) + +[Set up OneDrive to alert managers and delegate access automatically when users leave your organization](retention-and-deletion.md) + +[Overview of retention policies](/office365/securitycompliance/retention-policies) |
| SharePoint | Sync Client Update Process | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/sync-client-update-process.md | + + Title: "The OneDrive sync app update process" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++search.appverid: +- ODB160 +- MET150 +ms.assetid: 2f748bc6-6f01-4406-a791-ec047f066d6d +description: "Learn about the Production and Deferred rings for OneDrive sync app updates" +++# The OneDrive sync app update process ++This article is for IT admins who manage the new OneDrive sync app (OneDrive.exe) in an enterprise environment. It explains how we release updates to the sync app for Windows and the standalone sync app for Mac through rings of validation, and how the sync app checks for updates. Note that if you deploy the sync app alongside Office (via the Office Deployment Tool or some other means), it will continue to check for updates independent of any Office update restrictions you set. + +> [!NOTE] +> If you allow your users to sync personal OneDrive accounts, the update process described in this article and any settings you select apply to all instances of the sync app. +> +> The sync app installed from the Mac App Store follows a separate update process. After we finish rolling out updates within the Production ring, we publish them to the Mac App Store, where they're immediately released to everyone. + +## How we release updates through multiple rings ++After we validate updates through rings within Microsoft, we release them to the first public ring, Insiders. To try these latest features, join the [Windows Insider program](https://insider.windows.com/) or the [Office Insider](https://products.office.com/office-insider) program. It takes about three days to roll out to this ring. Later, we release to organizations in the default update ring, Production. We roll them out to a small percentage of users in the ring at first, and slowly roll them out to everyone in the ring. This typically takes one to two weeks. At each increase along the way, we monitor telemetry for quality assurance purposes. In the rare case we detect an issue, we suspend the release, address the issue, and release a new update to users in the same order. After updates have completely rolled out within the Production ring, we release them to the next ring, Deferred. + + ++> [!IMPORTANT] +> We recommend selecting several people in your IT department as early adopters to join the Insiders ring and receive features early. We recommend leaving everyone else in the organization in the default Production ring to ensure they receive bug fixes and new features in a timely fashion. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) + +The Deferred ring provides builds that have been monitored throughout the Production rollout, so fewer releases are suspended. The Deferred ring also lets you as an admin: + +- Control when you deploy updates (within 60 days of their release). ++- Deploy new versions from an internal network location to avoid using Internet bandwidth. (If you don't deploy an update after 60 days, it will be automatically downloaded and installed.) ++However, as the slowest ring, the Deferred ring receives performance improvements, reliability fixes, and new features last. + +> [!NOTE] +> Microsoft reserves the right to bypass the 60-day grace period for critical updates. + +To learn how to set the Deferred ring for the Windows sync app using Group Policy, see [Set the sync app update ring](use-group-policy.md#set-the-sync-app-update-ring). To learn how to set it for the Mac sync app, see [Configure the new OneDrive sync app on macOS](deploy-and-configure-on-macos.md). For info about the Microsoft 365 update process, see [Overview of update channels for Microsoft 365 Apps for enterprise](/DeployOffice/overview-of-update-channels-for-office-365-proplus). For info about the Windows 10 update process, see [Build deployment rings for Windows 10 updates](/windows/deployment/update/waas-deployment-rings-windows-10-updates). + +## How the sync app checks for and applies updates ++The OneDrive sync app checks for available updates every 24 hours when it's running. If it has stopped and hasn't checked for updates in more than 24 hours, the sync app will check for updates as soon as it's started. Windows 10 also has a scheduled task that updates the sync app even when it's not running. + +To determine if an update is available, the OneDrive sync app checks if: + +- The latest version released to the update ring is higher than what's installed on the computer. If the installed version is too old to be updated to the current version, the sync app will first be updated to the minimum version within the ring. + +- The update is available to the computer based on the rollout percentage we set within the ring. + +If both of these are true, OneDrive downloads the update to a hidden folder without any user interaction. After the download is complete, OneDrive verifies and installs it. If OneDrive is running, it's stopped and then restarted. Users don't need to sign in again, and they don't need administrative rights to install the update. + +For info about the latest releases, see [New OneDrive sync app release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0). ++> [!NOTE] +> To apply sync app updates, computers in your organization must be able to reach the following: "oneclient.sfx.ms" and "g.live.com." Make sure you don't block these URLs. They are also used to enable and disable features and apply bug fixes. See [More info about the URLs and IP address ranges used in Microsoft 365](/office365/enterprise/urls-and-ip-address-ranges). + +## Deploying updates in the Deferred ring ++At any given time, the next planned Deferred ring release is published on the [OneDrive sync app release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0) page with a link to the corresponding installer and the target date when that version will be released. On the specified date, the "Rolling out" version for the Deferred ring becomes the new minimum. All sync apps below that version will automatically download the installer from the Internet and update themselves. ++To deploy an updated version of the sync app for Windows, run the following command using Microsoft Endpoint Configuration + +``` +Execute <pathToExecutable>\OneDriveSetup.exe /update /restart +``` ++Where pathToExecutable is a location on the local computer or an accessible network share and OneDriveSetup.exe is the target version downloaded from the release notes page. Running this command restarts OneDrive.exe on all computers. If you don't want to restart the sync app, remove the /restart parameter. See [Deploy using Microsoft Endpoint Configuration Manager](deploy-on-windows.md) for tips on how to set up the Microsoft Endpoint Configuration Manager deployment package. ++To deploy an updated version of the sync app for Mac, deploy the OneDrive.pkg with the target version by using your MDM solution. |
| SharePoint | Sync Health | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/sync-health.md | + + Title: "OneDrive sync reports in the Apps Admin Center" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +ms.assetid: e1b3963c-7c6c-4694-9f2f-fb8005d9ef12 +description: Learn how to proactively monitor OneDrive health, devices, and usage across an organization using the OneDrive sync reports. +++# OneDrive sync reports in the Apps Admin Center ++Use the OneDrive sync health dashboard in the Microsoft 365 [Apps Admin Center](https://config.office.com/) to get an executive summary of everything happening with OneDrive so that you can resolve common issues quickly and focus on other strategic tasks as an administrator. +++Proactively keeping OneDrive healthy helps ensure that your organization's information is protected. The dashboard provides you with sync health reports for tracking relevant health issues and advisories, checking the sync status and app version of individual devices, and monitoring Known Folder Move roll out. ++In this article, you'll learn how to set up and navigate the sync health dashboard to better manage your OneDrive users and increase OneDrive adoption. ++## Requirements ++Before getting started, be sure that you're familiar with the requirements needed to access the dashboard: ++- OneDrive sync apps on the Insiders or Production ring. Devices on the Deferred ring aren't eligible for the preview. [Set the sync app update ring](use-group-policy.md#set-the-sync-app-update-ring). ++- OneDrive sync app version 22.087 or later for Windows and macOS. ++- [Global Administrator](/microsoft-365/admin/add-users/about-admin-roles), Office Apps Administrator or Microsoft 365 Administrator role access is required to enable and set up the dashboard for your organization. After the feature is enabled by one of these roles, one can also view the dashboard using [Global reader](/microsoft-365/admin/add-users/about-admin-roles) or Reports reader access. To learn more about administrator roles and permissions in Microsoft 365, visit [About Admin Roles](/microsoft-365/admin/add-users/about-admin-roles). ++- Devices in your organization should allow connections to `https://clients.config.office.net`. ++> [!NOTE] +> This feature isnΓÇÖt available to customers who have the following plans: Office 365 operated by 21Vianet, Office 365 GCC, or Office 365 GCC High and DoD. ++## Set up the OneDrive sync health dashboard ++In this section, you'll learn how to set up sync reports on Windows and macOS devices. ++# [Windows](#tab/windows) ++This tab provides how-to steps for enabling sync reports on Windows devices. ++> [!NOTE] +> The previous Group Policy HKLM\SOFTWARE\Policies\Microsoft\OneDrive\SyncAdminReports is still supported and will continue to be supported for 60 days after General Availability is announced. We recommend that admins deploy the GPO now, to ensure a smooth transition at that time. ++1. Ensure you have the required role and app versions listed in the [previous section](#requirements). ++2. Go to [Microsoft 365 Apps admin center](https://config.office.com) and sign in as a global admin or Office apps admin. ++3. From the left navigation menu, select **Health** > **OneDrive Sync**. ++4. Select **Enable preview features** to accept the license terms. ++ :::image type="content" source="media/enable-preview.png" alt-text="Screenshot of enable preview features button."::: ++5. In the left navigation menu, select **Settings**. ++6. Verify that a **Tenant Association Key** is present in the text field. If the field is empty, select **Generate new key**. ++ :::image type="content" source="media/tenant-key-image.png" alt-text="Screenshot of Tenant Association Key under Preview setup."::: ++ > [!NOTE] + > When you generate a new key for the first time, it can take up to 30 seconds for it to appear. ++7. Enable the OneDrive EnableSyncAdminReports Group Policy Object (GPO). ++ > [!IMPORTANT] + > **You must enable this setting on the devices from which you want to get reports.** This setting has does not affect users. We recommend a gradual rollout starting with a few test devices per day, then up to 100 devices per day, then gradually up to 10,000 devices per day until you finish. ++ You can enable this setting in multiple ways: ++ - Edit the registry ++ a. Go to HKLM\SOFTWARE\Policies\Microsoft\OneDrive ++ b. Right-click > **New** > **DWORD (32-bit) Value** ++ c. Name: EnableSyncAdminReports ++ d. Type: REG_DWORD ++ e. Data: 1 ++ :::image type="content" source="media/createregkey.png" alt-text="Screenshot image depicting the creation of a new key in the Registry Editor"::: ++ - Run Command Prompt as an administrator, and then run the following command: ++ ```PowerShell + reg.exe add HKLM\Software\Policies\Microsoft\OneDrive /v EnableSyncAdminReports /t REG_DWORD /d 1 + ``` ++ - Use [Group Policy](use-group-policy.md#manage-onedrive-using-group-policy). ++ To apply the setting on a single PC, follow these steps: ++ - Open Group Policy Editor (gpedit.exe). ++ - Go to Computer Configuration\Administrative Templates\OneDrive. ++ - Choose **Enable sync health reporting for OneDrive**. ++ - Select **Enabled** and then press **OK**. ++> [!IMPORTANT] +> When you enable the EnableSyncAdminReports setting on devices, it can take up to three days for reports to be available. Devices will appear in the report after this time. Forcing a specific device to report data is unsupported. ++# [macOS](#tab/macos) ++This tab provides how-to steps for enabling sync reports on macOS devices. ++1. Ensure you have the required role and app versions listed in the [previous section](#requirements). ++2. Go to the [Microsoft 365 Apps admin center](https://config.office.com) and sign in as a global admin or Office apps admin. ++3. From the left navigation menu, select **Health** > **OneDrive Sync**. ++4. Select **Enable preview features** to accept the license terms. ++ :::image type="content" source="media/enable-preview.png" alt-text="Screenshot of enable preview features button."::: ++5. In the left navigation menu, select **Settings**. ++6. Confirm that a **Tenant Association Key** has been generated in the text field. ++7. Before proceeding, ensure that the OneDrive application has been quit. ++8. Create a.plist file with the key **EnableSyncAdminReports**. You can also use a script to set the key. The key is the same whether you run the standalone or Mac App Store edition of the sync app. However, the .plist file name and domain name will be different. When you apply the setting, ensure that you target the appropriate domain depending on the edition of the sync app. ++|| Standalone | Mac App Store | +|:--|:--|:--| +|**.plist location <br/>**|~/Library/Managed Preferences/com.microsoft.OneDrive.plist <br/> |~/Library/Managed Preferences/com.microsoft.OneDrive-mac.plist <br/> | +|**Domain <br/>**|com.microsoft.OneDrive <br/> |com.microsoft.OneDrive-mac <br/> | ++9. Use the Terminal app to deploy the EnableSyncAdminReports setting onto your local computer. ++ Enter the following preference key to enable the setting: +<br/>\<key\>EnableSyncAdminReports\</key\><br/>\<true/\> ++10. Refresh the preferences cache. ++11. On the next start of OneDrive, the new setting will be picked up. ++> [!IMPORTANT] +> After you enable the EnableSyncAdminReports setting on devices, it takes up to three days for reports to be available. ++++## Navigate the OneDrive Sync health dashboard ++In this section, you'l learn how to successfully navigate the OneDrive Sync health dashboard. Learn about the reporting insights available to you and how they can help you proactively manage OneDrive for your organization. ++Jump to: ++- [Overview](#overview) +- [Details](#details) +- [Issues](#issues) ++> [!NOTE] +> After you set up the dashboard as described in the previous section, the Global Reader admin role is sufficient to access and view reports. ++### Overview ++The **Overview** tab (the default view) shows a summary of devices that have at least one sync issue, a percentage of the devices in your organization using [Known folder move](redirect-known-folders.md), and the number of devices running on the current version of OneDrive. +++| Card name | Description | +|-|--| +|Sync errors | *Shows how many devices have sync errors or not.* <br> <br> Sorting through errors can help you proactively reach out to educate people while resolving common issues and improving user experience. Users may not report OneDrive issues to you immediately. Unreported issues could lead to unwanted problems while they're working on important tasks. With the **Sync errors** card, you won't have to wait to be notified by users to take action. | +| Known folders | *Shows a snapshot of the number of known folders currently in use.* <br><br> **Known Folder Move** allows people to keep their Desktop, Documents, and Pictures folders protected by syncing them to the cloud with OneDrive. If youΓÇÖre rolling out Known Folder Move for your organization, the **Known folders** card is a great way for you to monitor progress. | +| Sync app version | *Shows the number of devices running on the current version of OneDrive.* <br><br> Running the current version of OneDrive helps users stay up to date with all the latest and greatest fixes and features from Microsoft. Hover over the **Sync app version** card for a filtered view of operating systems on the current version. Note: Mac App store devices are excluded from this section and will appear in the count as "devices excluded". | +|| ++### Details ++The **Details** tab shows all users, their current health state, their known folders currently moved in OneDrive, their current app version and operating system version, a timestamp of the last time the app was fully up to date, and a timestamp of the last time the sync app reported health data to the dashboard. An icon and status in the **Errors** column indicate the state of each device. +++This table provides a summary of the information found in each column of the **Details** tab: ++| Column name | Description | +|-|--| +|User | The name of the user | +| User email | The user's email address | +| Device name | The device name | +| Errors | The health status of a device | +| Known folders | The name of folders moved to OneDrive | +| App version | The current version of OneDrive running on the device | +| Operating system | The current version of the OS running on the device | +| Last synced timestamp (UTC) | The last time that the sync app was fully up to date with the cloud | +| Last status reported timestamp (UTC) | The last time that the sync app reported health data to the dashboard | +|| ++Customize your view of which devices show up on the dashboard by using the filter option in the command bar. Standard filters include "all devices" where you can see every device and "devices with errors" where you'll only see devices with errors. ++You can easily create a custom filter with your own conditions. From the command bar, select **Filter** > **New filter** to open the **Custom filter** panel. Name your filter and select your desired conditions. If you'd like to filter by app version, be sure that you enter the complete sync app version number including periods. Afterwards, select **Create** to use your new filter. ++[ ](media/custom-filter-pane.png#lightbox) ++When someone in your organization reports a problem with syncing files to OneDrive, you can investigate quickly without having to ask for extra details of the error message via Microsoft Teams chat or Outlook email. Select a user to see more information on their device and sync status. This detailed view lets you see a user's essential OneDrive information including any errors they might be experiencing. +++### Issues ++The **Issues** tab shows you a list of OneDrive error messages found in the health report and the number of devices affected by them in your organization. Use this view to see if there are any common patterns between users and the errors present across your organization. +++You can learn more about the error and devices affected by selecting an error message from the list. The **Issues** panel will appear with a summary of the devices affected, along with a list of users and their current app version and operating system. Partner with your users to fix common OneDrive sync issues. +++To learn more about OneDrive error messages, see [What do the OneDrive error codes mean?](https://support.microsoft.com/office/what-do-the-onedrive-error-codes-mean-f7a68338-e540-4ebf-ad5d-56c5633acded). ++## Data for the OneDrive sync health dashboard ++The sync reports use health data that your OneDrive sync apps send to Microsoft. You have choices when it comes to the technology you use and the data you share. Use the EnableSyncAdminReports setting to manage which devices send data. ++To learn more about the controls available to you, see [Overview of privacy controls for Microsoft 365 Apps](/deployoffice/privacy/overview-privacy-controls). To learn more about required service data, see [Required service data for Office](/deployoffice/privacy/required-diagnostic-data). ++## Known limitations and considerations ++This section describes known limitations and considerations in sync reporting. ++**Limitations** ++**Device Records:** By default, device records are kept in inventory for 30 days, after which they expire from the report. ++**Folders in OneDrive:** Devices with folders in OneDrive will appear in reports as a device with 0-3 known folders. If a device has not enabled folders in OneDrive, it will appear in reports as a device that is **Not eligible** in the **Known Folders** section of the **Overview** tab. In the **Details** tab, a hyphen ("-") will appear in the cell value of the **Known folders** table for devices that aren't applicable devices. This behavior is expected. ++**Sync app version: Mac App Store edition** For devices using the Mac App Store edition of the sync app, the version installed on each device is displayed in the **Details** tab. The dashboard doesn't currently track whether or not the Mac App Store edition is the latest version of the sync app available in the Mac App Store. If any devices use this edition, they'll be excluded from the **Sync app version** section of the **Overview** tab and the number of excluded devices is displayed. This is the expected result. ++**Considerations:** ++**Network Impact** *How is my network impacted when my organization enables Sync Reports?* ++There is negligible impact to a network after enabling the sync reports setting on devices. ++## Troubleshooting ++Use this section to troubleshoot if the OneDrive sync reports don't appear after three days. ++> [!IMPORTANT] +> If you enable the EnableSyncAdminReports setting on devices that don't meet the [requirements](#requirements), it will have no effect. The app won't send reports. ++1. Confirm that the sync app is on the Insiders or Production ring. ++ Confirm with Command Prompt: ++ Windows users should open Command Prompt as an administrator, then run the following command: ++ ```PowerShell + reg.exe query HKLM\Software\Policies\Microsoft\OneDrive /v GPOSetUpdateRing + ``` ++If the output from the script is **not** `dword:00000000`, your device is on the Insiders or Production ring. ++2. Confirm that the EnableSyncAdminReports setting is applied to the device. Run Command Prompt as an administrator, and then run the following command: ++ ```PowerShell + reg.exe query HKLM\Software\Policies\Microsoft\OneDrive /v EnableSyncAdminReports + ``` ++ The output should look like this: ++ :::image type="content" source="media/syncregkeyquery.png" alt-text="Screenshot of expected command prompt output"::: ++ If the EnableSyncAdminReports setting wasn't applied, go back and follow the steps under [Set up the OneDrive sync health dashboard](#set-up-the-onedrive-sync-health-dashboard). ++If the device is on the Insiders or Production ring and the setting was applied correctly, wait for 36 hours with the device turned on and signed in to OneDrive. If the device still doesn't appear on the dashboard, open a support ticket with Microsoft. For more information, see the next section, [Report a problem](#report-a-problem). ++## Report a problem ++If you encounter a problem with viewing the report dashboard, first verify that you've completed the steps in the troubleshooting section. ++If problems persist after troubleshooting, [open a support ticket with Microsoft](/microsoft-365/admin/contact-support-for-business-products). Make sure that the device isn't powered off during this period so that the sync app can still run and send a health report. ++For quick investigations, be sure to have the date and time when the EnableSyncAdminReports setting was enabled and either the userΓÇÖs email or the OneDrive device ID available in your issue report. ++To get the OneDrive device ID, select the OneDrive sync app in the notification area > **Help & Settings** > **Settings** > **About**. ++## Send feedback ++We value your feedback. To submit feature suggestions and report issues, you can use the Feedback button in the top-right corner of the dashboard page. ++ |
| SharePoint | Sync Process | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/sync-process.md | + + Title: "How sync works" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- MET150 +ms.assetid: 2f748bc6-6f01-4406-a791-ec047f066d6d +description: "Learn how the OneDrive sync app works. Understand how information flows between applications, how technologies work together, & how data is secured." +++# How sync works ++This article gives you an overview of how sync works in Microsoft OneDrive. It helps you understand the logic behind how information flows between applications, how the technologies work together, and how data is secured. ++[Download the PDF](https://go.microsoft.com/fwlink/p/?LinkId=829044) ++ + +## How information flows ++The OneDrive sync app uses [Windows Push Notification Services](/windows/uwp/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview) (WNS) to sync files in real time. WNS informs the sync app whenever a change actually happens, eliminating redundant polling and saving on unnecessary computing power. ++Here's how it works: ++- A change occurs in Microsoft 365. ++- WNS alerts the sync app of the change. ++- OneDrive adds it to the Internal Server Changes Queue. + - Any metadata changes happen immediately, like renaming or deleting files. + - Downloading content also starts a specific session with the client. ++- Microsoft 365 has metadata pointers directing it through Microsoft Azure. ++- The changes are processed in the order they are received. ++The previous OneDrive for Business sync app (Groove.exe) used a polling service to check for changes on a predetermined schedule. Polling can lead to system lag and slowness because it requires a lot of computing power. Using WNS is a significant enhancement. + ++## Authentication protocols ++The authentication protocols depend on which version of SharePoint you are using. ++ - SharePoint Server 2019 uses NTLM. + - SharePoint in Microsoft 365 uses FedAuth. ++## Syncing different file types ++OneDrive handles sync differently depending on the type of file. ++For Office 2016 and Office 2019 files, OneDrive collaborates directly with the specific apps to ensure data are transferred correctly. If the Office desktop app is running, it will handle the syncing. If it is not running, OneDrive will. ++For other types of files and folders, items smaller than 8 MB are sent inline in a single HTTPS request. Anything 8 MB or larger is divided into file chunks and sent separately one at a time through a [Background Intelligent Transfer Service](/windows/desktop/Bits/background-intelligent-transfer-service-portal) (BITS) session. Other changes are batched together into HTTPS requests to the server. + +## The underlying technologies ++The OneDrive sync app uses the following to sync files: ++- To find new changes and upload information: `https://<tenant_name, i.e. contoso>-my.sharepoint.com/personal/<user_contoso_onmicrosoft_com>/_api/SPFileSync/sync/<default document library ID GUID>/` ++- To download items: `https://<tenant_name, i.e. contoso>-my.sharepoint.com/personal/<user_contoso_onmicrosoft_com>/_layouts/15/download.aspx` ++- To discover the sites and organizations a user can access: `https://odc.officeapps.live.com/odc/servicemanager/userconnected` + +## Security and encryption ++File chunks are stored in multiple containers in Azure, each of which is given a unique key. Each key is required to reassemble the complete file. There's also a separate master key encrypting each file chunk key, ensuring the data remain secure even when not moving. ++## Related topic ++- [SharePoint Authentication in Microsoft 365](/sharepoint/authentication) + |
| SharePoint | Sync Vdi Support | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/sync-vdi-support.md | + + Title: "Use the sync app on virtual desktops" +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- Adm_O365 +- onedrive-toc +search.appverid: +- MET150 +- BCS160 ++- Strat_OD_admin +- M365-collaboration +ms.assetid: +description: "Learn about the OneDrive sync app support for desktop virtualization." +++# Use the sync app on virtual desktops ++For all [supported operating systems](https://support.office.com/article/cc0cb2b8-f446-445c-9b52-d3c2627d681e), the OneDrive sync app supports: ++- Virtual desktops that persist between sessions. +- Non-persistent virtual desktops that use [Azure Virtual Desktop](/azure/virtual-desktop). +- Non-persistent virtual desktops that have [FSLogix Apps](/fslogix/configure-profile-container-tutorial) or [FSLogix Office Container](/fslogix/configure-office-container-tutorial), and a Microsoft 365 subscription for all of the following operating systems: + - Windows 10, 32 or 64-bit (supports VHDX files) + - Windows 7, 32 or 64-bit (supports VHD files) + - Windows Server 2019 (supports VHDX) + - Windows Server 2016 (supports VHDX) + - Windows Server 2012 R2 (supports VHDX) + - Windows Server 2008 R2 (supports VHD) + +> [!NOTE] +> The minimum supported versions are: OneDrive 19.174.0902.0013 and FSLogix Apps [2.9.7653.47581](/fslogix/whats-new). +> +> Using the OneDrive sync app with non-persistent environments requires that you [install the sync app per machine](./per-machine-installation.md). +> +> For Windows Server, the [SMB network file sharing protocol](/windows-server/storage/file-server/file-server-smb-overview) is also required. +> +> The OneDrive sync app is not supported in remote app scenarios. +> +> The OneDrive sync app with FSLogix does not support running multiple instances of the same container simultaneously. ++## See also ++Learn more about [VHDX](/openspecs/windows_protocols/ms-vhdx/83f6b700-6216-40f0-aa99-9fcb421206e2) and [VHD](/windows/desktop/vstor/about-vhd). ++For info about creating virtual hard disks, see [Manage virtual hard disks](/windows-server/storage/disk-management/manage-virtual-hard-disks). |
| SharePoint | Transition From Previous Sync Client | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/transition-from-previous-sync-client.md | + + Title: "Transition from the previous OneDrive for Business sync app" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- ODB150 +- GOB150 +- GOB160 +- MET150 +ms.assetid: 4100df3a-0c96-464f-b0a8-c20de34da6fa +description: "Learn how to upgrade users from the previous OneDrive for Business sync app to the new OneDrive sync app (OneDrive.exe)." +++# Transition from the previous OneDrive for Business sync app ++> [!IMPORTANT] +> Support for the previous OneDrive for Business sync app (Groove.exe) ended on January 11, 2021. As of February 1, 2021, users can no longer sync OneDrive or SharePoint files in Microsoft 365 by using Groove.exe. Groove.exe will continue to work only for files in SharePoint Server. ++This article is for global and SharePoint admins who want to transition their users off of the previous OneDrive for Business sync app (Groove.exe) so that they sync with only the new OneDrive sync app (OneDrive.exe). ++If you're not an IT admin, to learn how to begin syncing files using the new OneDrive sync app, see [Sync files with the new OneDrive sync app in Windows](https://support.office.com/article/615391c4-2bd3-4aae-a42a-858262e42a49). ++> [!NOTE] +> If your organization never used the previous OneDrive for Business sync app, or had fewer than 250 licensed Office 365 users in June 2016, your users are already using the new OneDrive sync app to sync files in OneDrive and SharePoint. ++## Syncing files with OneDrive sync app to OneDrive sync app ++When users who are syncing files with the previous OneDrive for Business sync app (Groove.exe) sign in to the new OneDrive sync app (OneDrive.exe), the following things happen: ++- If the new OneDrive sync app can take over syncing a library, the previous sync app stops syncing it and the new OneDrive sync app takes over syncing it without re-downloading the content. If the new OneDrive sync app can't sync the library, the previous sync app continues to sync it. If a library requires checkout or has required columns or metadata, it will be synced read-only. ++- The previous sync app stops running and removes itself from automatic startup, unless it's still syncing libraries that the new OneDrive sync app can't sync. ++When SharePoint libraries begin syncing with the new OneDrive sync app, the folder hierarchy that appears in File Explorer may be simplified. ++## Limits ++The following library types are not yet supported by the new OneDrive sync app, and will not transition from the previous sync app: ++- On-premises locations in SharePoint Server 2016 or earlier. [Learn about using the OneDrive sync app with SharePoint Server 2019](/SharePoint/install/configure-syncing-with-the-onedrive-sync-app) ++- SharePoint libraries that people from other organizations shared that your users are syncing with the previous sync app. ++For more info about sync restrictions and limitations, see [Invalid file names and file types in OneDrive and SharePoint](https://support.office.com/article/64883a5d-228e-48f5-b3d2-eb39e07630fa) ++## Requirements ++To transition users off of the previous sync app, first make sure users have: ++- Windows 10, Windows 8.1, Windows 8, or Windows 7. ++- A current version of the new OneDrive sync app installed. For info about deploying the new OneDrive sync app, see [Deploy OneDrive apps using Microsoft Endpoint Configuration Manager](deploy-on-windows.md). OneDrive.exe must be deployed and configured before you try the takeover command. [Download the latest version of the new OneDrive sync app that's fully released to production](https://go.microsoft.com/fwlink/p/?linkid=844652). To learn about the versions that are rolling out to different rings, see [New OneDrive sync app release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0). ++- The following versions of Office or higher installed. For info about deploying Office, see [Choose how to deploy Microsoft 365 Apps for enterprise](/deployoffice/plan-microsoft-365-apps). Make sure you don't install the previous OneDrive for Business sync app. For info, see [Changes to OneDrive sync app deployment in Office Click-to-Run](exclude-or-uninstall-previous-sync-client.md). ++ |Office version |Minimum version | + ||| + |Microsoft 365 Apps for enterprise <br/> |16.0.7167.2\* <br/> | + |Office 2016 MSI <br/> |16.0.4432.1\* <br/> | + |Office 2013 MSI/C2R <br/> |15.0.4859.1\* <br/> | ++ > [!NOTE] + > If any users have Office 2010 installed, we strongly recommend removing the SharePoint Workspace component. If users previously set up SharePoint Workspace (even if they're no longer using it), it will cause problems syncing team sites. Before starting OneDrive Setup, either [Uninstall Office from a PC](https://support.office.com/article/9dd49b83-264a-477a-8fcc-2fdf5dbf61d8#OfficeVersion=2010) or modify the installation. To do this by running Setup, first create the following XML file: + > + > ```xml + > <?xml version="1.0" encoding="UTF-8"?> + > <Configuration Product="ProPlus"> + > <Display Level="none" CompletionNotice="no" SuppressModal="yes" NoCancel="yes" AcceptEula="yes" /> + > <Logging Type="standard" Path="C:\Windows\temp\" Template="MicrosoftSharePointWorkspaceSetup(*).txt" /> + > <Setting Id="SETUP_REBOOT" Value="Never" /> + > <OptionState Id="GrooveFiles" State="absent" Children="force" /> + > </Configuration> + > ``` + > + > Then run Setup: + > + > ```console + > Setup.exe /modify ProPlus /config RemoveSharepointDesigner.xml + > ``` + > + > For more info, see [Setup command-line options for Office 2010](/previous-versions/office/office-2010/cc178956(v=office.14)) and [Config.xml file in Office 2010](/previous-versions/office/office-2010/cc179195(v=office.14)). ++- The latest [Rights Management Service (RMS) client](https://aka.ms/odirm) if you want users to be able to sync IRM-protected SharePoint document libraries and OneDrive locations. ++## Configure takeover ++When the required software is installed on your users' computers, you can configure automatic takeover of syncing silently ([review the prerequisites and steps](use-silent-account-configuration.md)), and then [use this policy](use-group-policy.md#silently-sign-in-users-to-the-onedrive-sync-app-with-their-windows-credentials). ++After you install and configure OneDrive.exe, Groove.exe should no longer be able to sync. If the takeover did not succeed, or your users are stuck in a hybrid state (some content syncing with OneDrive.exe and some with Groove.exe), try running: `%localappdata%\Microsoft\OneDrive\OneDrive.exe /takeover`. ++> [!TIP] +> Make sure to run the command in a user context, rather than as admin, or the error "OneDrive.exe cannot be run with Admin privileges" appears. <br>To affect all users on the computer, configure the command to run on every user account so it will run for any user who signs in. ++If the takeover did not succeed, the previous OneDrive for Business sync app (Groove.exe) may be an older version that can't successfully transition to the new client. To patch the previous sync app, update groove-x in [Office 2016](/officeupdates/msp-files-office-2016) or [Office 2013](/officeupdates/msp-files-office-2013), and then try again. ++## See also ++To help your users get started with the OneDrive sync app, you can refer them to the following articles: ++- [Sync files with the new OneDrive sync app in Windows](https://support.office.com/article/615391c4-2bd3-4aae-a42a-858262e42a49) ++- [Get started with the new OneDrive sync app for Mac](https://support.office.com/article/d11b9f29-00bb-4172-be39-997da46f913f) ++- [Sync SharePoint files with the new OneDrive sync app](https://support.office.com/article/6de9ede8-5b6e-4503-80b2-6190f3354a88) |
| SharePoint | Turn On External Sharing Notifications | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/turn-on-external-sharing-notifications.md | + + Title: "Control notifications" +++++audience: Admin +f1.keywords: +- CSH +++ms.localizationpriority: medium ++- admindeeplinkSPO +- onedrive-toc ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +- MET150 +ms.assetid: b640c693-f170-4227-b8c1-b0a7e0fa876b +description: "Allow users to receive notifications about file activity in OneDrive and SharePoint." +++# Control notifications ++By default, users receive notifications about file activity in OneDrive and SharePoint. These notifications appear across apps and devices. For example, the service sends notifications through the Firebase Cloud Messaging service to the Office mobile app for Android or the Apple Push Notification service to the Office mobile app for iOS. It also sends notifications to the OneDrive sync app for Windows or Mac. As a global or SharePoint admin in Microsoft 365, you can turn off these notifications for all users for compliance purposes. If you allow these notifications, users can select to turn them off app by app where they don't want them. ++> [!NOTE] +> Currently, the service sends notifications to users when files are shared with them. Later, it will send notifications when people @mention the user in a comment. Other notifications might be added in the future. <br> Notifications aren't available for Office 365 operated by 21Vianet (China). + +## Allow or block notifications ++1. Go to <a href="https://go.microsoft.com/fwlink/?linkid=2185072" target="_blank">**Settings** in the new SharePoint admin center</a>, and sign in with an account that has [admin permissions](/sharepoint/sharepoint-admin-role) for your organization. + +2. Select the **Notifications** setting for OneDrive. + +3. Select or clear **Allow notifications**. + +You can also control this setting in PowerShell by using [Set-SPOTenant -NotificationsInOneDriveForBusinessEnabled](/powershell/module/sharepoint-online/set-spotenant). ++The Notifications page of the OneDrive admin center included three other settings under "Email OneDrive owners when": ++- Other users invite more external users to shared files. You can control this by using [Set-SPOTenant -NotifyOwnersWhenItemsReshared](/powershell/module/sharepoint-online/set-spotenant). +- External users accept invitations to access files. (This setting no longer works for the new sharing experience that appears in most places.) +- An anonymous access link is created or changed. You can control this by using [Set-SPOTenant -OwnerAnonymousNotification](/powershell/module/sharepoint-online/set-spotenant). ++## See also ++For info about controlling SharePoint notifications, see [Control notifications](/sharepoint/notifications). +To control whether sharing emails include "At a glance" content, see [Set-SPOTenant -IncludeAtAGlanceInShareEmails](/powershell/module/sharepoint-online/set-spotenant). |
| SharePoint | Upn Changes | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/upn-changes.md | + + Title: "How UPN changes affect OneDrive" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +- MET150 +description: "In this article, you'll learn how changing a User Principal Name (UPN) affects the OneDrive URL and OneDrive features." +++# How UPN changes affect the OneDrive URL and OneDrive features ++A User Principal Name (UPN) is made up of two parts, the prefix (user account name) and the suffix (DNS domain name). For example: ++user1@contoso.com ++In this case, the prefix is "user1" and the suffix is "contoso.com." ++You can change a user's UPN in the [Microsoft 365 admin center](/office365/admin/add-users/change-a-user-name-and-email-address?view=o365-worldwide&preserve-view=true) by changing the user's username or by setting a different email alias as primary. You can also change a user's UPN in the [Azure AD admin center](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) by changing their username. And you can change a UPN by [using Microsoft PowerShell](/powershell/module/msonline/set-msoluserprincipalname?view=azureadps-1.0&preserve-view=true). ++> [!NOTE] +> A user's UPN (used for signing in) and email address can be different. If you just need to add a new email address for a user, you can add an alias without changing the UPN. ++## Types of UPN changes ++You can change a UPN by changing the prefix, suffix, or both: ++- Changing the prefix. For example, if a person's name changed, you might change their account name: ++ user1@contoso.com to user2@contoso.com ++- Changing the suffix. For example, If a person changed divisions, you might change their domain: ++ user1@contoso.com to user1@contososuites.com ++> [!IMPORTANT] +> UPN changes can take several hours to propagate through your environment. ++## OneDrive URL ++A user's OneDrive URL is based on their UPN: ++`https://contoso-my.sharepoint.com/personal/user1_contoso_com` ++(where user1_contoso_com corresponds with user1@contoso.com) ++> [!NOTE] +> If the user's UPN contains an underscore, it will be present in the resultant OneDrive URL. ++In this case, if you changed the prefix to user2 and the suffix to contososuites.com, the user's OneDrive URL would change to: ++`https://contoso-my.sharepoint.com/personal/user2_contososuites_com` ++After you change a UPN, any saved links to the user's OneDrive (such as desktop shortcuts or browser favorites) will no longer work and will need to be updated. + +## Sync ++The sync app (on both Windows and Mac) will automatically switch to sync with the new OneDrive location after a UPN change. While the UPN change is propagating through your environment, users may see an error in the OneDrive sync app that "One or more libraries could not be synced." If they click for more information, they will see "You don't have permission to sync this library." Users who see this error should restart the sync app. The error will go away when the UPN change has been fully propagated and the sync app is updated to use the user's new OneDrive URL. ++> [!NOTE] +> Synced team sites are not impacted by the OneDrive URL change. ++## OneNote ++After a UPN change, users will need to close and reopen their OneNote notebooks stored in OneDrive. ++[Close a notebook in OneNote for Windows](https://support.office.com/article/d4b52723-6f33-430b-b1f7-35dbb07548a8) ++[Open a notebook in OneNote for Windows](https://support.office.com/article/2e99ead1-a1db-43e3-9945-0b0df9542888) ++## Recent files lists ++After a UPN change, users will need to browse to re-open active OneDrive files in their new location. Any links to the files (including browser favorites, desktop shortcuts, and "Recent" lists in Office apps and Windows) will no longer work. ++## Shared OneDrive files ++If a user shared OneDrive files with others, the links will no longer work after a UPN change. The user will need to re-share the files. ++## Office Backstage View ++After a UPN change, although Office will continue to work as expected, the user's original UPN will continue to be displayed in the Office Backstage View. To update the Office Backstage View to display the changed UPN, the user will need to sign out and then sign in using the Office client. ++## Search and Delve ++After a UPN change, it might take a while for files at the new OneDrive URL to be indexed. During this time, search results in OneDrive and SharePoint will use the old URL. Users can copy the URL, paste it in the address bar, and then update the portion for the new UPN. ++Delve will also link to old OneDrive URLs for a period of time after a UPN change. As activity occurs in the new location, the new links will start appearing. ++## SharePoint automated workflows and customizations ++Any automated workflows that were created with Power Automate or SharePoint 2013 workflows and refer to a OneDrive URL will not work after a UPN change. Similarly, any SharePoint apps (including Power Apps) that reference a OneDrive URL will need to be updated after a UPN change. ++## Recommendations ++- If you're changing many UPNs within your organization, make the UPN changes in batches to manage the load on the system. ++- If possible, apply changes before a weekend or during non-peak hours to allow time for the change to propagate and not interfere with your users' work. + +## See also ++[Info about UserPrincipalName attribute population in hybrid identity](/azure/active-directory/hybrid/plan-connect-userprincipalname) |
| SharePoint | Use Group Policy | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/use-group-policy.md | + + Title: "Use OneDrive policies to control sync settings" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: high ++- Strat_OD_admin +- M365-collaboration ++- seo-marvel-apr2020 +- onedrive-toc +search.appverid: +- ODB160 +- MOE150 +- MED150 +- MBS150 +- ODB150 +- MET150 +ms.assetid: 0ecb2cf5-8882-42b3-a6e9-be6bda30899c +description: "In this article, you'll learn about OneDrive policies and how to configure the OneDrive sync app by using Group Policy." +++# Use OneDrive policies to control sync settings ++This article describes the OneDrive Group Policy objects (GPOs) that admins can configure by using Group Policy or by using [administrative templates in Microsoft Intune](configure-sync-intune.md). You can use the registry key info in this article to confirm that a setting is enabled. + +> [!NOTE] +> If you're not an IT admin, see [Sync files with the new OneDrive sync app in Windows](https://support.office.com/article/615391c4-2bd3-4aae-a42a-858262e42a49) for info about OneDrive sync settings. ++<br/> +++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE2CnSx] + +## Manage OneDrive using Group Policy ++1. Install the OneDrive sync app for Windows. (To see which builds are releasing and download builds, go to the [release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0?).) Installing the sync app downloads the .adml and .admx files. ++2. Browse to %localappdata%\Microsoft\OneDrive\\*BuildNumber*\adm\ (for [per-machine sync app](per-machine-installation.md) browse to C:\Program Files (x86)\Microsoft OneDrive\BuildNumber\adm\ or Program Files\Microsoft OneDrive\BuildNumber\adm\ (depending on the OS architecture)), to the subfolder for your language, as necessary (where *BuildNumber* is the number displayed in sync app settings on the **About** tab). ++  + +3. Copy the .adml and .admx files. ++4. Paste the .admx file in your domain's Central Store, \\\\*domain*\sysvol\domain\Policies\PolicyDefinitions (where *domain* is your domain name, such as corp.contoso.com), and the .adml in the appropriate language subfolder, such as en-us. If the PolicyDefinitions folder does not exist, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759), or use your local policy store under %windir%\policydefinitions. ++5. Configure settings from the domain controller or on a Windows computer by running the [Remote Server Administration Tools](/windows-server/remote/remote-server-administration-tools). ++6. Link the Group Policy objects (GPOs) to an Active Directory container (site, domain, or organizational unit). For info, see [Link Group Policy objects to Active Directory containers](/previous-versions/windows/desktop/Policy/linking-gpos-to-active-directory-containers). ++7. Use security filtering to narrow the scope of a setting. By default, a setting is applied to all user and computer objects within the container to which it's linked, but you can use security filtering to narrow the scope of the policy's application to a subset of users or computers. For info, see [Filtering the scope of a GPO](/previous-versions/windows/desktop/Policy/filtering-the-scope-of-a-gpo). ++The OneDrive Group Policy objects work by setting registry keys on the computers in your domain. + +- When you enable or disable a setting, the corresponding registry key is updated on computers in your domain. If you later change the setting back to **Not configured**, the corresponding registry key is not modified, and the change does not take effect. After you configure a setting, set it to **Enabled** or **Disabled** going forward. ++- The location where registry keys are written has been updated. When you use the latest files, you might delete registry keys that you set previously. ++> [!NOTE] +> For info about storage, see [OneDrive Files On-Demand and Storage Sense for Windows 10](https://support.office.com/article/de5faa9a-6108-4be1-87a6-d90688d08a48) and [Policy CSP - Storage](/windows/client-management/mdm/policy-csp-storage). ++## List of policies by string ID ++- (AllowTenantList) [Allow syncing OneDrive accounts for only specific organizations](use-group-policy.md#allow-syncing-onedrive-accounts-for-only-specific-organizations) ++- (AutomaticUploadBandwidthPercentage) [Limit the sync app upload rate to a percentage of throughput](use-group-policy.md#limit-the-sync-app-upload-rate-to-a-percentage-of-throughput) ++- (BlockExternalListSync) This setting controls Lists sync and is listed here for convenience. For more info, see [Prevent users from syncing lists shared from other organizations](/sharepoint/lists-sync-policies#prevent-users-from-syncing-lists-shared-from-other-organizations). ++- (BlockExternalSync) [Prevent users from syncing libraries and folders shared from other organizations](use-group-policy.md#prevent-users-from-syncing-libraries-and-folders-shared-from-other-organizations) ++- (BlockTenantList) [Block syncing OneDrive accounts for specific organizations](use-group-policy.md#block-syncing-onedrive-accounts-for-specific-organizations) ++- (DefaultRootDir) [Set the default location for the OneDrive folder](use-group-policy.md#set-the-default-location-for-the-onedrive-folder) ++- (DehydrateSyncedTeamSites) [Convert synced team site files to online-only files](use-group-policy.md#convert-synced-team-site-files-to-online-only-files) ++- (DisableAutoConfig) [Prevent authentication from automatically happening](use-group-policy.md#prevent-authentication-from-automatically-happening) ++- (DisableCustomRoot) [Prevent users from changing the location of their OneDrive folder](use-group-policy.md#prevent-users-from-changing-the-location-of-their-onedrive-folder) ++- (DisableFirstDeleteDialog) [Hide the "Deleted files are removed everywhere" reminder](use-group-policy.md#hide-the-deleted-files-are-removed-everywhere-reminder) ++- (DisableNucleusSilentConfig) This setting controls Lists sync and is listed here for convenience. For more info, see [Prevent users from getting silently signed in to Lists sync with their Windows credentials](/sharepoint/lists-sync-policies#prevent-users-from-getting-silently-signed-in-to-lists-sync-with-their-windows-credentials). ++- (DisableNucleusSync) This setting controls Lists sync and is listed here for convenience. For more info, see [Prevent Lists sync from running on the device](/sharepoint/lists-sync-policies#prevent-lists-sync-from-running-on-the-device). ++- (DisablePauseOnBatterySaver) [Continue syncing when devices have battery saver mode turned on](use-group-policy.md#continue-syncing-when-devices-have-battery-saver-mode-turned-on) ++- (DisablePauseOnMeteredNetwork) [Continue syncing on metered networks](use-group-policy.md#continue-syncing-on-metered-networks) ++- (DisablePersonalSync) [Prevent users from syncing personal OneDrive accounts](use-group-policy.md#prevent-users-from-syncing-personal-onedrive-accounts) ++- (DisableTutorial) [Disable the tutorial that appears at the end of OneDrive Setup](use-group-policy.md#disable-the-tutorial-that-appears-at-the-end-of-onedrive-setup) ++- (DiskSpaceCheckThresholdMB) [Set the maximum size of a user's OneDrive that can download automatically](use-group-policy.md#set-the-maximum-size-of-a-users-onedrive-that-can-download-automatically) ++- (DownloadBandwidthLimit) [Limit the sync app download speed to a fixed rate](use-group-policy.md#limit-the-sync-app-download-speed-to-a-fixed-rate) ++- (EnableAllOcsiClients) [Coauthor and share in Office desktop apps](use-group-policy.md#coauthor-and-share-in-office-desktop-apps) ++- (EnableAutomaticUploadBandwidthManagement) [Enable automatic upload bandwidth management for OneDrive](use-group-policy.md#enable-automatic-upload-bandwidth-management-for-onedrive) ++- (EnableHoldTheFile) [Allow users to choose how to handle Office file sync conflicts](use-group-policy.md#allow-users-to-choose-how-to-handle-office-file-sync-conflicts) ++- (EnableODIgnoreListFromGPO) [Exclude specific kinds of files from being uploaded](use-group-policy.md#exclude-specific-kinds-of-files-from-being-uploaded) ++- (EnableSyncAdminReports) [Enable sync health reporting for OneDrive](use-group-policy.md#enable-sync-health-reporting-for-onedrive) ++- (FilesOnDemandEnabled) [Use OneDrive Files On-Demand](use-group-policy.md#use-onedrive-files-on-demand) ++- (ForcedLocalMassDeleteDetection) [Require users to confirm large delete operations](use-group-policy.md#require-users-to-confirm-large-delete-operations) ++- (GPOSetUpdateRing) [Set the sync app update ring](use-group-policy.md#set-the-sync-app-update-ring) ++- (KFMBlockOptIn) [Prevent users from moving their Windows known folders to OneDrive](use-group-policy.md#prevent-users-from-moving-their-windows-known-folders-to-onedrive) ++- (KFMBlockOptOut) [Prevent users from redirecting their Windows known folders to their PC](use-group-policy.md#prevent-users-from-redirecting-their-windows-known-folders-to-their-pc) ++- (KFMOptInWithWizard) [Prompt users to move Windows known folders to OneDrive](use-group-policy.md#prompt-users-to-move-windows-known-folders-to-onedrive) ++- (KFMSilentOptIn) [Silently move Windows known folders to OneDrive](use-group-policy.md#silently-move-windows-known-folders-to-onedrive) ++- (LocalMassDeleteFileDeleteThreshold) [Prompt users when they delete multiple OneDrive files on their local computer](use-group-policy.md#prompt-users-when-they-delete-multiple-onedrive-files-on-their-local-computer) ++- (MinDiskSpaceLimitInMB) [Block file downloads when users are low on disk space](use-group-policy.md#block-file-downloads-when-users-are-low-on-disk-space) ++- (PermitDisablePermissionInheritance) [Allow OneDrive to disable Windows permission inheritance in folders synced read-only](use-group-policy.md#allow-onedrive-to-disable-windows-permission-inheritance-in-folders-synced-read-only) ++- (PreventNetworkTrafficPreUserSignIn) [Prevent the sync app from generating network traffic until users sign in](use-group-policy.md#prevent-the-sync-app-from-generating-network-traffic-until-users-sign-in) ++- (SharePointOnPremFrontDoorUrl) Specify SharePoint Server URL and organization name. This setting is for customers who have SharePoint Server 2019. For info about using the new OneDrive sync app with SharePoint Server 2019, see [Configure syncing with the new OneDrive sync app](/SharePoint/install/configure-syncing-with-the-onedrive-sync-app/). ++- (SharePointOnPremPrioritization) Specify the OneDrive location in a hybrid environment. This setting is for customers who have SharePoint Server 2019. For info about using the new OneDrive sync app with SharePoint Server 2019, see [Configure syncing with the new OneDrive sync app](/SharePoint/install/configure-syncing-with-the-onedrive-sync-app/). ++- (SilentAccountConfig) [Silently sign in users to the OneDrive sync app with their Windows credentials](use-group-policy.md#silently-sign-in-users-to-the-onedrive-sync-app-with-their-windows-credentials) ++- (TenantAutoMount) [Configure team site libraries to sync automatically](use-group-policy.md#configure-team-site-libraries-to-sync-automatically) ++- (UploadBandwidthLimit) [Limit the sync app upload speed to a fixed rate](use-group-policy.md#limit-the-sync-app-upload-speed-to-a-fixed-rate) ++- (WarningMinDiskSpaceLimitInMB) [Warn users who are low on disk space](use-group-policy.md#warn-users-who-are-low-on-disk-space) ++## Computer Configuration policies ++Under Computer Configuration\Policies\Administrative Templates\OneDrive, navigate to **Computer Configuration > Policies**. + + ++### Allow OneDrive to disable Windows permission inheritance in folders synced read-only ++This setting lets the OneDrive sync app remove all inherited permissions within read-only folders syncing on a user's PC. This improves the performance of the sync app when syncing folders that the user has read-only permission to. ++Enabling this setting for a user does not change their permissions to view or edit content in SharePoint. ++We do not recommend setting this policy for users not syncing read-only content. ++Enabling this policy sets the following registry key value to 1: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"PermitDisablePermissionInheritance"="dword:00000001"` + +### Allow syncing OneDrive accounts for only specific organizations +<a name="AllowTenantList"> </a> ++This setting lets you prevent users from easily uploading files to other organizations by specifying a list of allowed tenant IDs. ++If you enable this setting, users get an error if they attempt to add an account from an organization that is not allowed. If a user has already added the account, the files stop syncing. ++To enter a tenant ID, in the **Options** box, select **Show**. + +This policy sets the following registry key: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive\AllowTenantList] "1111-2222-3333-4444"` + +where "1111-2222-3333-4444" is the [tenant ID](find-your-office-365-tenant-id.md). + +This setting takes priority over [Block syncing OneDrive accounts for specific organizations](use-group-policy.md#block-syncing-onedrive-accounts-for-specific-organizations). Do not enable both settings at the same time. ++### Block file downloads when users are low on disk space +<a name="MinDiskSpaceLimitInMB"> </a> ++This setting lets you specify a minimum amount of available disk space and block the OneDrive sync app (OneDrive.exe) from downloading files when users have less than this amount. + +Users are prompted with options to help free up space. + +Enabling this policy sets the following registry key value to a number from 0 through 10240000: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive] "MinDiskSpaceLimitInMB"="dword:00000000"` +++### Block syncing OneDrive accounts for specific organizations +<a name="BlockTenantList"> </a> ++This setting lets you prevent users from uploading files to another organization by specifying a list of blocked tenant IDs. ++If you enable this setting, users get an error if they attempt to add an account from an organization that is blocked. If a user has already added the account, the files stop syncing. + +To enter the tenant ID, in the **Options** box, select **Show**. + +This policy sets the following registry key. + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive\BlockTenantList] "1111-2222-3333-4444"` + +where "1111-2222-3333-4444" is the [tenant ID](find-your-office-365-tenant-id.md). + +This setting does NOT work if you have [Allow syncing OneDrive accounts for only specific organizations](use-group-policy.md#allow-syncing-onedrive-accounts-for-only-specific-organizations) enabled. Do not enable both settings at the same time. + +### Convert synced team site files to online-only files +<a name="DehydrateSyncedTeamSites"> </a> ++This setting lets you convert synced SharePoint files to online-only files when you enable OneDrive Files On-Demand. If you have many PCs syncing the same team site, enabling this setting helps you minimize network traffic and local storage usage. + +If you enable this setting, files in currently syncing team sites are changed to online-only files, by default. Files later added or updated in the team site are also downloaded as online-only files. To use this setting, the computer must be running Windows 10 Fall Creators Update (version 1709) or later, and you must enable OneDrive Files On-Demand. +This feature is not enabled for on-premises SharePoint sites. ++Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"DehydrateSyncedTeamSites"="dword:00000001"` ++For info about querying and setting file and folder states, see [Query and set Files On-Demand states](files-on-demand-mac.md). + +### Enable automatic upload bandwidth management for OneDrive +<a name="EnableAutomaticUploadBandwidthManagement"> </a> ++This setting lets the OneDrive sync app (OneDrive.exe) upload data in the background only when unused bandwidth is available. It prevents the sync app from interfering with other apps that are using the network. This setting is powered by the Windows LEDBAT (Low Extra Delay Background Transport) protocol. When LEDBAT detects increased latency that indicates other TCP connections are consuming bandwidth, the sync app will reduce its own consumption to prevent interference. When network latency decreases again and bandwidth is freed up, the sync app will increase the upload rate and consume the unused bandwidth. ++If you enable this setting, the sync app upload rate will be set to "Adjust automatically" based on bandwidth availability and users won't be able to change it. ++If you disable or do not configure this setting, users can choose to limit the upload rate to a fixed value (in KB/second), or set it to "Adjust automatically." ++> [!IMPORTANT] +> If you enable or disable this setting, and then change it back to Not Configured, the last configuration will remain in effect. We recommend enabling this setting instead of "Limit the sync app upload speed to a fixed rate." You should not enable both settings at the same time. This setting will override "Limit the sync app upload rate to a percentage of throughput" if both are enabled on the same device. ++Enabling this policy sets the following registry key value to 1: ++`[HKLM\Software\Policies\Microsoft\OneDrive]"EnableAutomaticUploadBandwidthManagement"="dword:00000001"` ++### Enable sync health reporting for OneDrive +<a name="EnableSyncAdminReports"> </a> ++This setting lets the OneDrive sync app report sync device and health data included in administrative sync reports. ++If you enable this setting, the OneDrive sync app will report device and health data to include in sync admin reports. You must enable this setting on the devices you want to get reports from. ++If you disable or do not configure this setting, OneDrive sync app device and health data will not appear in the admin reports. ++Enabling this policy sets the following registry key value to 1: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"EnableSyncAdminReports"="dword:00000001"` ++### Exclude specific kinds of files from being uploaded ++This setting lets you enter keywords to prevent the OneDrive sync app (OneDrive.exe) from uploading certain files to OneDrive or SharePoint. You can enter complete names, such as "setup.exe" or use the asterisk (*) as a wildcard character to represent a series of characters, such as *.pst. Keywords aren't case-sensitive. ++If you enable this setting, the sync app doesn't upload new files that match the keywords you specified. No errors appear for the skipped files, and the files remain in the local OneDrive folder. ++> [!NOTE] +> This setting will only block files that match your specification. It will not apply to existing files that are renamed to match the specified keywords. Additionally, new files that are created inside the synced folder and named to match the specified keywords will also not be blocked. ++In File Explorer, the files appear with an "Excluded from sync" icon in the Status column. The OneDrive sync app must be restarted after this setting is enabled for the setting to take effect. ++ ++Users will also see a message in the OneDrive activity center that explains why the files aren't syncing. ++ ++> [!NOTE] +> Users can still browse to their OneDrive in a web browser to upload an excluded file from their local OneDrive folder. We recommend that users remove the local file after doing this because having a file with the same name in the same folder will result in a sync conflict with the skipped file. ++If you disable or do not configure this setting, all supported files in all synced folders will be uploaded. ++Enabling this policy creates a list of strings under the following path: ++`HKLM\SOFTWARE\Policies\Microsoft\OneDrive\EnableODIgnoreListFromGPO` ++> [!NOTE] +> This setting gives you more flexibility than the [Block syncing of specific file types setting](block-file-types.md) in the admin center. Also with this setting, users don't see errors for the excluded files. <br> This setting does not support excluding Office files from being uploaded. All other file types are supported. ++### Hide the "Deleted files are removed everywhere" reminder ++When a user deletes local files from a synced location, a warning message appears that the files will no longer be available across all the user's devices and on the web. This setting lets you hide the warning message. ++ ++If you enable this setting, users won't see the "Deleted files are removed everywhere" reminder when they delete files locally. (This reminder is called "Deleted files are removed for everyone" when a user deletes files from a synced team site.) ++If you disable or do not configure this setting, the reminder will appear until users select "Don't show this reminder again." ++Enabling this policy sets the following registry key value to 1: +`HKLM\SOFTWARE\Policies\Microsoft\OneDrive\DisableFirstDeleteDialog ="dword:00000001"` ++### Limit the sync app upload rate to a percentage of throughput +<a name="AutomaticUploadBandwidthPercentage"> </a> ++This setting lets you balance the performance of different upload tasks on a computer by specifying the percentage of the computer's upload throughput that the OneDrive sync app (OneDrive.exe) can use to upload files. Setting this as a percentage lets the sync app respond to both increases and decreases in throughput. The lower the percentage you set, the slower files upload. We recommend a value of 50% or higher. The sync app periodically uploads without restriction for one minute and then slows down to the upload percentage you set. This lets small files upload quickly while preventing large uploads from dominating the computer's upload throughput. We recommend enabling this setting temporarily when you roll out [Silently move Windows known folders to OneDrive](use-group-policy.md#silently-move-windows-known-folders-to-onedrive), or [Prompt users to move Windows known folders to OneDrive](use-group-policy.md#prompt-users-to-move-windows-known-folders-to-onedrive) to control the network impact of uploading known folder contents. ++ + +> [!NOTE] +> The maximum throughput value detected by the sync app can sometimes be higher or lower than expected because of the different traffic throttling mechanisms that your Internet Service Provider (ISP) might use. <br>For info about estimating the network bandwidth you need for sync, see [Network utilization planning for the OneDrive sync app](network-utilization-planning.md). ++If you enable this setting and enter a percentage (from 10-99) in the **Bandwidth** box, computers use the percentage of upload throughput that you specify when uploading files to OneDrive, and users cannot change it. ++Enabling this policy sets the following registry key value. For example: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"AutomaticUploadBandwidthPercentage"="dword:00000032"` + +The previous registry key sets the upload throughput percentage to 50%, using the hexadecimal value for 50, which is 00000032. + +If you disable or do not configure this setting, users can choose to limit the upload rate to a fixed value (in KB/second), or set it to "Adjust automatically," which sets the upload rate to 70% of throughput. For info about the end-user experience, see [Change the OneDrive sync app upload or download rate](https://support.office.com/article/71cc69da-2371-4981-8cc8-b4558bdda56e). ++> [!IMPORTANT] +> If you enable or disable this setting, and then change it back to Not Configured, the last configuration remains in effect. We recommend enabling this setting instead of "Limit the sync app upload speed to a fixed rate" to limit the upload rate. You should not enable both settings at the same time. + +### Prevent authentication from automatically happening +<a name="DisableAutoConfig"> </a> ++This setting determines whether or not the Sync client can automatically sign in. ++If you enable this setting, it prevents Sync from automatically signing with an existing Microsoft Azure Active Directory (Azure AD) credential that is made available to Microsoft applications. ++If you disable or do not configure this setting, Sync will automatically sign in. + +Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"DisableAutoConfig"="dword:00000001"` ++### Prevent the sync app from generating network traffic until users sign in +<a name="PreventNetworkTrafficPreUserSignIn"> </a> ++This setting lets you block the OneDrive sync app (OneDrive.exe) from generating network traffic (checking for updates, and so on) until users sign in to OneDrive or start syncing files on their computer. + +If you enable this setting, users must sign in to the OneDrive sync app on their computer, or select to sync OneDrive or SharePoint files on the computer, for the sync app to start automatically. + +If you disable or do not configure this setting, the OneDrive sync app starts automatically when users sign in to Windows. ++> [!IMPORTANT] +> If you enable or disable this setting, and then change it back to Not Configured, the last configuration remains in effect. ++Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"PreventNetworkTrafficPreUserSignIn"="dword:00000001"` ++### Prevent users from fetching files remotely +<a name="RemoteAccessGPOEnabled"> </a> ++> [!NOTE] +> This setting has been removed from the OneDrive administrative template files (ADMX/ADML) because the Fetch files feature was deprecated on July 31, 2020. ++### Prevent users from moving their Windows known folders to OneDrive +<a name="KFMBlockOptIn"> </a> ++This setting prevents users from moving their Documents, Pictures, and Desktop folders to any OneDrive account. + +> [!NOTE] +> Moving known folders to personal OneDrive accounts is already blocked on domain-joined PCs. + +If you enable this setting, users aren't prompted with a window to protect their important folders, and the *Manage backup* command is disabled. If the user has already moved their known folders, the files in those folders will remain in OneDrive. To redirect the known folders back to the user's device, please select "No." This setting does not take effect if you've enabled "Prompt users to move Windows known folders to OneDrive" or "Silently move Windows known folders to OneDrive." + +If you disable or do not configure this setting, users can choose to move their known folders. + +Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMBlockOptIn"="dword:00000001"` ++To redirect the known folders back to the user's device and enable this policy, set the following registry key value to 2: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMBlockOptIn"="dword:00000002"` ++### Prevent users from redirecting their Windows known folders to their PC +<a name="KFMBlockOptOut"> </a> ++This setting forces users to keep their Documents, Pictures, and Desktop folders directed to OneDrive. ++If you enable this setting, the **Stop protecting** button in the **Set up protection of important folders** window is disabled, and users receive an error if they try to stop syncing a known folder. + +If you disable or do not configure this setting, users can choose to redirect their known folders back to their PC. + +Enabling this policy sets the following registry key: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMBlockOptOut"="dword:00000001"` ++### Prevent users from syncing libraries and folders shared from other organizations +<a name="BlockExternalSync"> </a> ++The B2B Sync feature of the OneDrive sync app lets users at an organization to sync OneDrive and SharePoint libraries and folders shared with them from another organization. For more info, see [B2B Sync](b2b-sync.md). ++Enabling this setting prevents users at your organization from being able to use B2B Sync. After the setting is enabled (value 1) on a computer, the sync app does not sync libraries and folders shared from other organizations. Modify the setting to the disabled state (value 0) to restore B2B Sync capability for your users. ++Prevent B2B Sync with: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive] "BlockExternalSync"="dword:1"` ++Restore B2B Sync with: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive] "BlockExternalSync"="dword:0"` ++### Prompt users to move Windows known folders to OneDrive +<a name="KFMOptInWithWizard"> </a> ++This setting shows the following window that prompts users to move their Documents, Pictures, and Desktop folders to OneDrive. ++> [!div class="mx-imgBorder"] +>  + +If you enable this setting and provide your tenant ID, users who are syncing their OneDrive see the previous window when they're signed in. If they close the window, a reminder notification appears in the Activity Center until they move all their known folders. If a user has already redirected their known folders to a different OneDrive account, they are prompted to direct the folders to the account for your organization (leaving existing files behind). + +If you disable or do not configure this setting, the window that prompts users to protect their important folders doesn't appear. + +Enabling this policy sets the following registry key: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMOptInWithWizard"="1111-2222-3333-4444"` + +where "1111-2222-3333-4444" is the [tenant ID](find-your-office-365-tenant-id.md). ++For info and recommendations, see [Redirect and move Windows known folders to OneDrive](redirect-known-folders.md). ++### Prompt users when they delete multiple OneDrive files on their local computer +<a name="LocalMassDeleteFileDeleteThreshold"> </a> ++This policy sets the threshold for how many files a user can delete from a local OneDrive folder before the user is notified that the files will also be deleted from the cloud. ++If you enable this policy, users will see a notification if they delete more than the specified number of files from OneDrive on their local computer. The user will be given the option to continue to remove the cloud files, or restore the local files. ++> [!NOTE] +> Even if you enable this policy, users won't receive notifications if they've selected the "Always remove files" check box on a previous notification, or if they've cleared the "Notify me when many files are deleted in the cloud" check box in OneDrive sync app settings. ++If you disable this policy, users will not receive a notification when they delete numerous OneDrive files on their local computer. ++If you do not configure this policy, users will see a notification when they delete more than 200 files within a short period of time. ++Enabling this policy sets the following registry key value to a number from 0 through 100000: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"LocalMassDeleteFileDeleteThreshold"` ++### Require users to confirm large delete operations +<a name="ForcedLocalMassDeleteDetection"> </a> ++This setting makes users confirm that they want to delete files in the cloud when they delete a large number of synced files. ++If you enable this setting, a warning always appears when users delete a large number of synced files. If a user doesn't confirm a delete operation within seven days, the files are not deleted. ++If you disable or do not configure this setting, users can choose to hide the warning, and always delete files in the cloud. ++Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"ForcedLocalMassDeleteDetection"="dword:00000001"` ++### Set the maximum size of a user's OneDrive that can download automatically +<a name="DiskSpaceCheckThresholdMB"> </a> ++This setting is used with [Silently sign in users to the OneDrive sync app with their Windows credentials](use-group-policy.md#silently-sign-in-users-to-the-onedrive-sync-app-with-their-windows-credentials) on devices that don't have OneDrive Files On-Demand enabled. Any user who has a OneDrive that's larger than the specified threshold (in MB) is prompted to choose the folders they want to sync before the OneDrive sync app (OneDrive.exe) downloads the files. + +To enter the tenant ID and the maximum size in MB (from 0 to 4294967295), in the **Options** box, select **Show**. The default value is 500. + +Enabling this policy sets the following registry key: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceCheckThresholdMB]"1111-2222-3333-4444"=dword:0005000` + +where "1111-2222-3333-4444" is the [tenant ID](find-your-office-365-tenant-id.md) and 0005000 sets a threshold of 5000 MB. + +### Set the sync app update ring +<a name="GPOSetUpdateRing"> </a> ++We release OneDrive sync app (OneDrive.exe) updates to the public through three rings- first to Insiders, then Production, and finally Deferred. This setting lets you specify the ring for users in your organization. When you enable this setting and select a ring, users aren't able to change it. ++Insiders ring users receive builds that let them preview new features coming to OneDrive. ++Production ring users get the latest features as they become available. This ring is the default. ++Deferred ring users get new features, bug fixes, and performance improvements last. This ring lets you deploy updates from an internal network location, and control the timing of the deployment (within a 60-day window). ++> [!IMPORTANT] +> We recommend selecting several people in your IT department as early adopters to join the Insiders ring and receive features early. We recommend leaving everyone else in the organization in the default Production ring to ensure they receive bug fixes and new features in a timely fashion. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) ++If you disable or do not configure this setting, users can join the [Windows Insider program](https://insider.windows.com/) or the [Office Insider](https://products.office.com/office-insider) program to get updates on the Insiders ring. ++Enabling this policy sets the following registry key: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"GPOSetUpdateRing"="dword:0000000X"` ++Set the value 4 for Insider, 5 for Production, or 0 for Deferred. When you configure this setting to 5 for Production, or 0 for Deferred, the "Get OneDrive Insider preview updates before release", in the sync app, the checkbox does not appear on the **Settings > About** tab. + +For more info on the builds currently available in each ring, see the [release notes](https://support.office.com/article/845dcf18-f921-435e-bf28-4e24b95e5fc0?). For more info about the update rings and how the sync app checks for updates, see [The OneDrive sync app update process](sync-client-update-process.md). ++### Silently move Windows known folders to OneDrive +<a name="KFMOptInNoWizard"> </a> ++Use this setting to redirect and move your users' Documents, Pictures, and/or Desktop folders to OneDrive without any user interaction. ++> [!NOTE] +> We recommend deploying the silent policy for existing devices and new devices while limiting the deployment of existing devices to 1,000 devices a day and not exceeding 4,000 devices a week. We also recommend using this setting together with [Prompt users to move Windows known folders to OneDrive](use-group-policy.md#prompt-users-to-move-windows-known-folders-to-onedrive). If moving the known folders silently does not succeed, users will be prompted to correct the error and continue. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) + +You can move all folders at once or select the folders you want to move. After a folder is moved, this policy will not affect that folder again, even if you clear the check box for the folder. ++If you enable this setting and provide your tenant ID, you can choose whether to display a notification to users after their folders have been redirected. + + + +If you disable or do not configure this setting, your users' known folders are not silently redirected to OneDrive. + +Enabling this policy sets the following registry keys: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptIn"="1111-2222-3333-4444"` + +where "1111-2222-3333-4444" is a String value representing the [tenant ID](find-your-office-365-tenant-id.md). + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInWithNotification"="dword:00000001"` + +Setting this value to 1 shows a notification after successful redirection. ++If you don't set any of the following policies then the default policy will move all the folders (Desktop, Documents and Pictures) into OneDrive. If you want to specify which folder(s) to move then you can set any combination of the following policies: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInDesktop"="dword:00000001"` + +Setting this value to 1 will move the Desktop folder. ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInDocuments"="dword:00000001"` + +Setting this value to 1 will move the Documents folder. ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInPictures"="dword:00000001"` + +Setting this value to 1 will move the Pictures folder. ++For more info, see [Redirect and move Windows known folders to OneDrive](redirect-known-folders.md). + +### Silently sign in users to the OneDrive sync app with their Windows credentials +<a name="SilentAccountConfig"> </a> ++> [!IMPORTANT] +> [Azure Active Directory Authentication Library](/azure/active-directory/develop/active-directory-authentication-libraries) (ADAL) is enabled automatically when the sync user is provisioned via `SilentAccountConfig`, so you don't have to enable it separately. + +If you enable this setting, users who are signed in on a PC that's joined to Azure AD can set up the sync app without entering their account credentials. Users will still be shown OneDrive Setup so they can select folders to sync and change the location of their OneDrive folder. If a user is using the previous OneDrive for Business sync app (Groove.exe), the new sync app attempts to take over syncing the user's OneDrive from the previous app, and preserves the user's sync settings. This setting is frequently used together with [Set the maximum size of a user's OneDrive that can download automatically](use-group-policy.md#set-the-maximum-size-of-a-users-onedrive-that-can-download-automatically) on PCs that don't have Files On-Demand and with [Set the default location for the OneDrive folder](use-group-policy.md#set-the-default-location-for-the-onedrive-folder). ++> [!IMPORTANT] +> We recommend enabling silent account configuration when you configure the sync app. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) ++Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"SilentAccountConfig"="dword:00000001"` + +For more info about this feature, including troubleshooting steps, see [Silently configure user accounts](use-silent-account-configuration.md). +Let us know if you have feedback on this feature or encounter any issues. Right-click the OneDrive icon in the notification area and select **Report a problem**. Tag any feedback with "SilentConfig" so that your feedback is sent directly to engineers working on this feature. ++### Specify SharePoint Server URL and organization name ++This setting is for customers who have SharePoint Server 2019. For info about using the new OneDrive sync app with SharePoint Server 2019, see [Configure syncing with the new OneDrive sync app](/SharePoint/install/configure-syncing-with-the-onedrive-sync-app/). ++### Specify the OneDrive location in a hybrid environment ++This setting is for customers who have SharePoint Server 2019. For info about using the new OneDrive sync app with SharePoint Server 2019, see [Configure syncing with the new OneDrive sync app](/SharePoint/install/configure-syncing-with-the-onedrive-sync-app/). ++### Use OneDrive Files On-Demand +<a name="FilesOnDemandEnabled"> </a> ++This setting lets you control whether OneDrive Files On-Demand is enabled for your organization. Files On-Demand helps you save storage space on your users' computers, and minimize the network impact of sync. The feature is available to users running Windows 10 Fall Creators update (version 1709 or later). For more info, see [Save disk space with OneDrive Files On-Demand for Windows 10](https://support.office.com/article/0e6860d3-d9f3-4971-b321-7092438fb38e). ++> [!IMPORTANT] +> We recommend keeping Files On-Demand enabled. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) + +If you enable this setting, new users who set up the sync app see online-only files in File Explorer, by default. File contents don't download until a file is opened. If you disable this setting, Windows 10 users have the same sync behavior as users of previous versions of Windows, and aren't able to turn on Files On-Demand. If you do not configure this setting, users can turn Files On-Demand on or off. ++Enabling this policy sets the following registry key value to 1: + +`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"FilesOnDemandEnabled"="dword:00000001"` + +Meet Windows and OneDrive sync app requirements and still can't see Files On-Demand option available at "Settings"? Make sure the service "Windows Cloud Files Filter Driver" start type is set to 2 (AUTO_START). Enabling this feature sets the following registry key value to 2: ++`[HKLM\SYSTEM\CurrentControlSet\Services\CldFlt]"Start"="dword:00000002"` ++### Warn users who are low on disk space +<a name="WarningMinDiskSpaceLimitInMB"> </a> ++This setting lets you specify a minimum amount of available disk space, and warn users when the OneDrive sync app (OneDrive.exe) downloads a file that causes them to have less than this amount. Users are prompted with options to help free up space. + +Enabling this policy sets the following registry key value to a number from 0 through 10240000: ++`[HKLM\SOFTWARE\Policies\Microsoft\OneDrive] "WarningMinDiskSpaceLimitInMB"="dword:00000000"` +++## User Configuration policies +<a name="Glob"> </a> ++Find *User Configuration policies* under User Configuration\Policies\Administrative Templates\OneDrive. + + + +### Allow users to choose how to handle Office file sync conflicts +<a name="EnableHoldTheFile"> </a> ++This setting specifies what happens when conflicts occur between Office file versions during sync. By default, users can decide if they want to merge changes or keep both copies. Users can also change settings in the OneDrive sync app to always keep both copies. (This option is available for Office 2016 or later only. With earlier versions of Office, both copies are always kept.) + +If you enable this setting, users can decide if they want to merge changes or keep both copies. Users can also configure the sync app to always fork the file and keep both copies, as follows. + + + +Enabling this policy sets the following registry key value to 1: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "EnableHoldTheFile"="dword:00000001"` ++If you disable this setting, the Sync conflicts setting on the Office tab is disabled, and when a sync conflict occurs, both copies of the file are kept. + +To enable this setting, you must enable [Coauthor and share in Office desktop apps](use-group-policy.md#coauthor-and-share-in-office-desktop-apps). For more info about the Office settings in the sync app, see [Use Office applications to sync Office files that I open](https://support.office.com/article/8a409b0c-ebe1-4bfa-a08e-998389a9d823). + +### Coauthor and share in Office desktop apps +<a name="EnableAllOcsiClients"> </a> ++This setting lets multiple users use the Microsoft 365 Apps for enterprise, Office 2019, or Office 2016 desktop apps to simultaneously edit an Office file stored in OneDrive. It also lets users share files from the Office desktop apps. ++> [!IMPORTANT] +> We recommend keeping this setting enabled to make syncing faster and reduce network bandwidth. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) + +If you enable or do not configure this setting, the **Office** tab appears in OneDrive sync settings, and **Use Office applications to sync Office files that I open** is selected, by default. + + ++Enabling this policy sets the following registry key value to 1: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "EnableAllOcsiClients"="dword:00000001"` + +If you disable this setting, the **Office** tab is hidden in the sync app, and coauthoring and in-app sharing for Office files is disabled. The **Users can choose how to handle Office files in conflict** setting acts as disabled, and when file conflicts occur, both copies of the file are kept. For more info about the settings in the sync app, see [Use Office applications to sync Office files that I open](https://support.office.com/article/8a409b0c-ebe1-4bfa-a08e-998389a9d823). ++### Configure team site libraries to sync automatically +<a name="AutoMountTeamSites"> </a> ++This setting lets you specify SharePoint team site libraries to sync automatically the next time users sign in to the OneDrive sync app (OneDrive.exe), within an eight-hour window, to help distribute network load. To use this setting, the computer must be running Windows 10 Fall Creators Update (version 1709) or later, and you must enable OneDrive Files On-Demand. +This feature is not enabled for on-premises SharePoint sites. ++> [!IMPORTANT] +> For performance reasons, we recommend not enabling this setting to libraries with more than 5,000 files or folders. +> Do not enable this setting to the same library with more than 1,000 devices. ++If you enable this setting, the OneDrive sync app automatically syncs the contents of the libraries you specified as online-only files the next time the user signs in. The user isn't able to stop syncing the libraries. ++If you disable this setting, team site libraries that you've specified aren't automatically synced for new users. Existing users can choose to stop syncing the libraries, but the libraries won't stop syncing automatically. ++To configure the setting, in the **Options** box, select **Show**, and then enter a friendly name to identify the library in the **Value Name** field, and the entire library ID (tenantId=xxx&siteId=xxx&webId=xxx&listId=xxx&webUrl=httpsxxx&version=1) in the **Value** field. ++To find the library ID, sign in as a global or SharePoint admin in Microsoft 365, browse to the library, and select **Sync**. In the **Starting sync** dialog, select the **Copy library ID** link. ++ ++The special characters in this copied string are in Unicode and must be converted to ASCII according to the following table. ++|Find |Replace| +|- |-| +| %2D | - | +| %7B | { | +| %7D | } | +| %3A | : | +| %2F | / | +| %2E | . | ++Alternatively, you can run the following command in PowerShell, replacing "Copied String" with the library ID: ++```powershell +[uri]::UnescapeDataString("Copied String") +``` ++Enabling this policy sets the following registry key, using the entire URL from the library you copied: ++`[HKCU\Software\Policies\Microsoft\OneDrive\TenantAutoMount]"LibraryName"="LibraryID"` ++### Continue syncing on metered networks +<a name="DisablePauseOnMeteredNetwork"> </a> ++This setting lets you turn off the auto-pause feature when devices connect to metered networks. ++If you enable this setting, syncing continues when devices are on a metered network. OneDrive does not automatically pause syncing. ++If you disable or do not configure this setting, syncing pauses automatically when a metered network is detected and a notification appears. To not pause, in the notification, select **Sync Anyway**. When syncing is paused, to resume syncing, in the notification area of the taskbar, select the OneDrive cloud icon, and at the top of the Activity Center, select the alert. ++Enabling this policy sets the following registry key value to 1: ++`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "DisablePauseOnMeteredNetwork"=dword:00000001` + +### Continue syncing when devices have battery saver mode turned on +<a name="DisablePauseOnBatterySaver"> </a> ++This setting lets you turn off the auto-pause feature for devices that have battery saver mode turned on. ++If you enable this setting, syncing continues when users turn on battery saver mode. OneDrive does not automatically pause syncing. ++If you disable or do not configure this setting, syncing pauses automatically when battery saver mode is detected and a notification appears. To not pause, in the notification, select **Sync Anyway**. When syncing is paused, to resume syncing, in the notification area of the taskbar, select the OneDrive cloud icon, and at the top of the Activity Center, select the alert. ++Enabling this policy sets the following registry key value to 1: ++`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "DisablePauseOnBatterySaver"=dword:00000001` +++### Disable the tutorial that appears at the end of OneDrive Setup +<a name="DisableFRETutorial"> </a> ++This setting lets you prevent the tutorial from showing at the end of OneDrive Setup. ++If you enable this setting, users don't see the tutorial after they complete OneDrive Setup. + +Enabling this policy sets the following registry key value to 1: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "DisableTutorial"="dword:00000001"` ++### Limit the sync app download speed to a fixed rate +<a name="DownloadBandwidthLimit"> </a> ++This setting lets you configure the maximum speed at which the OneDrive sync app (OneDrive.exe) can download files. This rate is a fixed value in kilobytes per second, and applies only to syncing, not to downloading updates. The lower the rate, the slower the files download. ++We recommend that you use this setting in cases where Files On-Demand is NOT enabled, and where strict traffic restrictions are required, such as when you initially deploy the sync app in your organization or enable syncing of team sites. We don't recommend that you use this setting on an ongoing basis because it decreases sync app performance and negatively impacts the user experience. After the initial sync, users typically sync only a few files at a time, and it doesn't have a significant effect on network performance. If you enable this setting, computers use the maximum download rate that you specify, and users are not able to change it. ++If you enable this setting, enter the rate (from 1 to 100000) in the **Bandwidth** box. The maximum rate is 100000 KB/s. Any input lower than 50 KB/s sets the limit to 50 KB/s, even if the UI shows a lower value. ++If you disable or do not configure this setting, the download rate is unlimited, and users can choose to limit it in OneDrive sync app settings. For info about the end-user experience, see [Change the OneDrive sync app upload or download rate](https://support.office.com/article/71cc69da-2371-4981-8cc8-b4558bdda56e). ++Enabling this policy sets the following registry key value to a number from 50 through 100,000. For example: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive] "DownloadBandwidthLimit"="dword:00000032"` + +The previous registry key sets the download throughput rate limit to 50KB/sec, using the hexadecimal value for 50, which is 00000032. ++> [!NOTE] +> OneDrive.exe must be restarted on users' computers to apply this setting. + +For info about estimating the network bandwidth you need for sync, see [Network utilization planning for the OneDrive sync app](network-utilization-planning.md). + +### Limit the sync app upload speed to a fixed rate +<a name="UploadBandwidthLimit"> </a> ++This setting lets you configure the maximum speed at which the OneDrive sync app (OneDrive.exe) can upload files. This rate is a fixed value in kilobytes per second. The lower the rate, the slower the computer uploads files. ++If you enable this setting and enter the rate (from 1 to 100000) in the **Bandwidth** box, computers use the maximum upload rate that you specify, and users are not able to change it in OneDrive settings. The maximum rate is 100000 KB/s. Any input lower than 50 KB/s sets the limit to 50 KB/s, even if the UI shows a lower value. ++If you disable or do not configure this setting, users can choose to limit the upload rate to a fixed value (in KB/second), or set it to "Adjust automatically" which sets the upload rate to 70% of throughput. For info about the end-user experience, see [Change the OneDrive sync app upload or download rate](https://support.office.com/article/71cc69da-2371-4981-8cc8-b4558bdda56e). ++We recommend that you use this setting only in cases where strict traffic restrictions are required. In scenarios where you need to limit the upload rate (such as when you roll out Known Folder Move), we recommend enabling [Limit the sync app upload rate to a percentage of throughput](use-group-policy.md#limit-the-sync-app-upload-rate-to-a-percentage-of-throughput) to set a limit that adjusts to changing conditions. You should not enable both settings at the same time. ++Enabling this policy sets the following registry key value to a number from 50 through 100,000. For example: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive]"UploadBandwidthLimit"="dword:00000032"` + +The previous registry key sets the upload throughput rate limit to 50KB/sec, using the hexadecimal value for 50, which is 00000032. ++> [!NOTE] +> OneDrive.exe must be restarted on users' computers to apply this setting. + +For info about estimating the network bandwidth you need for sync, see [Network utilization planning for the OneDrive sync app](network-utilization-planning.md). + + +### Prevent users from changing the location of their OneDrive folder +<a name="DisableCustomRoot"> </a> ++This setting lets you block users from changing the location of the OneDrive folder on their computer. + +To use this setting, in the **Options** box, select **Show**, and enter your [tenant ID](find-your-office-365-tenant-id.md). To enable the setting, enter 1; to disable it, enter 0. + +If you enable this setting, the **Change location** link is hidden in OneDrive Setup. The OneDrive folder is created in the default location, or in the custom location you specified if you enabled [Set the default location for the OneDrive folder](use-group-policy.md#set-the-default-location-for-the-onedrive-folder). + +Enabling this policy sets the following registry key value to 1: ++`[HKCU\Software\Policies\Microsoft\OneDrive\DisableCustomRoot] "1111-2222-3333-4444"="dword:00000001"` + +where "1111-2222-3333-4444" is the tenant ID. + +If you disable this setting, users can change the location of their sync folder in OneDrive Setup. ++ +### Prevent users from syncing personal OneDrive accounts +<a name="DisablePersonalSync"> </a> ++This setting lets you block users from signing in with a Microsoft account to sync their personal OneDrive files. By default, users are allowed to sync personal OneDrive accounts. + +If you enable this setting, users are prevented from setting up a sync relationship for their personal OneDrive account. Users who are already syncing their personal OneDrive when you enable this setting aren't able to continue syncing (they receive a message that syncing has stopped), but any files synced to the computer remain on the computer. ++Enabling this policy sets the following registry key value to 1: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive]"DisablePersonalSync"="dword:00000001"` ++### Receive OneDrive sync app updates on the Deferred ring +<a name="EnableEnterpriseUpdate"> </a> ++> [!IMPORTANT] +> This setting will be removed soon. We recommend using the new setting [Set the sync app update ring](use-group-policy.md#set-the-sync-app-update-ring) instead. + +For more info about the update rings and how the sync app checks for updates, see [The OneDrive sync app update process](sync-client-update-process.md). ++### Set the default location for the OneDrive folder +<a name="DefaultRootDir"> </a> ++This setting lets you set a specific path as the default location of the OneDrive folder on users' computers. By default, the path is under %userprofile%. + +If you enable this setting, the default location of the OneDrive - {organization name} folder is the path that you specify. To specify your tenant ID and the path, in the **Options** box, select **Show**. + +This policy sets the following registry key to a string that specifies the file path: + +`[HKCU\SOFTWARE\Policies\Microsoft\OneDrive\DefaultRootDir] "1111-2222-3333-4444"="{User path}"` + +where "1111-2222-3333-4444" is the tenant ID. + +If you disable this setting, the local *OneDrive - {organization name}* folder location defaults to %userprofile%. + +> [!NOTE] +> The %logonuser% environment variable won't work through Group Policy. We recommend you use %username% instead. + +## See also +<a name="Glob"> </a> ++[Deploy the new OneDrive sync app in an enterprise environment](deploy-on-windows.md) ++[Prevent users from installing the sync app](prevent-installation.md) ++[Allow syncing only on computers joined to specific domains](allow-syncing-only-on-specific-domains.md) ++[Block syncing of specific file types](block-file-types.md) ++[Deploy and configure the new OneDrive sync app for Mac](deploy-and-configure-on-macos.md) ++[Lists sync policies](/sharepoint/lists-sync-policies) |
| SharePoint | Use Silent Account Configuration | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/use-silent-account-configuration.md | + + Title: "Silently configure user accounts" +++++audience: ITPro +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration +search.appverid: +- ODB160 +- MET150 +ms.assetid: 64aa1f56-d7f6-4500-a408-1fde8fe6db36 ++- seo-marvel-apr2020 +- onedrive-toc +description: "Learn how IT admins can enable silent account configuration when deploying the OneDrive sync app in an enterprise." +++# Silently configure user accounts ++This article is for IT admins who would like to silently configure user accounts when deploying the new OneDrive sync app (OneDrive.exe) to managed Windows computers in their enterprise. This feature works for computers that are joined to Azure Active Directory (Azure AD). + +If you enable this feature, OneDrive.exe will attempt to silently (without user interaction) sign-in to the work or school user account that was used to sign into Windows (known as the Windows Primary Account). That Windows account must be a Microsoft Azure Active Directory (Azure AD) account or be linked to an Azure AD account through a hybrid authentication configuration (see Prerequisites below). ++Before OneDrive.exe begins syncing, it will check the available disk space. If syncing the user's entire OneDrive would cause the available space to drop below 1 GB or if the size exceeds the threshold you set (on devices that don't have Files On-Demand enabled), OneDrive will prompt the user to choose folders to sync. For info about setting this threshold using Group Policy, see [Set the maximum size of a user's OneDrive that can download automatically](use-group-policy.md#set-the-maximum-size-of-a-users-onedrive-that-can-download-automatically). + +When the user is configured in the sync app, if the same user account is syncing files with the previous OneDrive for Business sync app (Groove.exe), the new sync app (OneDrive.exe) will attempt to take over syncing those files. ++> [!IMPORTANT] +> We recommend enabling silent account configuration when you configure the sync app. [See all our recommendations for configuring the sync app](ideal-state-configuration.md) ++## Prerequisites ++Before you can enable silent account configuration, you need to join your devices to Azure AD. You can join devices running Windows 10 and Windows Server 2016 directly to Azure AD. To learn how, see [Join your work device to your organization's network](/azure/active-directory/user-help/user-help-join-device-on-network). + +If you have an on-premises environment that uses Active Directory, you can enable [hybrid Azure AD joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan) to join devices on your domain to Azure AD. Devices must be running one of the following operating systems: + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2019 +- Windows Server 2016 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +If you federate your on-premises Active Directory with Azure AD, you must use AD FS to enable this feature. For info about using Azure AD Connect, see [Getting started with Azure AD Connect using express settings](/azure/active-directory/hybrid/how-to-connect-install-custom). + +> [!NOTE] +> For more info, see [How to configure hybrid Azure Active Directory joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan). To check the join status and fix problems, see [Troubleshoot hybrid Azure AD-joined devices](/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current). + +## Enable silent configuration ++If the computers on your network are joined to Active Directory on-premises, you can use domain group policy to configure silent account configuration. ++Using Group Policy: + +1. Enable silent account configuration. For info, see [Silently sign in users to the OneDrive sync app with their Windows credentials](use-group-policy.md#silently-sign-in-users-to-the-onedrive-sync-app-with-their-windows-credentials). + +2. Optionally, specify the maximum OneDrive size that will download automatically in silent configuration. For info, see [Set the maximum size of a user's OneDrive that can download automatically](use-group-policy.md#set-the-maximum-size-of-a-users-onedrive-that-can-download-automatically). If you enable Files On-Demand, OneDrive will ignore the maximum size value. + +3. Optionally, set the default location for the OneDrive folder. For info, see [Set the default location for the OneDrive folder](use-group-policy.md#set-the-default-location-for-the-onedrive-folder). + +> [!TIP] +> See the [Verify SilentAccountConfig](use-silent-account-configuration.md#VerifySilentAccountConfig) section below to verify and troubleshoot your configuration. + +> [!NOTE] +> Silent account configuration won't work on devices for users who require multi-factor authentication. Select third-party identity providers (IdPs) are supported, but there are caveats. For more information, make sure to check out the [Azure AD federation compatibility list](/azure/active-directory/hybrid/how-to-connect-fed-compatibility). ++If the computers on your network aren't connected to Active Directory on-premises, but only to Azure AD, we recommend using Intune and a Microsoft PowerShell script to set the registry keys required to enable silent account configuration. Be sure you have [automatic enrollment set up for Windows 10 devices](/intune/quickstart-setup-auto-enrollment). ++Using a script: ++```PowerShell +$HKLMregistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive'##Path to HKLM keys +$DiskSizeregistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceCheckThresholdMB'##Path to max disk size key +$TenantGUID = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' ++if(!(Test-Path $HKLMregistryPath)){New-Item -Path $HKLMregistryPath -Force} +if(!(Test-Path $DiskSizeregistryPath)){New-Item -Path $DiskSizeregistryPath -Force} ++New-ItemProperty -Path $HKLMregistryPath -Name 'SilentAccountConfig' -Value '1' -PropertyType DWORD -Force | Out-Null ##Enable silent account configuration +New-ItemProperty -Path $DiskSizeregistryPath -Name $TenantGUID -Value '102400' -PropertyType DWORD -Force | Out-Null ##Set max OneDrive threshold before prompting +``` ++## Windows Image Prep requirements ++SilentAccountConfig creates a SilentBusinessConfigCompleted registry entry once SilentAccountConfig has successfully provisioned the user in OneDrive.exe. This prevents SilentAccountConfig from reprovisioning the user in OneDrive.exe if the user manually stops syncing. ++If SilentAccountConfig has successfully completed on a computer you're going to use to build a Windows deployment image (for example, SysPrep), you need to ensure this registry key is removed before you prepare your image. You can do so by running the following command: ++```console +reg delete HKCU\Software\Microsoft\OneDrive /v SilentBusinessConfigCompleted /f +``` ++<a name="VerifySilentAccountConfig"></a> +## Verify SilentAccountConfig ++### Instructions for SharePoint in Microsoft 365: +1. Unlink all pre-existing Business instances in OneDrive. ++2. Clear the registry of any previous successful Silent Business Config runs: ++ ```console + reg delete HKCU\Software\Microsoft\OneDrive /v SilentBusinessConfigCompleted /f + ``` ++3. Set the Silent Config policy registry entry (must be run from an administrator CMD window): ++ ```console + reg add HKLM\SOFTWARE\Policies\Microsoft\OneDrive /v SilentAccountConfig /t REG_DWORD /d 0x1 /f + ``` ++4. Sign out of Windows (Ctrl+Alt+Delete Sign out). ++5. Sign in to Windows. ++6. Shortly you should see a blue cloud icon in the notification area of the taskbar. Selecting the icon should show the activity center pop-up showing ongoing/recent activity from the first sync. If so, SilentAccountConfig has worked correctly. ++7. If instead you see the "Set up OneDrive" screen, SilentAccountConfig couldn't silently sign in or failed for another reason. Verify you completed these steps correctly by repeating them again. Follow the [Verify Single Sign On (SSO)](use-silent-account-configuration.md#VerifySSO) steps later in this article to confirm that SSO isn't a problem. Gather sync app logs to send to the engineering team for further help. ++### Instructions for SharePoint Server 2019 ++1. Ensure you can manually get the OneDrive sync app to sync content with your on-premises SharePoint Server 2019 before proceeding. See [Configure sync app for syncing with SharePoint Server](/sharepoint/install/configure-syncing-with-the-onedrive-sync-app) for details. ++2. Set the SharePointOnPremPrioritization reg key value to 1 (this ensures that SharePoint Server takes precedence over SharePoint in Microsoft 365, deleting the registry key to revert to SharePoint in Microsoft 365): ++ ```console + reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive /v SharePointOnPremPrioritization /t REG_DWORD /d 0x1 /f + ``` ++3. Follow steps 1 through 6 in the previous procedure for SharePoint in Microsoft 365. ++4. If instead, you see the "Set up OneDrive" screen, SilentAccountConfig was unable to silently sign in or failed for another reason. Verify you've completed these steps correctly by repeating them again. Gather sync app logs to send to the engineering team for further help. ++### To prevent Silent Business Config: ++```console +reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive /v SilentAccountConfig /f +``` ++<a name="VerifySSO"></a> +## Verify that Single Sign On (SSO) is working ++The most common reason for SilentAccountConfig to fail is the credentials aren't available to OneDrive.exe without user interaction. Follow these steps to determine if this is a problem in your case. ++If you have a computer, you think should work with SilentAccountConfig, you can manually verify that SSO is working correctly to ensure that the environment is configured correctly. + +1. Temporarily force ADAL on by running this command: ++ ```console + reg add HKCU\Software\Microsoft\OneDrive /v EnableADAL /t REG_DWORD /d 1 /f + ``` ++2. Shut down any running OneDrive.exe processes (verify in the Task Manager Details tab - Ctrl+Shift+Esc). ++3. Start menu - OneDrive, you should see the **Set up OneDrive** screen (if not unlink/stop syncing any business accounts and start over). ++4. Enter the same email address that the user used to sign into Windows (try alias@domain and domain\alias forms). ++5. Select the **Sign in** button. ++6. The dialog should switch to a "signing in" page with a spinning icon for a few seconds. It should then continue to the next part of the wizard without asking for a password. ++7. If a password prompt doesn't appear, your auth environment is properly configured and SilentAccountConfig should work for your users. ++8. If you do see a password prompt, the environment isn't configured properly for silent sign-on. This could be due to a problem with how the computer is domain joined (for example, a trust relationship problem), a problem with ADFS configuration, an Azure AD conditional access policy requiring user interaction, you didn't provide the same user email address as the one used to sign into Windows, or some other reason. You'll need to resolve whatever is blocking silent sign-on before SilentAccountConfig will work for you. ++9. Remove the EnableADAL key you added in step 1: ++ ```console + reg delete HKCU\Software\Microsoft\OneDrive /v EnableADAL /f + ``` ++> [!NOTE] +> When using SilentAccountConfig, you do not need to specify EnableADAL=1. This is only necessary when manually testing SSO in the above steps where we manually sign in (instead of using SilentAccountConfig to sign in). However, if you want users who manually set up OneDrive sync to benefit from SSO to minimize how often they need to enter a password in sync, you can deploy the EnableADAL key on your users' computers. |
| SharePoint | User External Sharing Settings | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/user-external-sharing-settings.md | + + Title: "Change the external sharing setting for a user's OneDrive" +++++audience: Admin +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++- Strat_OD_admin +- M365-collaboration ++search.appverid: +- ODB160 +- MET150 +ms.assetid: 64aa1f56-d7f6-4500-a408-1fde8fe6db36 +description: "Learn how to change the OneDrive external sharing setting for a user in the Microsoft 365 admin center." +++# Change the external sharing setting for a user's OneDrive ++After you set the organization-wide sharing settings for Microsoft SharePoint and Microsoft OneDrive, you can further restrict the external sharing for a specific OneDrive user. ++> [!NOTE] +> Instead of changing the external sharing setting for an individual user's OneDrive, you might want to block external sharing of sensitive information for all users. To learn how, see [Learn about Microsoft Purview data loss prevention](/compliance/dlp-learn-about-dlp). ++ +1. Sign in to https://admin.microsoft.com as a global or SharePoint admin. (If you see a message that you don't have permission to access the page, you don't have Microsoft 365 admin permissions in your organization.) + + > [!NOTE] + > If you have Office 365 operated by 21Vianet (China), sign in at https://login.partner.microsoftonline.cn/. Then select the Admin tile to open the admin center. + +2. In the left pane, select **Users** \> **Active users**. ++3. Select the user. ++4. Select the **OneDrive** tab, and under **Sharing**, select **Manage external sharing**. ++5. Select a new external sharing level, and then select **Save**. ++> [!NOTE] +> You can also change the external sharing setting for a specific OneDrive user by using Microsoft PowerShell and running the cmdlet Set-SPOSite with the parameter -SharingCapability. For more info, see [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite). + + |