[1809, ou] Onedrive silent config

[synaesthesia]

Scratching my head with this

 

Office 365, Windows AD and hybrid AAD via Azure AD. Passwords are synced via password hash.

Office applications sign in automatically to currently logged on user instantly with no issues, as do all browsers when going to login.microsoftonline.com (or 365 email).

But Onedrive will not sign in automatically at all. I think I've got it to do it, accidentally once, but never again.

 

ADAL is enabled (although shouldn't be necessary any more if I understand correctly)

Onedrive is latest version (19.062)

User settings contains the following within Admin Templates>OneDrive

 

Coauthor and share in Office desktop apps Enabled  
Disable the tutorial that appears at the end of OneDrive Setup Enabled  
Prevent users from syncing personal OneDrive accounts Enabled  
Set the default location for the OneDrive folder Enabled (with tenant ID entered)

 

Workstation settings contains the following

 

Allow syncing OneDrive accounts for only specific organizations Enabled 
Set the maximum size of a user's OneDrive that can download automatically Enabled 
Set the sync client update ring Enabled 
Silently sign in users to the OneDrive sync client with their Windows credentials Enabled  
Specify SharePoint Server URL and organization name Enabled 
Use OneDrive Files On-Demand Enabled 

 

Yet nothing

Anything I'm missing?

[free780]

If you manually type the UPN does it autologin?

[synaesthesia]

Instead of the straight logon name? unfortunately not.

[chrisjako]

Assuming you are synchronising devices in AD via the AD connect then

go to portal.azure.com

click on azure aD

go to devices

search for your machine - is it registered as pending? if so open up command prompt as admin and type

 

dsregcmd /leave

 

Delete the device from Azure AD (as in the above search)

 

reboot

 

this should fix your issue

[mullet_man]

I only have these set on the computer policy and it works for me. Have you got the tenant ID correct?

 

Prompt users to move Windows known folders to OneDrive Enabled

Silently move Windows known folders to OneDrive Enabled

Show notification to users after folders have been redirected: Yes

Silently sign in users to the OneDrive sync client with their Windows credentials Enabled

[sjatkn]

I've just been working this and found two things.

 

1. There is a pre-existing GPO that is interfering with the silently sign in users setting. I ended up moving the OneDrive SSO GPO to the top of the list. I may now start moving it back down to see at which point it stops working.

2. If the user has MFA enable in Office 365 then silent sign in does not work. I've seen other pages elsewhere saying the same, but I've proved it myself by signing in with two different accounts, one with MFA and one without. I must go find / report a uservoice article on this.

[sjatkn]

1. There is a pre-existing GPO that is interfering with the silently sign in users setting. I ended up moving the OneDrive SSO GPO to the top of the list. I may now start moving it back down to see at which point it stops working.

It looks like it may well be something to do with proxies. I found a Microsoft docs page which I have since lost that said WPAD needed to be configured for automatic proxy configuration. I've just tweaked my auto config and now even my MFA account is working, though I use conditional access in school to only require it for external logins.

 

2. If the user has MFA enable in Office 365 then silent sign in does not work. I've seen other pages elsewhere saying the same, but I've proved it myself by signing in with two different accounts, one with MFA and one without. I must go find / report a uservoice article on this.

As mentioned this may not be a problem any longer now I've tweaked the WPAD proxy config. Though as I have conditional access enabled I don't require MFA in school, only for external logins.