imPC@ndo IT

Guides / intune

Block personal OneDrive sync on corporate devices with Intune

Stop users signing into personal Microsoft accounts on managed Windows devices. A Settings Catalog policy, no ADMX import, five minutes.

Your corporate Windows devices have OneDrive for Business configured — but what stops a user from also signing into their personal Microsoft account and syncing their home OneDrive? By default: nothing. This is a real data leakage risk: employees can copy sensitive files straight into personal cloud storage, bypassing all your DLP controls. Blocking it is a two-minute job in Intune’s Settings Catalog.

Why This Matters

Allowing personal OneDrive sync on corporate devices creates several tangible risks:

  • Data Exfiltration — Users can copy sensitive corporate files into personal OneDrive — completely outside your DLP and governance controls.
  • Malware Introduction — Personal OneDrive accounts aren’t subject to corporate security scanning. Infected files synced from personal storage can reach the corporate endpoint.
  • Compliance Violations — In regulated industries (healthcare, finance, legal), storing company data in personal cloud storage may directly violate GDPR, HIPAA, or SOC2 requirements.
  • Licensing Issues — Personal OneDrive runs outside your M365 licensing agreement, potentially creating liability for unauthorized corporate data storage.

Prerequisites

  • Microsoft Intune license (Plan 1 or above, included in M365)
  • Intune Administrator or Global Administrator role
  • Target devices running Windows 10 or 11 with OneDrive sync client installed
  • Devices Entra ID joined or Hybrid joined and enrolled in Intune

Creating the Configuration Profile

Create the Policy

  1. Sign in to intune.microsoft.com.
  2. Navigate to Devices → Windows → Configuration profiles.
  3. Click + Create → New Policy.
  4. Platform: Windows 10 and later — Profile type: Settings catalog.
  5. Click Create.

Basics

  1. Enter a name like OneDrive – Block Personal Account Sync.
  2. Add a description documenting the purpose and change ticket reference.
  3. Click Next.

Add the Setting

  1. On Configuration settings, click + Add settings.
  2. Search for OneDrive in the settings picker.
  3. Browse to the OneDrive category.
  4. Enable: Prevent users from syncing personal OneDrive accounts (User).
  5. Set the toggle to Enabled.
  6. Close the picker and click Next.

Assignments

  1. Target All devices for full coverage, or a specific Entra ID group to pilot first.
  2. Click Next.

Review + Create

  1. Confirm the setting shows: Prevent users from syncing personal OneDrive accounts (User) → Enabled.
  2. Click Create.

Verifying the Policy Applied

From Intune

  1. Open the policy in Intune → Device and user check-in status report.
  2. A Succeeded status on your test device confirms delivery.

From the Device (Registry)

On the target device, open Registry Editor and check:

HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoftOneDrive “DisablePersonalSync” = dword:00000001

Value 1 = policy is active on that user’s session.

What the User Sees

Users already syncing personal OneDrive

When the policy applies, the OneDrive sync client displays a notification that personal account syncing has stopped. Files already synced locally remain on disk — the policy does not delete them. Only the ongoing sync relationship is severed.

Users trying to add a personal account

Any attempt to sign in with a personal Microsoft account (@outlook.com, @hotmail.com, @live.com) is blocked with an error message. The setup cannot be completed.

Summary

Blocking personal OneDrive sync is a quick, high-value control that closes a commonly overlooked data leakage gap. In under five minutes in Intune, you can ensure that corporate endpoints only sync to company-managed cloud storage.

  • Create a Settings Catalog profile — no ADMX import
  • Enable “Prevent users from syncing personal OneDrive accounts (User)”
  • Assign to All Devices or pilot group
  • Verify via Intune report or DisablePersonalSync = 1 in registry

Original concept:cloudsecop.com — Original author: Aymen EL JAZIRI (Microsoft MVP)