Configure OneDrive Auto Sign-in Using Intune: Complete Enterprise Guide

1. Open your browser and go to https://intune.microsoft.com
2. Sign in with an account that has Intune Administrator or Global Administrator rights
3. Navigate to Devices → Windows → Configuration
4. Click Create → New Policy

1. Select the following options:
   • Platform: Windows 10 and later
   • Profile type: Settings catalog
2. Click Create
3. On the Basics tab, enter:
   • Name: OneDrive - Silent Account Configuration
   • Description: `Automatically signs users into OneDrive sync app using Windows credentials. Deployed via Settings Catalog.
4. Click Next

1. Click + Add settings
2. In the Settings picker, search for: Silently sign in users to the OneDrive
3. Expand the OneDrive category
4. Select: Silently sign in users to the OneDrive sync app with their Windows credentials
5. Close the settings picker- Set the toggle to Enabled
6. Click Next

1. Select appropriate scope tags for your organization
2. If not using scope tags, leave as Default
3. Click Next

1. Click + Add groups
2. Select a Microsoft Entra security group containing:

• Pilot group first: Start with 50-100 test users
• Production rollout: Expand to larger groups after validation

3. Optionally add exclusion groups
4. Click Next

1. Review all configuration settings
2. Verify assignments are correct
3. Click Create

For complete OneDrive automation, combine Silent Account Config with Known Folder Move (KFM).

Recommended Additional Settings

Create a second Settings Catalog policy or add these to the existing profile:

Find Your Tenant ID

# Via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgOrganization | Select-Object Id, DisplayName

Or navigate to: Microsoft Entra admin center → Overview → Tenant ID

KFM Registry Verification

After deployment, verify these keys exist:

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]
"KFMSilentOptIn"="<Your-Tenant-ID>"
"KFMSilentOptInWithNotification"=dword:00000001

Deploy and Synchronize

Force Policy Sync

To expedite deployment during testing:

Method 1: Company Portal

1. Open Company Portal app
2. Go to Settings
3. Click Sync

Method 2: PowerShell

## Trigger Intune sync
$EnrollmentID = Get-ScheduledTask | Where-Object {$_.TaskPath -like "*Microsoft*Windows*EnterpriseMgmt*"} | Select-Object -ExpandProperty TaskPath -First 1
$EnrollmentID = $EnrollmentID.Split('\')[5]
Get-ScheduledTask | Where-Object {$_.TaskPath -eq "\Microsoft\Windows\EnterpriseMgmt\$EnrollmentID\"} | Start-ScheduledTask

Method 3: Settings App

1. Open Settings → Accounts → Access work or school
2. Select your organization connection
3. Click Info → Sync

Monitor Deployment Status

Intune Admin Center

1. Navigate to Devices → Windows → Configuration
2. Select OneDrive - Silent Account Configuration
3. Review the overview dashboard:
   • Succeeded: Policy applied successfully
   • Pending: Awaiting device check-in
   • Failed: Requires investigation
4. Click View report for detailed device-level status

Per-Device Report

For failed deployments, check:

1. Click on the device name
2. Review the Settings status section
3. Note any error codes for troubleshooting

Verify on Endpoint

Visual Verification

1. Log into the Windows device with a targeted user account
2. Look for the OneDrive cloud icon in the system tray
3. Blue icon: Signed in and syncing
4. Gray icon: Not signed in (policy may have failed)
5. Click the icon to verify the correct account is connected

Registry Verification

## Check policy deployment
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive" -Name SilentAccountConfig -ErrorAction SilentlyContinue

## Check silent config completion flag
Get-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name SilentBusinessConfigCompleted -ErrorAction SilentlyContinue

Expected values:

• SilentAccountConfig = 1
• SilentBusinessConfigCompleted = 1

Event Log Verification

## Query Intune diagnostic events
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" | 
    Where-Object {$_.Id -eq 814 -and $_.Message -like "*SilentAccountConfig*"} | 
    Select-Object TimeCreated, Message -First 5

Troubleshooting

Common Issues and Solutions

Issue 1: OneDrive Shows "Set up OneDrive" Instead of Auto Sign-in

Possible Causes:

• MFA is required for the user
• Device is not properly Entra ID joined
• Primary Refresh Token is missing or expired

Resolution:

# Verify PRT status
dsregcmd /status | Select-String -Pattern "AzureAdPrt"

# If AzureAdPrt : NO, try:
# 1. Lock and unlock the workstation
# 2. Sign out and sign back in
# 3. Run: dsregcmd /refreshprt

Issue 2: Policy Shows as Applied but OneDrive Not Configured

Resolution:

1. Clear previous silent config attempts:

# Run as the affected user
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "SilentBusinessConfigCompleted" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "ClientEverSignedIn" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "PersonalUnlinkedTimeStamp" -ErrorAction SilentlyContinue

2. Reset OneDrive:

& "$env:LOCALAPPDATA\Microsoft\OneDrive\OneDrive.exe" /reset
Start-Sleep -Seconds 10
& "$env:LOCALAPPDATA\Microsoft\OneDrive\OneDrive.exe"

Issue 3: Event ID 814 Shows Policy Error

Check the diagnostic log:

Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" -MaxEvents 50 | 
    Where-Object {$_.Message -like "*OneDrive*"} | 
    Format-List TimeCreated, Id, Message

Look for:

• Event ID 813: Policy processing started
• Event ID 814: Policy applied successfully
• Event ID 404: Policy application failed

Issue 4: Generate MDM Diagnostic Report

For escalation to Microsoft Support:

1. Go to Settings → Accounts → Access work or school
2. Select your organization
3. Click Info → Create report
4. Share the generated report with support

Rollback Procedure

To remove the policy configuration:

# Remove machine-level policy keys
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive" -Recurse -Force -ErrorAction SilentlyContinue

# Remove user-level completion flags
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "SilentBusinessConfigCompleted" -Force -ErrorAction SilentlyContinue

# Restart OneDrive
Stop-Process -Name "OneDrive" -Force -ErrorAction SilentlyContinue
Start-Process "$env:LOCALAPPDATA\Microsoft\OneDrive\OneDrive.exe"