OneDrive Known Folder Move with Intune: silent setup and troubleshooting

To silently redirect Desktop, Documents and Pictures to OneDrive on Intune-managed Windows devices, create a Windows settings catalog profile that enables Silently sign in users to the OneDrive sync app with their Windows credentials and Silently move Windows known folders to OneDrive with your tenant ID, optionally add Prevent users from redirecting their Windows known folders to their PC, and assign it to device groups. Roll it out to existing PCs in waves of no more than 1,000 devices a day, and troubleshoot with the policy registry values, the OneDrive sync health dashboard and the folder backup error messages.

Who this is for and what you will have at the end

This guide is for endpoint and Microsoft 365 administrators who manage Windows devices with Microsoft Intune and want users' known folders backed up to OneDrive without asking them to do anything. Known Folder Move (KFM) is what users see as folder backup in OneDrive. It keeps the folders where users expect them while their contents sync to OneDrive, so files are protected and available on other devices.

At the end you will have:

• One Intune profile that signs users in to OneDrive and moves their known folders silently.
• A rollout plan that doesn't saturate your network or support desk.
• A way to confirm, per device and across the organization, that folders actually moved.
• Fixes for the errors that stop a folder from being backed up.

If you are also replacing file shares or migrating content, the Google Workspace to Microsoft 365 migration guide covers Migration Manager, and general sync problems that aren't specific to folder backup are covered in the OneDrive sync errors guide.

The policies that control Known Folder Move

All OneDrive policies can be set with Group Policy, Intune or the registry. The ones that matter for KFM, with the registry values they write under HKLM\SOFTWARE\Policies\Microsoft\OneDrive:

Two behaviors are worth knowing before you start. After a folder has been moved, the silent policy doesn't touch it again, even if you later clear that folder in the policy. And Microsoft recommends pairing the silent policy with the prompt policy, so that if the silent move fails, users are prompted to fix the error and continue.

Prerequisites

• Microsoft Entra joined devices for silent sign-in. The silent account configuration feature works on computers joined to Microsoft Entra ID.
• A current OneDrive sync app. Microsoft recommends upgrading to the latest available build before deploying KFM, and the sync health dashboard needs version 22.232 or later.
• Your tenant ID. In the Microsoft Entra admin center it is in the Tenant ID box on the Overview page.
• No conflicting folder policies. The Group Policy setting User Configuration > Administrative Templates > Desktop > Prohibit User from manually redirecting Profile Folders must be Disabled or Not configured. If Windows Folder Redirection points Desktop, Documents or Pictures anywhere other than OneDrive, KFM won't work until you transition (see Step 4).
• OneDrive in Microsoft 365. KFM doesn't work for users syncing OneDrive files in SharePoint Server.
• Bandwidth awareness. Users with large known folders upload a lot of data on first sync.

Step 1: Create the settings catalog profile

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Manage devices > Configuration and create a new policy.
3. Set Platform to Windows 10 and later and Profile type to Settings catalog, then select Create.
4. In Basics, give the profile a clear name, for example Windows - OneDrive - Known Folder Move, and a description.
5. In Configuration settings, select Add settings, choose the OneDrive category in the settings picker, and add:
   • Silently sign in users to the OneDrive sync app with their Windows credentials: Enabled.
   • Silently move Windows known folders to OneDrive: Enabled, with your tenant ID entered, the notification option set as you prefer, and the folders you want to move selected (or leave the folder options unset to move all three).
   • Prompt users to move Windows known folders to OneDrive: Enabled, with your tenant ID, as the fallback when the silent move fails.
   • Prevent users from redirecting their Windows known folders to their PC: Enabled, if users must not turn backup off.
   • Use OneDrive Files On-Demand: Enabled. Microsoft recommends keeping Files On-Demand on so users don't download everything to every device.
6. Optionally add Limit the sync app upload rate to a percentage of throughput for the first weeks. Microsoft suggests this temporarily for users with many files in their known folders, and disabling it once uploads are complete.
7. Assign scope tags if you use them, then go to Assignments.

Step 2: Assign to device groups

The KFM settings are computer settings (they write to HKEY_LOCAL_MACHINE). Microsoft's guidance for ADMX-backed settings in Intune is:

• Assigned to device groups, the settings apply to any user who signs in to those devices.
• Assigned to user groups, the settings apply to any device the user enrolls and signs in to, and a computer setting assigned through a user can affect other users of the same device.

For a controlled rollout, device groups are easier to reason about. Create a pilot group, then wave groups that you add to the assignment over time.

Step 3: Pace the rollout

Moving known folders triggers uploads of everything in them. Microsoft's recommendations:

A practical sequence is: IT pilot devices first, then a few hundred devices from different sites, then daily waves within the limits above. Watch the sync health dashboard and your network monitoring between waves.

Step 4: Transition from Windows Folder Redirection

If Folder Redirection is in place today, the path depends on where folders are redirected:

• Redirected to OneDrive already: disable the Folder Redirection policy, leaving the folders and contents in OneDrive, then enable the KFM policy. Known folders stay in OneDrive.
• Redirected to another local location: disable the Folder Redirection policy, leaving content at the redirected location, then enable KFM. The folders move to OneDrive.
• Redirected to a network file share: first use Migration Manager to copy the share contents into each user's existing Documents, Pictures or Desktop folders in OneDrive (don't select Preserve file share permissions if Migration Manager creates those folders). Then disable Folder Redirection, leaving content on the share, and enable KFM. The local folders merge with what you copied.

The OneDrive policies don't affect Music and Videos, so those can stay redirected with the Windows policy. Extending the scope of folders synced by OneDrive through Windows Folder Redirection isn't supported.

Also check for users whose folders are redirected to OneDrive in a different organization, for example after a merger. Redirecting them to your organization's OneDrive creates new, empty folders, and the user sees an empty desktop until they move their files across. Disable the old redirection first where you can.

Verify the deployment

In Intune

Open the profile under Devices > Manage devices > Configuration > Policies. The device and user check-in status shows Succeeded, Error, Conflict, Pending or Not applicable. Conflict means two settings are applied to the same device and Intune can't sort it out, so an administrator has to review which profiles set the same OneDrive values. Device assignment status lets you generate a report filtered to errors or conflicts, and the Monitor tab under Devices > Manage devices > Configuration has a Configuration policy assignment failures report for errors and conflicts across all profiles.

On a device

Confirm that the policy values arrived:

reg.exe query HKLM\SOFTWARE\Policies\Microsoft\OneDrive

You should see SilentAccountConfig, KFMSilentOptIn with your tenant ID, and any folder-specific values you configured. Note that the block policy appears as KFMBlockOptIn, not as its policy name.

Then check the user's experience: the OneDrive icon is signed in, and in OneDrive settings Manage backup shows Desktop, Documents and Pictures as backed up. In File Explorer, the known folders now sit inside the OneDrive folder.

Across the organization: sync health dashboard

The OneDrive sync health dashboard in the Microsoft 365 Apps admin center shows sync issues per device, app versions, and a Known folders card that tracks KFM rollout. To use it:

1. Enable the dashboard as an Office Apps Administrator in the Microsoft 365 Apps admin center.
2. Enable the Enable sync health reporting for OneDrive policy (EnableSyncAdminReports) on devices. It applies to Group Policy and Intune, so you can add it to the same settings catalog profile; the registry equivalent is:

reg.exe add HKLM\Software\Policies\Microsoft\OneDrive /v EnableSyncAdminReports /t REG_DWORD /d 1

3. Wait. It can take up to three days for devices to appear, and forcing a device to report isn't supported. The older SyncAdminReports key is no longer supported, so devices that only have that value won't show up.

The Devices tab lists each device with its health state and the known folders currently moved to OneDrive.

Troubleshooting

Most failures show up for the user as a folder backup error in OneDrive. If the silent move fails and the prompt policy is enabled, users are asked to fix the problem and continue.

Checklist

• Tenant ID collected from the Microsoft Entra admin center.
• No Prohibit User from manually redirecting Profile Folders policy, and Folder Redirection transitioned.
• Settings catalog profile with silent sign-in, silent KFM, the prompt fallback, Files On-Demand and, if required, the block opt-out setting.
• Optional upload rate limit for the first waves, removed afterwards.
• Assigned to device groups, pilot first, then waves within 1,000 devices a day and 4,000 a week.
• Policy values confirmed with reg.exe query on sample devices.
• EnableSyncAdminReports deployed and the sync health dashboard's Known folders card tracking progress.
• Folder backup errors triaged with the table above.

References

• Redirect and move Windows known folders to OneDrive
• Use OneDrive policies to control sync settings
• Configure OneDrive sync app settings with Intune
• Recommended sync app configuration
• OneDrive sync reports in the Apps Admin Center
• Find your Microsoft 365 tenant ID
• Monitor device configuration policies in Microsoft Intune
• Back up your folders with OneDrive