This blog post will explain how to create Intune Policy Allows Syncing OneDrive Accounts only for Specific Organizations with block error 0x8004e4d1. The setting restricts which OneDrive accounts users can sync based on the organization’s approved domains and tenants.
This feature primarily enhances security by limiting OneDrive syncs to accounts associated with specific, trusted organizations. It helps prevent data from syncing to unauthorized or personal accounts, safeguarding sensitive company information.
This policy can be configured through Group Policy, the OneDrive Admin Center, or with tools like Microsoft Intune. By specifying allowed domains, administrators can control the syncing of OneDrive accounts on corporate devices, ensuring compliance with data protection and security policies. This is especially useful for organizations that must prevent accidental sharing of sensitive data with external or personal OneDrive accounts.
By enforcing this restriction, companies can maintain greater control over their data, reducing the risk of data breaches and unauthorized access. This policy is particularly valuable for businesses with stringent security requirements, as it limits file syncing and sharing to only those accounts that belong to trusted, predefined organizations.
Table of Contents
Why We Need to Allow Syncing OneDrive Accounts for Only Specific Organizations
Allowing OneDrive Accounts to be synced for only specific organizations can be necessary for several reasons, particularly in organizational or enterprise environments where data security, compliance, and productivity are paramount. Here are some key reasons.
| Key Reasons | Description |
|---|---|
| Data Security | Restricting syncing to specific organizations ensures that sensitive corporate data is not synced to unauthorized or personal OneDrive accounts, reducing the risk of data breaches, leaks, or accidental sharing with external parties. |
| Regulatory Compliance | Many industries are subject to strict regulations regarding data storage and sharing. Limiting syncing to approved domains helps organizations meet legal and regulatory requirements, ensuring that sensitive data remains within trusted environments. |
| Enhanced IT Control | Allowing syncing only for specific organizations gives IT administrators greater control over data flows. They can monitor and manage which accounts and devices have access to corporate data, improving data governance and making it easier to audit and secure shared files. |
| Preventing Data Loss | By enforcing restrictions, organizations can prevent users from inadvertently syncing data to non-corporate accounts, minimizing the risk of data loss due to unauthorized access or accidental deletion from unapproved platforms. |
| Consistent User Management | It enables centralized user management, allowing administrators to align account syncing with internal policies. Only trusted domains are allowed, ensuring that company data stays within a controlled and trusted infrastructure. |
- New Windows Autopilot Device Preparation Experience using Intune
- How to Set App Defaults using Intune | Export the Default XML File & Encode it in Base64 format
- Best Guide to Create a Local User with Intune Remediation Script
Create Allow Syncing OneDrive Accounts for Only Specific Organizations Configuration Policy in Intune
Follow the steps below to create an Allow Syncing OneDrive Accounts for Only Specific Organizations configuration policy with Microsoft Intune. Log in to the Microsoft Intune Admin Center using your Intune administrator credentials.
- Navigate to Devices > Windows > Configuration
- Click on +Create > +New Policy
- Intune Win32 App Supersedence and Auto App Update Explained
- Best Method to Add a Local User to Local Administrator Group with Intune Local User Membership Policy
In the next step, we can create a new Configuration Profile from scratch. First, we need to provide the options mentioned below.
- Platform: Windows 10 and later
- Profile type: Settings catalog
On the Basics details page, we can name the configuration profile “Allow Syncing OneDrive Accounts for Only Specific Organizations.” If needed, briefly describe the policy’s use and click Next.
We can now add the required settings to the Configuration Settings pane. To do so, click +Add settings in the bottom left corner of the page.
Search for “OneDrive Accounts for Only Specific Organizations” as a keyword. This will help you find the correct policy based on our current needs. Now you can see the browse by category found as OneDrive. Click that to find “Allow syncing OneDrive accounts for only specific organizations” Select the check option and close the Settings picker pane.
- Allow syncing OneDrive accounts for only specific organizations
Note! This setting lets you prevent users from easily uploading files to other organizations by specifying a list of allowed tenant IDs. If you enable this setting, users will get an error if they attempt to add an account from an organization that is not allowed. If a user has already added the account, the files will stop syncing. If you disable or do not configure this setting, users can add accounts from any organization. To block specific organizations instead, use “Block syncing OneDrive accounts for specific organizations.” This setting will take priority over the “Block syncing OneDrive accounts for specific organizations.” Do not enable both policies at the same time.
On the next page, toggle the Enabled option to Allow Syncing OneDrive Accounts for Only Specific Organizations, enter your organization’s Tenant ID under Tenant ID (Device), and click Next.
Note! Access the Microsoft Entra Admin Center with your credentials to check the Tenant ID. Navigate to Identity > Overview. Under the Basic information, you can find the Teanat ID
On the next page, Leave the Scope tags as Default. If you have any custom scope tags available, you can also select them for this policy assignment.
Click on Next and assign the configuration profile to HTMD – Test Computers. Then click Add Groups and select the required device group in the Included Groups option.
On the Review + Create page, carefully review all the settings you’ve defined for the “Block OneDrive Personal Sync” configuration. Select Create to implement the changes once you’ve confirmed everything is correct.
Monitor the Allow Syncing OneDrive Accounts for Only Specific Organizations Policy Deployment
This configuration has been deployed to the Microsoft Entra ID group (HTMD – Test Computers). Once the device is synced, the profile will take effect immediately. To monitor the profile deployment status from the Intune Portal, follow the steps below.
- Navigate to Devices > Windows > Configuration > Search for the “Allow Syncing OneDrive Accounts for Only Specific Organizations” configuration.
- Under the Device and user check-in status, you can see the policy’s deployment status.
End User Experience – Allow Syncing OneDrive Accounts for Only Specific Organizations Policy
We must check whether the Allow Syncing OneDrive Accounts for Only Specific Organizations policy worked. To check the same. Log in to one of the policy-targeted devices.
Search for the Microsoft OneDrive App on the Start menu and open it. To test this scenario, enter a corporate mail address using a different tenant ID, click Sign in, and enter the Password.
If the policy is successfully implemented, you will get a block message: “There was a problem connecting to OneDrive.” You don’t have access to this service. For help, contact your IT department. (Error Code: 0x8004e4d1)
Author
Vaishnav K has over 11 years of experience in SCCM, Device Management, and Automation Solutions. He writes and imparts knowledge about Microsoft Intune, Azure, PowerShell scripting, and automation. Check out his profile on LinkedIn.