AdminPackStudio

Posted on Oct 15

Intune OneDrive Known Folder Move Not Working: A Read-First Silent Sign-In and Policy Triage

#intune #onedrive #windows #sysadmin

You deployed Silently move Windows known folders to OneDrive (and usually Silently sign in users to the OneDrive sync app with their Windows credentials) from Intune. The Settings catalog profile shows Succeeded. A week later half the fleet still has Desktop and Documents under the local profile, Manage backup is greyed out or errors, and the ticket queue says "OneDrive Known Folder Move not working."

Hold off on wiping the user profile or recreating the Intune policy. Known Folder Move (KFM) is a short chain: Intune delivers the OneDrive policy keys → the tenant ID and folder checkboxes are correct and nothing blocks KFM → OneDrive.exe is signed in to the work account (SilentAccountConfig) → the sync app is healthy enough to evaluate KFM → each folder passes Microsoft's folder-backup eligibility checks → the known-folder paths actually point into OneDrive. Most "KFM not working" tickets die at a wrong or missing tenant ID, SilentAccountConfig never completing (interactive MFA / no SSO), or a leftover Folder Redirection / Prohibit-redirect GPO — not at "OneDrive is broken."

If the device is not enrolled or nothing from Intune is landing, use the Company Portal / device not syncing triage first. If silent sign-in fails because the device has no Primary Refresh Token, use the AzureAdPrt : NO triage. This one is for when Intune is healthy and the OneDrive KFM policy is the problem.

TL;DR

Silent KFM writes KFMSilentOptIn = your tenant ID (string) under HKLM\SOFTWARE\Policies\Microsoft\OneDrive. Wrong GUID, empty value, or policy never landed = folders never move. Optional per-folder DWORD keys are KFMSilentOptInDesktop / Documents / Pictures = 1.
Pair silent KFM with SilentAccountConfig (SilentAccountConfig = 1). Microsoft recommends both. Silent sign-in needs an Entra joined or hybrid joined device and credentials available without user interaction. Microsoft documents that SilentAccountConfig will not work for users who require multifactor authentication that needs interaction.
Legacy Windows Folder Redirection GPOs for Desktop/Documents/Pictures block OneDrive KFM until you transition them per Microsoft's redirect-known-folders guidance. Prohibit User from manually redirecting Profile Folders = Enabled fails the move with 0x80070005.
Also deploy the prompt policy (KFMOptInWithWizard = tenant ID) alongside silent move. Microsoft: if silent move fails, users get prompted to fix the error and continue.
Roll out slowly. Microsoft recommends limiting silent KFM on existing devices to about 1,000 devices a day and 4,000 a week (shared with macOS in the published guidance).
Device truth is registry under HKLM\SOFTWARE\Policies\Microsoft\OneDrive, OneDrive signed-in state, and the folder paths themselves — not the Intune "Succeeded" chip alone.

Where in the chain did it break?

Step	What happens	Typical symptom when it breaks
1. Policy lands	Settings catalog / ADM OneDrive settings assigned; HKLM policy keys present	Intune Succeeded but no `KFMSilentOptIn` / `SilentAccountConfig` on the device
2. Tenant ID + folders	`KFMSilentOptIn` = correct tenant GUID; Desktop/Documents/Pictures selected	Keys present but wrong GUID; only some folders selected; Block KFM also enabled
3. Conflicts cleared	No KFMBlockOptIn block; Folder Redirection GPO transitioned; Prohibit-redirect Disabled/Not configured	0x80070005; folders already redirected to a file share; empty Desktop after move to another org
4. Silent sign-in	OneDrive.exe signed in to the work account without a setup prompt	"Set up OneDrive" every logon; SilentAccountConfig = 1 but cloud icon never settles
5. Sync app healthy	Current OneDrive.exe; `PreSignInSettingsConfig.json` present; not SharePoint Server-only sync	KFM option missing; eligibility checks never run
6. Folder blockers	Path length, file size, Choose folders, reparse points, nested known folders	Manage backup shows a specific folder error; silent move stops mid-folder
7. Paths verify	Desktop/Documents/Pictures shell folders point under the OneDrive root	Policy "applied," files still only under `%USERPROFILE%\Documents`

Pick one device that should have moved and did not, and one that did. Reading both at each step beats guessing from the Intune overview.

Step 1: Read whether the Intune OneDrive policy actually landed

In Intune, open the profile (Settings catalog with OneDrive settings, or the older Administrative Templates OneDrive profile) > Device status / User status for the test device. Then on the device, read the policy hive (elevated PowerShell, read-only):

$p = 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive'
if (-not (Test-Path $p)) { 'No HKLM Policies\Microsoft\OneDrive key — policy has not landed' }
else {
  Get-ItemProperty $p |
    Select-Object SilentAccountConfig, KFMSilentOptIn, KFMSilentOptInWithNotification,
                  KFMSilentOptInDesktop, KFMSilentOptInDocuments, KFMSilentOptInPictures,
                  KFMOptInWithWizard, KFMBlockOptIn, KFMBlockOptOut, FilesOnDemandEnabled,
                  DisableAutoConfig
}

Result	Meaning
Path missing	Assignment, filter, or MDM check-in problem — fix Intune delivery first (device not syncing)
Keys present	Policy reached the device; continue at Step 2
Only some keys	Split profiles / conflicting ADM vs Settings catalog; read which profile owns each setting

Microsoft's Intune education sample puts these under Devices > Configuration > Settings catalog > OneDrive: Silently move Windows known folders to OneDrive (with the five sub-settings: Desktop, Documents, Pictures, notification, Tenant ID) and Silently sign in users to the OneDrive sync app with their Windows credentials.

Step 2: Read tenant ID, folder selection, and Block settings

Registry (HKLM...\OneDrive)	Healthy silent KFM	Watch for
`KFMSilentOptIn` (string)	Your Entra tenant ID GUID	Typo, old tenant after migration, quotes/spaces pasted into Intune
`KFMSilentOptInDesktop` / `Documents` / `Pictures`	`1` for each folder you want, or all three omitted (Microsoft: omitting them moves all three by default)	You meant all three but only Desktop = 1
`KFMSilentOptInWithNotification`	`1` to toast after success; `0` / absent for quiet	Not a failure mode — informational
`KFMOptInWithWizard` (string)	Same tenant ID (prompt fallback)	Silent-only with no prompt = users never see why a folder failed
`KFMBlockOptIn`	Absent or not blocking	`1` = prevent users from moving known folders to OneDrive (and Microsoft: this setting does not take effect if silent or prompt KFM is enabled — still don't leave a fight between policies). `2` = redirect known folders back to the device
`KFMBlockOptOut`	`1` if you require users to keep folders on OneDrive	Fine once move succeeded; does not cause the first move
`SilentAccountConfig`	`1`	Missing while you expected silent sign-in
`DisableAutoConfig`	Absent / not preventing Entra auto sign-in	Bitmask `1`/`3` can block Entra auto sign-in

Confirm the tenant ID matches Entra:

# Device join tenant (read-only)
dsregcmd /status | Select-String -Pattern 'TenantId','AzureAdJoined','DomainJoined'
# Or from a signed-in admin session against Graph / portal: Entra ID > Overview > Tenant ID

KFMSilentOptIn must equal that GUID as a string value, not a DWORD.

Step 3: Read conflicts: Folder Redirection GPO and 0x80070005

Microsoft is explicit:

OneDrive KFM GPOs do not work if you previously used Windows Folder Redirection GPOs to redirect Documents, Pictures, or Desktop to a location other than OneDrive. Transition per Redirect and move Windows known folders to OneDrive (disable the old GPO carefully; migrate file-share content with Migration Manager when needed).
User Configuration > Administrative Templates > Desktop > Prohibit User from manually redirecting Profile Folders must be Disabled or Not configured. If Enabled, folders will not move.
Microsoft's user-facing Fix problems with folder backup doc maps error code 0x80070005 to that Prohibit-redirect policy. Files may already have been copied into identically named folders under OneDrive while the original locations look empty — move content back before retrying.

On a domain-joined / hybrid device, read the effective policy (read-only):

# RSOP-style hints (requires RSAT / gpresult). Look for Folder Redirection and the Prohibit setting.
gpresult /Scope User /v | Select-String -Pattern 'Folder Redirection','Prohibit User from manually redirecting','OneDrive','Known Folder' -Context 0,2

Also watch for folders already redirected to another organization's OneDrive: Microsoft warns that redirecting to your tenant then creates new empty Desktop/Documents/Pictures and leaves the old files behind.

Step 4: Read SilentAccountConfig and whether OneDrive is actually signed in

Silent KFM needs a signed-in work OneDrive. Microsoft's silent account configuration doc:

Check	Healthy	Broken pattern
Join type	Entra joined, or hybrid joined on a supported OS	Workplace joined / registered only; no Entra relationship
`SilentAccountConfig`	DWORD `1` under HKLM Policies\OneDrive	Key missing
Interactive MFA / CA	Sign-in possible without a password/MFA prompt for OneDrive	Microsoft: SilentAccountConfig won't work on devices for users who require multifactor authentication (interactive). CA grant controls that demand user interaction also break silent SSO
User-visible result	Blue/white cloud in the notification area; Activity Center shows sync — not endless Set up OneDrive	Setup wizard every sign-in
Prior success stamp	`SilentBusinessConfigCompleted` may exist under `HKCU\Software\Microsoft\OneDrive` after a successful silent provision	Stale image / Sysprep left the stamp so a new user never silent-provisions (Microsoft documents clearing these keys before sealing an image)

Microsoft's SSO verification (paraphrased, still read-only until you intentionally sign in): shut down OneDrive.exe, start OneDrive, enter the same UPN the user used for Windows, and confirm the wizard proceeds without a password prompt. A password or MFA prompt means fix SSO/CA/join before expecting SilentAccountConfig to work. For PRT failures, use the AzureAdPrt : NO triage.

# Read-only: is OneDrive running, and do silent-config stamps exist for this user?
Get-Process OneDrive -ErrorAction SilentlyContinue | Select-Object Id, Path
Get-ItemProperty 'HKCU:\Software\Microsoft\OneDrive' -ErrorAction SilentlyContinue |
  Select-Object SilentBusinessConfigCompleted, ClientEverSignedIn, OneAuthUnrecoverableTimestamp

OneAuthUnrecoverableTimestamp present is a signal Microsoft's silent-config troubleshooting calls out — clear it only when you are deliberately retesting silent sign-in (that is a change; park it for the change table).

Step 5: Read sync app health and KFM eligibility prerequisites

Read	Healthy	Watch for
OneDrive.exe build	Current production ring (About tab in OneDrive settings). Microsoft's eligibility KB discusses builds 18.151.0729.0012 and later for full KFM Settings behavior	Ancient Groove.exe-only installs; missing per-machine OneDrive
`%localappdata%\Microsoft\OneDrive\Settings\PreSignInSettingsConfig.json`	File present	Missing → Microsoft: check proxy / M365 URL allow lists (and AV interference in some cases)
Files On-Demand	`FilesOnDemandEnabled` = 1 recommended	Not required for KFM itself, but Microsoft recommends it with silent config
Sync target	OneDrive for work/school in Microsoft 365	Microsoft: Known Folder Move doesn't work for users syncing OneDrive files in SharePoint Server

$settings = Join-Path $env:LOCALAPPDATA 'Microsoft\OneDrive\Settings\PreSignInSettingsConfig.json'
Test-Path $settings

$od = @(
  "$env:LOCALAPPDATA\Microsoft\OneDrive\OneDrive.exe"
  "${env:ProgramFiles}\Microsoft OneDrive\OneDrive.exe"
  "${env:ProgramFiles(x86)}\Microsoft OneDrive\OneDrive.exe"
) | Where-Object { Test-Path $_ } | Select-Object -First 1
if ($od) { (Get-Item $od).VersionInfo | Select-Object FileVersion, FileName } else { 'OneDrive.exe not found' }

Step 6: Read folder-backup blockers (content and Choose folders)

When silent move fails, Microsoft recommends the prompt policy so the user (or you, on a test device) sees the reason. Official Fix problems with folder backup messages include:

Message / code	Meaning (Microsoft)	Read-first action
File exceeds the maximum path length in Windows	Full path including name ≥ 260 characters	Find long paths under Desktop/Documents/Pictures; shorten before retry
File exceeds the maximum file size	File over 250 GB	Move that file out of the known folder
The file name isn't allowed in OneDrive	Leading space or `\ / : * ? " < > \	`
The folder isn't selected for syncing	Known folder (for Pictures: also Screenshots / Camera Roll) unchecked under Choose folders	OneDrive Settings > Choose folders
Important folders aren't in the default locations	Folder contains another known folder or the OneDrive folder itself	Untangle nested Desktop/Documents/Pictures/OneDrive
0x80070005	Prohibit User from manually redirecting Profile Folders enabled	Step 3 — and restore copied content if originals are empty
Folder contains a reparse point	Junction / symlink inside the folder	Remove the reparse point (only ones you understand)
Folder protection is unavailable	Domain PC trying to protect folders into a personal MSA OneDrive	Sign in with the work account; Block personal sync if that is your standard

Silent move that "did nothing" with no dialog usually means Steps 1–4, not a content blocker. Content blockers show up once OneDrive is signed in and evaluates the folder.

Step 7: Read whether the known folders actually moved

# Shell known-folder paths for the interactive user
[Environment]::GetFolderPath('Desktop')
[Environment]::GetFolderPath('MyDocuments')
[Environment]::GetFolderPath('MyPictures')

# OneDrive commercial root is commonly under the user profile; confirm with the cloud icon > Settings > Account
Get-ChildItem $env:USERPROFILE -Directory |
  Where-Object { $_.Name -like 'OneDrive*' } |
  Select-Object FullName

Result	Meaning
Paths are under `...\OneDrive - <org>\Desktop` (etc.)	KFM succeeded for that folder
Paths still `C:\Users\<user>\Desktop` (etc.)	Move never completed — go back up the chain
Mix (Documents moved, Desktop not)	Per-folder checkbox, per-folder error, or prior successful move of only some folders (Microsoft: after a folder moves, silent policy won't affect that folder again even if you clear its checkbox)

For reporting at scale, Microsoft documents Enable sync health reporting for OneDrive (EnableSyncAdminReports = 1) so devices appear in OneDrive sync admin reports — useful after the pilot, not a substitute for the per-device registry read.

When a change is justified

Finding	Prefer	Avoid
No policy keys on device	Fix assignment/filter/sync; confirm Settings catalog OneDrive settings	Recreating the same profile without reading Device status
Wrong / empty tenant ID	Set `KFMSilentOptIn` (and prompt) to the current Entra tenant ID	Pasting the Organization name or domain instead of the GUID
SilentAccountConfig = 1 but Setup wizard every time	Fix join + SSO; exclude OneDrive from interactive MFA/CA only with a deliberate Conditional Access design	Turning MFA off tenant-wide
Folder Redirection GPO still redirecting Desktop/Docs/Pictures	Transition per Microsoft's redirect-known-folders article	Enabling KFM on top and hoping
0x80070005 / Prohibit redirect Enabled	Set that GPO to Disabled or Not configured; put files back if OneDrive copies left originals empty	Deleting the user profile to "reset OneDrive"
Silent move failed once, never retried	Deploy Prompt users to move Windows known folders to OneDrive with the same tenant ID; fix the listed folder error	Forcing KFM by manually moving folders and breaking app path assumptions
One folder already moved earlier	Treat that folder as done; fix remaining folders individually	Assuming clearing an Intune checkbox will un-move or re-move it (Microsoft: silent policy won't affect a folder again after it moved)
Fleet-wide first enablement	Pilot; stay near Microsoft's ~1,000 existing devices/day and ~4,000/week guidance; temporarily limit upload throughput if needed	Assigning silent KFM to All devices overnight
Imaging / Autopilot golden image	Clear `SilentBusinessConfigCompleted`, `ClientEverSignedIn`, `PersonalUnlinkedTimeStamp`, `OneAuthUnrecoverableTimestamp` before Sysprep per Microsoft	Sealing an image after a tech account silent-provisioned OneDrive
Need files back after a bad move	Stop backup for that folder from Manage backup, or follow your restore runbook	Randomly deleting the OneDrive hive

FAQ

Why is Intune OneDrive Known Folder Move not working when the profile shows Succeeded?
Succeeded means the MDM settings were applied. KFM still needs the correct KFMSilentOptIn tenant ID, a signed-in OneDrive work account, no Folder Redirection / Prohibit-redirect conflict, and folders that pass the backup eligibility checks. Read HKLM\SOFTWARE\Policies\Microsoft\OneDrive and the known-folder paths on the device.

Do I need SilentAccountConfig for silently move Windows known folders?
Microsoft recommends enabling silent account configuration when you configure the sync app, and the education Intune sample enables both together. Without a signed-in work account, silent KFM has nothing to move into. SilentAccountConfig itself requires Entra (or hybrid) join and sign-in without interactive MFA.

What is error 0x80070005 during OneDrive folder backup?
Microsoft's Fix problems with folder backup article: the Prohibit User from manually redirecting Profile Folders group policy is enabled. Content may already have been copied under OneDrive with empty originals — move files back, set the policy to Disabled or Not configured, then retry.

Why did only Documents move and Desktop stay local?
Either only Documents was selected in the silent policy, Desktop failed a folder-backup check (path, size, reparse point, Choose folders), or Desktop was moved in an earlier attempt (silent policy will not process that folder again). Use the prompt policy and Step 6–7 on the failing folder.

Does Known Folder Move work with SharePoint Server?
Microsoft documents that Known Folder Move does not work for users syncing OneDrive files in SharePoint Server. Use Microsoft 365 OneDrive for KFM.

Free checklist

Known Folder Move is often the first real "files land in Microsoft 365" control you turn on before you tighten Conditional Access around compliant or hybrid-joined devices. If silent sign-in is broken by a CA grant that always prompts, KFM stalls and so does every other Windows primary-refresh flow. The free Conditional Access pre-enforcement checklist keeps break-glass, pilot groups, and report-only review on one page:

👉 https://cashflow4375.gumroad.com/l/ujkqxb?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=intune-onedrive-known-folder-move-not-working

If you want the rest of the Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=intune-onedrive-known-folder-move-not-working

Admin Pack Studio; not affiliated with Microsoft. Steps 1–7 only read until you deliberately change a GPO, CA exclusion, or OneDrive backup toggle. Pilot SilentAccountConfig and KFM on a small user/device group first, and check current Microsoft docs for OneDrive policy registry values and Known Folder Move prerequisites.

DEV Community