Automatic User Sign-In, Known Folder Protection & New Device Restoration
Documentation Status: Current as of August 2026
This guide documents the recommended Microsoft Intune configuration for automating OneDrive for Business on organization-managed Windows devices. The goal is to provide a seamless new-device experience where the user's organizational OneDrive account is automatically configured after Windows sign-in and their protected files become available on the replacement device.
The configuration combines silent OneDrive account sign-in, Known Folder Move (KFM), and Files On-Demand. Together, these policies allow Desktop, Documents, and Pictures to be protected in OneDrive while avoiding the need for users to manually configure the OneDrive client on every new Windows device.
1. Title & Scope
Title: OneDrive Automation Configuration — New Device User Sign-In & File Restoration
Scope: This procedure covers Microsoft Intune configuration for automatically signing users into OneDrive with their Windows credentials, redirecting Windows known folders to OneDrive, enabling Files On-Demand, preventing personal OneDrive synchronization where required, and validating the user's OneDrive experience on a newly provisioned Windows device.
Target:
- Microsoft Intune Administrators
- Microsoft Entra ID Administrators
- Endpoint Management Teams
- Systems Administrators
- Help Desk and Desktop Support Teams
- Windows Deployment Teams
- Microsoft 365 Administrators
2. Purpose
- Automatically configure OneDrive for organizational users.
- Silently sign users into OneDrive using their Windows credentials.
- Redirect Desktop, Documents, and Pictures to OneDrive.
- Protect user files against device failure or replacement.
- Allow users to access their OneDrive content from a replacement Windows device.
- Reduce manual OneDrive configuration during new-device deployment.
- Reduce the amount of data that must be stored locally through Files On-Demand.
- Prevent users from accidentally configuring personal OneDrive accounts when required by policy.
- Provide a repeatable Intune deployment model for enterprise Windows devices.
3. Prerequisites
- Microsoft 365 tenant.
- Microsoft Entra ID.
- Microsoft Intune.
- Microsoft OneDrive for Business.
- Windows 10 or Windows 11 supported device.
- Microsoft Entra joined or supported hybrid-joined Windows device for silent account configuration.
- User assigned the appropriate Microsoft 365/OneDrive license.
- Microsoft Intune administrative permissions.
- Microsoft Entra tenant ID.
- OneDrive sync client installed on the target Windows devices.
- Existing OneDrive data synchronized to the user's organizational account.
4. Architecture Overview
The recommended design uses Microsoft Entra authentication as the foundation for automatic OneDrive account configuration.
Microsoft Entra ID
|
|
Windows Sign-In
|
v
OneDrive Silent Sign-In
|
v
OneDrive for Business
|
+------------+------------+
| | |
v v v
Desktop Documents Pictures
| | |
+------------+------------+
|
v
OneDrive Cloud
|
v
New Windows Device
|
v
Automatic Sign-In
|
v
User Files AvailableThe important distinction is that the user's files remain stored in the organization's OneDrive service. The new device establishes a new synchronization relationship with the same organizational account rather than copying the entire old computer.
5. Deployment Procedure
Step 1 — Obtain the Microsoft Entra Tenant ID
The OneDrive Known Folder Move policy requires the organization's Microsoft Entra tenant ID.
Retrieve the tenant ID from the Microsoft Entra admin center or another approved tenant-management source.
Example:
Tenant ID:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxUse the actual tenant ID for the organization. Do not use a user ID, subscription ID, or Microsoft 365 domain name in this field.
Step 2 — Open Microsoft Intune Admin Center
Sign in to the Microsoft Intune admin center using an account with the required configuration-policy permissions.
Navigate to the Windows configuration policy area:
Intune admin center
|
+-- Devices
|
+-- Manage devices
|
+-- Configuration
|
+-- Create
|
+-- New policyMicrosoft's current Intune Settings Catalog workflow uses Windows 10 and later as the platform and Settings catalog as the profile type for OneDrive configuration.
Step 3 — Create the OneDrive Configuration Profile
Configure the profile using the following values:
Platform:
Windows 10 and later
Profile type:
Settings catalog
Name:
OneDrive - Enterprise Automation
Description:
Automatically configure OneDrive sign-in, Known Folder Move,
Files On-Demand, and organizational sync settings.Step 4 — Add OneDrive Settings
Select Add settings and search for the OneDrive category.
The core configuration should include the following settings:
- Silently sign in users to the OneDrive sync app with their Windows credentials
- Silently move Windows known folders to OneDrive
- Use OneDrive Files On-Demand
- Prevent users from syncing personal OneDrive accounts
Microsoft's current Intune documentation specifically identifies silent sign-in, Files On-Demand, and blocking personal OneDrive accounts as common OneDrive Settings Catalog configurations.
Step 5 — Enable Silent OneDrive Sign-In
Locate:
OneDrive
|
+-- Silently sign in users to the OneDrive sync app
with their Windows credentialsSet the policy to:
EnabledThis allows users on Microsoft Entra joined Windows PCs to configure the OneDrive sync app without manually entering their credentials. Microsoft documents that this setting is designed for computers joined to Microsoft Entra ID.
Step 6 — Enable OneDrive Files On-Demand
Locate:
OneDrive
|
+-- Use OneDrive Files On-DemandSet the policy to:
EnabledFiles On-Demand allows OneDrive content to appear in File Explorer without requiring every file to be downloaded to the local device. New users who configure the sync client can therefore see online-only files while conserving local disk space. Microsoft currently recommends this setting as part of common Intune OneDrive configurations.
Step 7 — Configure Known Folder Move
Locate the OneDrive setting:
OneDrive
|
+-- Silently move Windows known folders to OneDriveEnable the policy and configure the organization's tenant ID.
Recommended configuration:
Silently move Windows known folders to OneDrive:
Enabled
Desktop:
Enabled
Documents:
Enabled
Pictures:
Enabled
Tenant ID:
<Microsoft Entra Tenant ID>
Show notification after folders are redirected:
NoMicrosoft's current OneDrive policy documentation identifies KFMSilentOptIn as the policy that silently redirects Desktop, Documents, and Pictures to OneDrive without user interaction.
Step 8 — Prevent Users from Disabling Known Folder Protection
If the organization's objective is to ensure Desktop, Documents, and Pictures remain protected by OneDrive, configure the policy that prevents users from redirecting their known folders back to the local PC.
OneDrive
|
+-- Prevent users from redirecting their Windows
known folders to their PC
Value:
EnabledMicrosoft documents this setting as a way to require users to keep their known folders directed to OneDrive.
Step 9 — Prevent Personal OneDrive Accounts
If organizational policy prohibits personal OneDrive synchronization on corporate devices, enable:
OneDrive
|
+-- Prevent users from syncing personal OneDrive accounts
Value:
EnabledMicrosoft documents that enabling this policy prevents users from creating new personal OneDrive synchronization relationships on the device.
Step 10 — Configure the OneDrive Update Ring
Configure the OneDrive sync client update ring according to the organization's endpoint-management strategy.
For most production environments, the Production ring provides a reasonable balance between feature availability and deployment stability.
OneDrive
|
+-- Set the sync app update ring
Update Ring:
ProductionMicrosoft documents the Production update ring as value 5 in the corresponding OneDrive policy configuration.
Step 11 — Configure Automatic OneDrive Startup
Configure OneDrive to start automatically whenever the user signs into Windows.
OneDrive
|
+-- Start OneDrive automatically when signing in to Windows
Value:
EnabledMicrosoft documents this policy as overriding the user's startup preference so that OneDrive automatically starts when the user signs into Windows.
Step 12 — Assign the Policy
Assign the configuration profile to the appropriate Microsoft Entra security group. A recommended deployment model is to use a pilot group before assigning the policy to the entire Windows device population.
Recommended deployment:
OneDrive-Pilot
|
v
Test Users / IT
|
v
Production Validation
|
v
All Managed Windows UsersMicrosoft recommends controlled deployment of silent Known Folder Move for existing devices. Current Microsoft guidance recommends limiting existing-device silent KFM deployment to approximately 1,000 devices per day and no more than 4,000 devices per week.
Step 13 — Sync the New Windows Device
Enroll the new Windows device into Microsoft Intune and sign in with the user's organizational Microsoft Entra account.
Allow the device to receive the OneDrive configuration profile.
A manual policy synchronization can be initiated from:
Settings
|
+-- Accounts
|
+-- Access work or school
|
+-- Organizational Account
|
+-- Info
|
+-- SyncStep 14 — Confirm OneDrive Automatic Sign-In
After policy processing, OneDrive should automatically establish the organizational account using the user's Windows credentials.
The user should not need to manually enter their Microsoft 365 password as part of the normal OneDrive setup process when the prerequisites for silent account configuration are satisfied.
Step 15 — Confirm the OneDrive Folder
Open File Explorer and verify that the user's organizational OneDrive appears in the navigation pane.
File Explorer
|
+-- OneDrive - <Organization>
|
+-- Desktop
+-- Documents
+-- Pictures
+-- Other OneDrive ContentStep 16 — Confirm Known Folder Move
Verify that the user's Windows Desktop, Documents, and Pictures folders are redirected to the organization's OneDrive location.
The files previously synchronized to OneDrive should become available through the new device without requiring the old computer to be present.
Step 17 — Confirm Files On-Demand
Verify that cloud content is displayed in File Explorer using OneDrive's cloud/file status indicators.
Files that are online-only should not consume the same amount of local disk space as files that have been downloaded to the device.
Step 18 — Confirm User Data Is Available
Open the user's OneDrive folder and confirm that expected folders and files are visible.
The purpose of this validation is not to confirm that every cloud file has been downloaded. Instead, verify that the user's OneDrive namespace is available and that Files On-Demand is functioning as designed.
6. New Device Replacement Workflow
The following workflow should be used when replacing a failed, lost, damaged, or retired Windows device.
OLD DEVICE
|
+-- User files synchronized to OneDrive
|
v
OneDrive Cloud
|
| Device Replacement
v
NEW WINDOWS DEVICE
|
+-- Windows Enrollment
|
+-- Microsoft Entra Sign-In
|
+-- Intune Policy
|
+-- OneDrive Silent Sign-In
|
+-- Known Folder Move
|
+-- Files On-Demand
|
v
USER DATA AVAILABLEThe replacement device does not need to be restored from a traditional full-computer image merely to recover the user's OneDrive data. The new device establishes a new OneDrive synchronization relationship with the user's organizational account.
7. Validation & Troubleshooting
- Verify the device is Microsoft Entra joined or otherwise meets the silent-sign-in requirements.
- Verify the user has the required Microsoft 365 license.
- Verify OneDrive is installed and running.
- Verify the Intune OneDrive policy is successfully assigned.
- Verify silent account sign-in is enabled.
- Verify Known Folder Move is enabled.
- Verify the correct tenant ID is configured.
- Verify Files On-Demand is enabled.
- Verify the organizational OneDrive folder appears in File Explorer.
- Verify Desktop, Documents, and Pictures are redirected as expected.
- Verify files previously synchronized to OneDrive are available.
- Verify OneDrive synchronization is healthy.
Issue: OneDrive Does Not Automatically Sign In
Verify that the Windows device is Microsoft Entra joined and that the user is signing into Windows with the organizational identity. Confirm that the silent sign-in policy has successfully applied to the device.
Microsoft specifically documents silent OneDrive sign-in as applying to computers joined to Microsoft Entra ID.
Issue: Desktop/Documents Are Not Redirected
- Verify Known Folder Move is enabled.
- Verify the correct tenant ID is configured.
- Verify the OneDrive client is running.
- Check for legacy Windows Folder Redirection policies.
- Check whether the folders were previously redirected.
- Check OneDrive synchronization status.
Issue: Files Appear but Are Not Downloaded
This is normally expected behavior when Files On-Demand is enabled. Files can appear in File Explorer as online-only content without consuming full local storage.
Issue: User's Old Files Are Missing
First verify that the files were successfully synchronized to the user's OneDrive account from the old device. Files that existed only locally on the old device and were never synchronized to OneDrive cannot be restored by OneDrive automation.
Issue: OneDrive Is Consuming Too Much Disk Space
Verify that Files On-Demand is enabled and review whether the user has selected individual files or folders to remain available offline.
Issue: KFM Deployment Causes Problems
Stop the broader deployment and validate the affected devices. Review existing folder redirection policies, permissions, local folder structure, OneDrive status, and application dependencies before continuing.
8. PowerShell Validation
Verify OneDrive Process
Get-Process OneDrive -ErrorAction SilentlyContinueCheck OneDrive Policy Registry Location
Get-ItemProperty `
-Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive" `
-ErrorAction SilentlyContinueCheck User-Level OneDrive Policy Configuration
Get-ItemProperty `
-Path "HKCU:\SOFTWARE\Policies\Microsoft\OneDrive" `
-ErrorAction SilentlyContinueUse registry validation as a troubleshooting aid. The policy names and registry locations should be interpreted according to the applicable OneDrive policy and current Microsoft documentation rather than assuming every setting is stored in the same registry hive.
9. Recommended Enterprise Configuration
For a typical Microsoft Entra joined and Intune-managed Windows environment, the following configuration provides a strong baseline:
OneDrive Enterprise Baseline
--------------------------------------------
Silent Account Sign-In:
Enabled
Files On-Demand:
Enabled
Known Folder Move:
Enabled
Desktop:
Enabled
Documents:
Enabled
Pictures:
Enabled
Prevent KFM Opt-Out:
Enabled
Prevent Personal OneDrive:
Enabled
OneDrive Auto Start:
Enabled
Update Ring:
Production
Deployment:
Pilot → ProductionMicrosoft's current documentation supports this combination as a common enterprise configuration pattern for Intune-managed Windows devices.
10. Important Limitations
- OneDrive is not a replacement for a full endpoint backup solution.
- Files must successfully synchronize before they can be recovered from OneDrive.
- Files stored outside the protected OneDrive locations may not be automatically protected.
- Applications are not restored by OneDrive.
- Windows configuration is not fully restored by OneDrive.
- Local application data is not automatically restored unless separately synchronized or managed.
- Users may have additional SharePoint or Teams content that requires separate synchronization configuration.
- Files On-Demand means cloud files may appear without being physically stored on the device.
11. Security Considerations
- Use Microsoft Entra authentication for organizational identity.
- Prevent personal OneDrive synchronization when required by policy.
- Use Intune RBAC to restrict configuration-policy administration.
- Use Microsoft Entra security groups for controlled deployment.
- Test KFM with pilot users before production deployment.
- Monitor OneDrive synchronization health.
- Review Microsoft 365 retention and data-governance requirements separately.
12. Escalation Path
- Level 1 — Help Desk: Verify user identity, Windows sign-in, OneDrive status, policy synchronization, and basic OneDrive availability.
- Level 2 — Endpoint Administration: Review Intune policy assignment, Settings Catalog configuration, Known Folder Move, Files On-Demand, OneDrive client health, and Windows device state.
- Level 3 — Identity / Microsoft 365 Administration: Review Microsoft Entra authentication, OneDrive account provisioning, Microsoft 365 licensing, SharePoint/OneDrive service configuration, and tenant-level restrictions.
- Level 4 — Microsoft Support: Escalate persistent OneDrive or Microsoft 365 service issues after collecting device information, timestamps, policy results, synchronization errors, and diagnostic data.
13. Deployment Checklist
- Microsoft Entra tenant ID confirmed.
- Microsoft Intune configuration profile created.
- Silent OneDrive sign-in enabled.
- Files On-Demand enabled.
- Known Folder Move enabled.
- Desktop protection enabled.
- Documents protection enabled.
- Pictures protection enabled.
- Known Folder Move opt-out restricted where required.
- Personal OneDrive synchronization restricted where required.
- OneDrive automatic startup enabled.
- Production update ring configured.
- Pilot group assigned.
- Pilot validation completed.
- Production deployment completed.
- New-device restoration tested.
14. Final Validation
The deployment should be considered successful when a test user can sign into a newly provisioned Windows device using their organizational credentials and OneDrive automatically establishes the user's organizational account.
The user's OneDrive content should become visible through File Explorer, while Desktop, Documents, and Pictures should be protected through Known Folder Move. Files On-Demand should allow cloud content to remain online-only unless the user or application requires local availability.