Intune and SharePoint enforce OneDrive sync tenant restriction together

In a lot of my Microsoft 365 projects, IT, compliance and occasionally the works council now push hard for strict OneDrive sync tenant restriction. The concern is easy to understand. If users can sync sensitive files to personal Microsoft accounts or some random tenant, you end up with shadow IT, data leaks and compliance trouble. With the Intune Settings Catalog and a few SharePoint admin controls, you can put a stop to unmanaged OneDrive sync. Below is how I set up tenant restriction for OneDrive sync in customer environments, along with the things I've learned to watch for.

Two Intune settings block foreign tenants and personal accounts

In the Intune Settings Catalog, OneDrive sync tenant restriction comes down to two settings: Allow syncing OneDrive accounts for only specific organizations (AllowTenantList) and Block syncing OneDrive accounts for personal accounts (DisablePersonalSync). AllowTenantList takes a list of tenant IDs, and users can then sync only with those organizations. That shuts out personal Microsoft accounts as well as external business tenants. Use your tenant ID exactly as the Entra ID portal shows it on the Overview page, so no typos creep in.

Pro tip: Copy the tenant ID straight from the Entra ID portal every time. Typing it by hand is a reliable way to generate sync tickets you'll be chasing for weeks.

I deploy both settings as an Intune Settings Catalog profile assigned to all corporate Windows devices. One tenant ID is enough in most environments, though you can add more for mergers or hybrid coexistence. I always turn DisablePersonalSync on. The settings apply to Windows 10 and 11 alike, so unmanaged sync has no hiding place.

A few extra settings keep the user experience in good shape

Tenant restriction alone doesn't make a good configuration. I set Files On-Demand as the default in every deployment, because it keeps local disk usage reasonable even with large libraries. Silent account configuration is something I wouldn't skip, since it signs users in to OneDrive automatically with no extra prompts. Storage Sense, which you configure through Windows policies, frees up space by offloading files that haven't been used. You can set all of this in Intune. Files On-Demand and silent sign-in sit under OneDrive, and Storage Sense is in the Windows section.

A minimal AllowTenantList Intune config profile could look like this when exported as JSON:

{
  "@odata.type": "#microsoft.graph.deviceConfiguration",
  "displayName": "OneDrive sync: block foreign tenants",
  "oneDriveAllowTenantList": [
    "abcd1234-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ],
  "oneDriveDisablePersonalSync": true
}

Apply in Intune → Devices → Configuration profiles → Settings catalog (requires an Intune licence and admin rights).

The SharePoint admin center blocks sync on unmanaged or non-domain devices

Client-side controls only cover part of the picture, so I add server-side restrictions as a second layer. In the SharePoint admin center, go to Policies → Access control → Unmanaged devices → Sync restrictions and enter the AD domain names you allow. From then on, only devices joined to your approved domains (traditional or Entra ID/AAD-joined) can sync SharePoint and OneDrive files. If you have BYOD, partner devices or older clients that Intune doesn't manage, you really need this.

The official docs and the guide to restricting sync by domain go through the steps and the domain options in more detail.

The layers only work when they fit together

From what I see, Intune on its own does the job when every PC is managed and the old GPOs are gone. Hybrid or messier environments are different. Legacy policies such as "allow sync only on specific domains" via GPO can still be active there and may even get in the way. In regulated industries or on high-value endpoints, I combine every layer available: the Intune Settings Catalog, sync restrictions in the SharePoint admin center and, where edge cases call for it, domain-based GPOs.

The simplified flow below shows where device and tenant sync gets enforced:

flowchart TD
    Device["Company device"] --> Intune["Intune policy: AllowTenantList"]
    Intune --> OneDriveApp["OneDrive client"]
    OneDriveApp --> SharePointAdmin["SharePoint admin center policy"]
    SharePointAdmin --> CloudSync["OneDrive/SharePoint cloud sync"]

Figure: Where OneDrive sync restrictions apply on the way from endpoint to cloud

Tenant Restrictions v2 and Known Folder Move give you even more control

If that still isn't enough, Tenant Restrictions v2 is the next step. It blocks sign-in or data access to other Microsoft 365 tenants no matter which client, browser or app is used, which helps against shadow IT and users mixing accounts. I describe a practical setup in Tenant restrictions v2: Stopping data leaks to rogue tenants. I'd also roll out Known Folder Move through Intune so Desktop, Documents and Pictures always sync to the correct tenant. My notes on that are in OneDrive Known Folder Move with Intune: pitfalls and health checks.

I treat tenant restriction as mandatory, not optional

If you take security and compliance seriously, OneDrive sync tenant restriction is no longer up for debate. The tooling is mature. Still, my experience is that these settings only hold up if you review and test them regularly, particularly when your management model shifts toward hybrid join, cloud-only or BYOD. Write down your configuration, look at it again at least once a year and follow what changes in Intune and SharePoint. That way you can show that your data stays where it's supposed to.