Microsoft is rolling out a brand new function coming month that may immediate customers so as to add their private Microsoft account to OneDrive. Which means that, when the consumer accepts, private recordsdata shall be synced to your small business gadgets.
And even worse, it permits customers to simply (and by accident) save enterprise recordsdata into their private OneDrives. This fashion, you not solely lose monitor of firm knowledge, but it surely additionally permits the customers to share recordsdata with anybody, with none restrictions or auditing.
The roll-out of this new function is presently scheduled for June 2025, providing you with only some weeks to behave, as a result of this function is enabled by default!
The right way to Disable Immediate to Add Private Account to OneDrive
Private knowledge doesn’t belong on firm gadgets in my view, so I like to recommend disabling the immediate earlier than it’s rollout within the coming weeks. To do that, we are able to use two group coverage settings, and there may be additionally a setting for it in Intune.
Utilizing Group Coverage
There are two group insurance policies that we are able to use to stop syncing private OneDrives to our gadgets. The primary setting, DisablePersonalSync, isn’t new and can forestall customers from syncing private OneDrives utterly. The second coverage, DisableNewAccountDetection, will forestall the brand new immediate.
I like to recommend enabling each insurance policies so you might be certain that customers gained’t be syncing their private OneDrive and don’t get an pointless immediate:
- Open the Group Coverage Administration Console
- Create or Open your OneDrive Coverage Object
- Navigate to Consumer Configuration > Insurance policies > Administrative Templates > OneDrive
- Allow the setting “Forestall customers from syncing Private OneDrive accounts“
For the DisableNewAccountDetection coverage setting, you have to to just remember to have the most recent .adml and .admx recordsdata put in in your central retailer. You’ll find the most recent model on a consumer system the place OneDrive is put in within the folder:
%ProgramFilespercentMicrosoft OneDrive<BuildNumber>adm
Copy the OneDrive.adml and OneDrive.admx to the central retailer in:
\<area>sysvoldomainPoliciesPolicyDefinitions
Now, reopen the Group Coverage Administration console and return to your OneDrive coverage. Allow the next settings:
- Navigate to Laptop Configuration > Insurance policies > Administrative Templates > OneDrive
- Allow the setting “Disable a toast and exercise middle message to encourage a consumer to register OneDrive utilizing an current credential that’s made accessible to Microsoft purposes“
Utilizing Intune
When you’ve got Intune, then you may allow the setting “Forestall customers from syncing private OneDrive accounts (consumer)”. This isn’t a brand new setting, however also needs to work for the upcoming modifications. I’m not certain if this can even block the immediate, however I count on it will.
If you wish to make certain, then you may all the time roll out the registry merchandise under.
Utilizing Registry
In case you can’t use a GPO or Intune, then it’s also possible to set the next registry keys within the consumer gadgets to disable the OneDrive private immediate:
[HKLMSOFTWAREPoliciesMicrosoftOneDrive]"DisableNewAccountDetection"=dword:00000001
[HKCUSOFTWAREPoliciesMicrosoftOneDrive]"DisablePersonalSync"=dword:00000001
Wrapping Up
Whereas doing a little analysis for this text, I seen that this function isn’t new. It has appeared early on the Microsoft roadmap beneath ID 146851 and within the message middle beneath MC626577. From what I might discover, the function was canceled, however I can’t discover any extra data on it.
As talked about, private recordsdata don’t have a spot on enterprise gadgets in my view, so I like to recommend enabling the insurance policies to stop the upcoming immediate.
