INTUNE-022: OneDrive sync restrictions
- Platform
- Entra ID / M365
- Category
- Intune / Endpoint Management
- Severity
- Medium
- Zero Trust pillar
- Devices (weight 3)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
OneDrive sync client settings control how corporate files are synchronized between cloud storage and managed devices, and unrestricted sync can lead to corporate data being stored on unmanaged or non-compliant devices. Without domain restrictions on the sync client, users may sync corporate SharePoint and OneDrive content to personal devices outside of IT control. Proper sync restrictions prevent data leakage through unmanaged file synchronization.
Recommended value
OneDrive sync restricted to domain-joined or Intune-managed devices; Known Folder Move enabled for backup; Files On-Demand enabled
Remediation
Configure the OneDrive sync client through Intune to restrict synchronization to devices that are Azure AD joined or Intune managed using the tenant allow list. Enable Known Folder Move to automatically redirect Desktop, Documents, and Pictures to OneDrive for data protection and enable Files On-Demand to minimize local data storage. Block sync of personal OneDrive accounts on corporate devices if permitted by organizational policy to prevent data commingling.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| not-implemented | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-19