Intune - OneDrive Configuration - Want to throw Microsoft away!

[J_Worth]

Hello all,

 

Has anyone on here managed to successfully get OneDrive to work reliably and every time when it's configured using a Device Configuration profile via Intune?

 

The machine shows that all the settings have been applied successfully, however, when a user logs in, OneDrive will not automatically sign in. It will sign in if you manually do it, but that defeats the object of setting it to silently sign in. This is also a very much needed policy as I can't have students and staff having to manually sign into OneDrive client whenever they log into a machine.

 

I've noticed that there's also no entry under Accounts -> Access work or school that says "Connected by username@domain Connected to school name's Entra ID".

 

This issue seems to affect the silently signing in of Edge as well. When a member of staff logs in, Edge prompts to sign into a profile rather than just working.

 

I've reverted back to Group Policy (except for a single test machine) as at least that's reliable and works each and every time.

 

Should it really be this difficult to get working using this "modern way" of managing machines!?

 

I'm all for going with Intune, but this sort of (basic!) thing just makes me have no faith in it. How can I trust it to work for our 700-odd machines, of which most have many students logging onto them throughout the day!?

 

Any help/advice gratefully received - I've got an open support ticket with Microsoft about this as well.

 

Here are the settings for OneDrive:

 

 

Thanks all!

[ZeroHour]

Hmm I dont use the exact same settings but it did work for me, is this Windows 11 or Windows 10?

Which version?

I will flatten my VM and see what happens with it.

[J_Worth]

Sorry! It's Windows 11 23H2

[cheekycharly]

Working for me here on W11 and W10.

 

There are three scope tags you want to enable.

 

Silently sign in users in the OneDrive sync app with their Windows credentials

 

Silently move Windows known folders to OneDrive

 

Use OneDrive Files On-Demand

[ckedu-local]

I ended up using the Admin Templates OneDrive settings, instead of the templates option. Seemed to be more reliable for me.

[J_Worth]

Working for me here on W11 and W10.

 

There are three scope tags you want to enable.

 

Silently sign in users in the OneDrive sync app with their Windows credentials

 

Silently move Windows known folders to OneDrive

 

Use OneDrive Files On-Demand

 

I've got all that enabled except from the Silently move Windows known folder to OneDrive.

 

I'm wondering if the issue is because the machine itself doesn't have a primary user attached so is marked as shared?

[J_Worth]

I ended up using the Admin Templates OneDrive settings, instead of the templates option. Seemed to be more reliable for me.

 

Can you clarify how you went about creating the profile? I created it by clicking "Templates" - "Administrative Templates" and then configuring these settings as required targeting Computer Configuration.

 

[J_Worth]

Interesting development here - it would appear as though if you delete a user profile from the machine and then log back in as that user, the Intune policies don't apply. When looking within the Intune admin console, it still shows the OneDrive configuration for that user (of which the user profile has been deleted) and still being successfully applied to the machine. It's as though somewhere on the machine it still knows that this particular user logged into it and that the settings are still current so it doesn't apply them again.

 

I'm also confused that a policy targeted to the machine gets stored against each user. For example with GPO, if we delete a user profile and that user logs back in, the GPO policies are applied immediately.

 

Am I just missing a trick here? Does Shared PC mode (with OneDrive Sync enabled) solve this issue?

[Wubbalubbadub]

Are you cloud managed only?

 

From Microsoft: If the computers on your network aren't connected to Active Directory on-premises, but only to Microsoft Entra ID, we recommend using Intune and a Microsoft PowerShell script to set the registry keys required to enable silent account configuration. Be sure you have automatic enrollment set up for Windows 10 or newer devices.

 

 $HKLMregistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive'##Path to HKLM keys
$DiskSizeregistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceCheckThresholdMB'##Path to max disk size key
$TenantGUID = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

if(!(Test-Path $HKLMregistryPath)){New-Item -Path $HKLMregistryPath -Force}
if(!(Test-Path $DiskSizeregistryPath)){New-Item -Path $DiskSizeregistryPath -Force}

New-ItemProperty -Path $HKLMregistryPath -Name 'SilentAccountConfig' -Value '1' -PropertyType DWORD -Force | Out-Null ##Enable silent account configuration
New-ItemProperty -Path $DiskSizeregistryPath -Name $TenantGUID -Value '102400' -PropertyType DWORD -Force | Out-Null ##Set max OneDrive threshold before prompting

 

This is what solved my issues when I was starting out with my cloud project some years ago.

 

Source: https://learn.microsoft.com/en-us/sharepoint/use-silent-account-configuration

[MYK-IT]

Here's our Intune Device Configuration for Intune (SSO, KFM etc.)

 

 

If you have specifically assigned / applied the 'Shared PC' policy (and not just removing the primary device owner) then the OneDrive client wouldn't be enabled or running at all, and you'd need to have an additional custom device configuration to apply a couple of custom OMA-URI settings (e.g. to enable the OneDrive client and to ensure that MDM Policy Supersedes Local Group Policy).

 

Are these devices pure Azure AD (e.g. cloud) or Hybrid? If the latter, the above does work on its own. And if Hybrid I'm assuming you have Azure AD Connect configured and syncing (devices and users) correctly etc?

 

 

 

Not sure if still a requirement, but for Hybrid devices we had the following Local GPO applied too:

 

Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List

 

https://device.login.microsoftonline.com 1

https://autologon.microsoftazuread-sso.com 1

https://{your unique m365 domain}-my.sharepoint.com 2

[J_Worth]

All the machines are connected to AD on-prem - I'm using Hybrid Entra ID Join and the machines are Co-Managed with Config Manager.

 

It's got to be something to do with deleting a user profile and then logging back into the machine as that user - Intune doesn't re-apply the settings as it assumes that it's already been applied so won't apply again.

 

How does everyone manage clearing stale profiles on Intune managed machines? I'm wondering if it's because I'm deleting the profile and then logging straight in as that user again - should I try waiting longer. I'm aware that Intune does reapply configuration profiles around every 8 hours. I've checked the device this morning in Intune and it still has the OneDrive configuration policy as showing as Succeeded; is Intune just not aware that these user profiles have now been deleted.

[J_Worth]

Here's our Intune Device Configuration for Intune (SSO, KFM etc.)

 

[ATTACH=CONFIG]71152[/ATTACH]

 

If you have specifically assigned / applied the 'Shared PC' policy (and not just removing the primary device owner) then the OneDrive client wouldn't be enabled or running at all, and you'd need to have an additional custom device configuration to apply a couple of custom OMA-URI settings (e.g. to enable the OneDrive client and to ensure that MDM Policy Supersedes Local Group Policy).

 

Are these devices pure Azure AD (e.g. cloud) or Hybrid? If the latter, the above does work on its own. And if Hybrid I'm assuming you have Azure AD Connect configured and syncing (devices and users) correctly etc?

 

 

 

Not sure if still a requirement, but for Hybrid devices we had the following Local GPO applied too:

 

Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List

 

https://device.login.microsoftonline.com 1

https://autologon.microsoftazuread-sso.com 1

https://{your unique m365 domain}-my.sharepoint.com 2

 

I've not yet applied the Shared PC policy to this machine - when the user logs into the machine the first time it all works exactly how it should. When they subsequently log into the machine, it all works. However, if I delete the user profile from the machine, when the user next logs in it doesn't.

 

They are Hybrid Entra ID Joined. Yep, both devices and users are synced correctly. The machine is enrolled into Intune without problems - device configuration is applying, endpoint policies and update rings are all applying and working. Even managed to get Intune Windows Feature policy sorted to push the device from Win 10 to Win 11 without any issues at all.

 

I've got those URLs (except the https://device.login.microsoftonline.com URL) added to a group policy that's applied to user (I've not got any Intune user targeted policies - these are all still GPO and the way it's going likely to remain like that!!). I'll create a config profile and add those URLs and target it at the machine.

 

Just to point out - I've never had any issues with any of this when the configuration was all applied via GPO - it's just since switching the OneDrive configuration to Intune that things have gone awry.

[MYK-IT]

All the machines are connected to AD on-prem - I'm using Hybrid Entra ID Join and the machines are Co-Managed with Config Manager.

 

It's got to be something to do with deleting a user profile and then logging back into the machine as that user - Intune doesn't re-apply the settings as it assumes that it's already been applied so won't apply again.

 

How does everyone manage clearing stale profiles on Intune managed machines? I'm wondering if it's because I'm deleting the profile and then logging straight in as that user again - should I try waiting longer. I'm aware that Intune does reapply configuration profiles around every 8 hours. I've checked the device this morning in Intune and it still has the OneDrive configuration policy as showing as Succeeded; is Intune just not aware that these user profiles have now been deleted.

 

To manage local profiles in general, we use Storage Sense (Device Configuration) policies; though that is to manage storage capacity.

 

For removal of a problematic profile, Control Panel > Advanced System Settings > User Profiles > Settings > Profiles stored on this computer.

 

We apply the OneDrive settings via Intune, for both hybrid and Azure AD (applied to the device).

[J_Worth]

To manage local profiles in general, we use Storage Sense (Device Configuration) policies; though that is to manage storage capacity.

 

For removal of a problematic profile, Control Panel > Advanced System Settings > User Profiles > Settings > Profiles stored on this computer.

 

We apply the OneDrive settings via Intune, for both hybrid and Azure AD (applied to the device).

 

Ok thanks - It's when I remove a profile via CP -> Advanced System Settings -> User Profiles -> Settings -> Select profile and delete that seems to break the automatic signing into OneDrive when the user logs back in again.

 

I'm applying the OneDrive settings in exactly the same way as you - to the device and these are Hybrid.

 

Interestingly, it seems to affect Microsoft Edge signing in as well - this is set to force sign in. When OneDrive doesn't automatically sign in, Edge also doesn't. Edge settings are still applied via user targeted GPO and this hasn't been touched.

[J_Worth]

If anyone can test my theory that would be great - delete the profile via advanced system settings and then log straight back in as the user who's profile has just been deleted. Does OneDrive sign in or does it get stuck?

[bjeffery]

Have you followed this to get working with shared device?

 

[georgeescott]

If anyone can test my theory that would be great - delete the profile via advanced system settings and then log straight back in as the user who's profile has just been deleted. Does OneDrive sign in or does it get stuck?

We've been configuring and testing OneDrive via Intune recently. I can confirm, this is also happening to us on our test devices.

 

OneDrive will auto-launch at login and silently sign-in on the first and subsequent logins, but it then stop's silently signing-in after removing the user's profile and signing in again.

 

We have some Entra-joined devices that have been autopilot-ed in both user-driven and self-deploying.

 

This is happening on both our user-driven devices (has a primary user and no Shared PC mode enabled) devices as well as our self-deploying (no primary user and Shared PC mode enabled) devices.

 

 

Have you followed this to get working with shared device?

 

There's a new OMA-URI policy setting EnableSharedPCModeWithOneDriveSync to get OneDrive working in Shared PC Mode which we're using rather than the 'legacy' workaround of DisableOneDriveFileSync and MDMWinsOverGP.

[J_Worth]

I finally got this working earlier - Microsoft support were useless.

 

It's an issue with the Microsoft.AAD.BrokerPlugin not being provisioned at login. As soon as I ran a PowerShell command to fix this, logged off and back on, it all worked as expected and without any issues. More information here: https://call4cloud.nl/2023/12/the-0xd000000d-job-2-nutty-by-intune/

 

Apparently there's a automatic troubleshooter that runs to resolve this for Education and Enterprise SKUs, however, I'm not sure when it runs as during the troubleshooting it didn't seem to silently kick in and resolve the issue. I don't have any shared PC policies set.

[georgeescott]

I finally got this working earlier - Microsoft support were useless.

 

It's an issue with the Microsoft.AAD.BrokerPlugin not being provisioned at login. As soon as I ran a PowerShell command to fix this, logged off and back on, it all worked as expected and without any issues. More information here: https://call4cloud.nl/2023/12/the-0xd000000d-job-2-nutty-by-intune/

 

Apparently there's a automatic troubleshooter that runs to resolve this for Education and Enterprise SKUs, however, I'm not sure when it runs as during the troubleshooting it didn't seem to silently kick in and resolve the issue. I don't have any shared PC policies set.

 

Sadly, I don't think this is the cause of our issue.

 

I've run the PowerShell commands to reinstall the Microsoft.AAD.BrokerPlugin plugin, as well as following Microsoft's article on this https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/automatic-authentication-fails, no change. Edge/Office apps will silently sign-in, it only seems to be OneDrive that doesn't (after the profile has been removed previously).

 

Back to MS support...

[georgeescott]

Back to MS support...

Still battling with MS Support on this one. Trying to get them to acknowledge it as an issue and not 'by design'.

 

It also affects SSO for all MS apps e.g. Edge, Word etc. after the profile has been deleted, not just OneDrive.

 

If you manually sign-in to an MS app after the profile has been previously removed e.g. OneDrive, the other MS apps then work, and on subsequent logins too. Very weird.

[_techie_]

The Templates settings then administrative templates seem to work way more reliably for me too, I've been designing an updated set of configurations using them and it seems way more reliable....