Replacing folder redirection and mapped network drives: Controlling the OneDrive client experience on Windows 10 with Intune

July 31, 2019

Replacing folder redirection and mapped network drives: Controlling the OneDrive client experience on Windows 10 with Intune

For as long as we can remember, the primary way to share files in an organization was mapped network drives. This may have included a “Public” or “Company” drive (e.g. P:\ for Public), as well as a “Home” or “User” drive (H:\ or U:\ respectively). As well, there may have been other departmental file shares, maybe mapped as other letters.

But Windows Server based file shares are looking more and more like the dinosaurs they are these days. They are clunky. They require either a local area network connection, or a VPN connection to use them. They do not support additional columns, views or metadata, nor do they provide robust search capabilities. If you want to share a file from this structure, it means attaching a copy of the file to an email, which then creates version sprawl and of course, there are now additional copies of that file “floating around” in the world and you no longer own or control that data.

SharePoint solves literally all of these issues. And many people love being able to break out of the confines of the clunky old mapped drive experience. But there is one little problem: nobody from the old world wants to access their files through a web browser. Nobody. Everyone (or most everyone) still wants the trusty, crusty old Windows File Explorer.

OneDrive client to the rescue

Well I have good news for you crusty types that just cannot let go of the past: the OneDrive client for Windows can help to bridge the adoption gap, and get your organization one step closer to ditching that old on-premises based file server.

OneDrive is not only a personal storage space for your own documents (like the Home or User drive), but the OneDrive client app will also be able to sync shared locations in SharePoint down to the client device, and display them in File Explorer–just like mapped drives. NOTE: You must have Windows 10 version 1709 or later, and preferably version 1903.

The settings that we need to enable this experience are:

Silently sign in users to the OneDrive sync client with their Windows credentials, because we want the setup to be seamless and easy for the end user (NOTE: the machine must be Azure AD Joined or Hybrid Joined for that to work);
Use OneDrive Files On-Demand, so we don’t have to sync literally every file to the local device–instead they can be left in the cloud and synced on-demand;
Silently move Windows known folders to OneDrive will turn on Known Folder Move also known as the “Backup” feature–this will sync the local Desktop, Documents and Pictures folders, similar to redirected folders in the past
And last, Configure team site libraries to sync automatically, because we would like to have the “mapped drives” show up in File Explorer without the user needing to “do” anything themselves

Rather than going up to each and every Windows 10 device to make these changes happen for the user, we can use modern Device management (Intune) to make this easy for everyone.

Step-by-Step

Before you begin go fetch the tenant ID from Azure AD admin center > Azure Active Directory > Properties blade. Copy the Directory ID.

Return to Intune, go to Device configuration > Profiles. Pick Create Profile. Give this a name like Windows 10 OneDrive Config, and a description similar to the one pictured. Pick Windows 10 and later as the Platform, and Administrative Templates as the Profile type. Click Create.

Under Settings, type “onedrive” in the search field to filter your choices.

Scroll down to find and enable the following settings:

Silently sign in users to the OneDrive sync client with their Windows credentials: Enabled.

Use OneDrive Files On-Demand: Choose Enabled. OK.

Silently move Windows known folders to OneDrive: Choose Enabled. Paste the Directory ID from the Azure AD admin center into the Tenant ID field. Click OK.

In case the client fails to silently configure, you can also enable the policy to prompt the end-user to complete the setup (Microsoft recommends this if you read the setting descriptions). I use the silent option only, and have not run into problems on 1903.

Now you should have all of the settings necessary for the initial configuration of the OneDrive client:

Under Assignments you can target a pilot group to test drive this policy out.

How to sync SharePoint library locations automatically to File Explorer using Intune and OneDrive

To map a SharePoint library just like a mapped network drive, create another new configuration profile, selecting Windows 10 and later, and Administrative Templates as the type. Filter the Settings list to “OneDrive” specific settings again, then choose the option Configure team site libraries to sync automatically (I usually pick the User Setting Type).

Click Enabled. As you will see, to configure this setting, it is necessary to retrieve the library ID for each library you wish to sync.

Therefore, navigate to the library in SharePoint Online. (1) Click Sync at the top, then (2) Cancel out of the prompt to Open Microsoft OneDrive?, finally (3) Copy library ID.

Back in the configuration profile, paste the library ID into the field called “VALUE” and give it a friendly name.

Under Assignments, you can scope these policies to the proper groups.

Note: The best way to map multiple libraries is by using a single device configuration profile, and entering multiple libraries within it. So for instance if you have a company-wide library and a departmental library, you would map both of them together in one profile. Therefore, first think about who needs access to which libraries, and then target the appropriate groups of users under Assignments, that way.

Fine print on mapped libraries

Be sure to read this fine print here.

Small orgs will not have a problem with the 1,000 devices limit. But again it requires Fall Creator’s update 1709 or later to work (and 1903 is preferred in general for applying these admin templates). Oh, and you might have to wait up to 8 hours for this setting to take effect. Yep. You read that right. In my testing this held true. Sometimes a device would pick up the change within 2-4 hours, and others it wouldn’t show up until the following day, after I made a change to the policy.

On the client machine, you will not be able to get this to happen any faster using a reboot, or the manual MDM sync option under Settings > Accounts > Work and school

Nor will it work to manually run the scheduled task that pulls down a policy refresh, as it does for making certain other changes to the configuration profiles: Computer Management > Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt > {GUID} > Schedule #3 created by enrollment client

I thought for sure this is why they say up to 8 hours, because this task only repeats every 8 hours. But apparently this has no bearing on the settings that control OneDrive sync / library mappings. So it’s still a mystery to me what the wait is all about. It is disappointing, but aside from that–everything works beautifully.

Libraries that you configure to sync will eventually show up in File Explorer alongside OneDrive, under another icon that features your company’s name (as it appears in the admin portal under Settings > Organization profile).

Replacing folder redirection and mapped network drives: Controlling the OneDrive client experience on Windows 10 with Intune