I'm using OneDrive for Business and the Sync app (latest and on production ring) on Windows 10 22H2 Enterprise machines. They are all HAADJ (Hybird AzureAD Joined). As part of our Pilot group users have been giving us feedback on their experience and one thing that has come up accross the board is the following: On first launch of the sync app the users must supply their e-mail address/password and MFA to setup Since the system is Hybrid joined we thought that silent configuration would be possible so we configured the required group polices as per this guide . However, new users that have this policy applied to thier machines still report the same experience. So this raises several questions: What is the expected experience with Onedrive silent configuration? If MFA is enabled is it just an MFA prompt? Is this supported on HAADJ machines (documents stet it is)? How to troubleshoot this?

Hi @shockoMS 1 If OneDrive use Windows Primary Account to sign in automatically without user interaction, SilentAccountConfig works correctly. But if you have enabled MFA, then it won't work . The following image is from " Enable silent configuration " part. 2 According to " Prerequisites ", Hybird AzureAD (Microsoft Entra hybrid) joined devices are supported. 3 Please make sure the MFA is disabled first, then follow the steps of " Verify that Single Sign On (SSO) is working " to have a check. For any further assistant, it would be best to open a support ticket with Microsoft Support to help review your issue and help you test remotely. As you are working with a complicated scenario, and this could be due to many reasons. Thanks for your understanding. If the answer is helpful, please click " Accept Answer " and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

I have logged this to MS support for clarification . We have to have MFA so I cannot relax this but I would have thought that we at least could simplify the user experience by pre-populating the username or better still, like other applications on Hybrid AzureAD joined machines (MS Edge for business sign-in or MS teams) simply promt the user for MFA. I'll post back any results.

Onedrive Silent Configuration Expectation and Troubleshooting

Accepted answer

Jiajing Hua-MFST 10,560 Reputation points Microsoft Vendor

2023-11-20T06:45:52.4466667+00:00

Hi @shockoMS

1 If OneDrive use Windows Primary Account to sign in automatically without user interaction, SilentAccountConfig works correctly.

But if you have enabled MFA, then it won't work. The following image is from "Enable silent configuration" part.

2 According to "Prerequisites", Hybird AzureAD (Microsoft Entra hybrid) joined devices are supported.

3 Please make sure the MFA is disabled first, then follow the steps of "Verify that Single Sign On (SSO) is working" to have a check.

For any further assistant, it would be best to open a support ticket with Microsoft Support to help review your issue and help you test remotely. As you are working with a complicated scenario, and this could be due to many reasons.

Thanks for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

2 people found this answer helpful.
shockoMS 281 Reputation points

2023-11-20T08:20:58.5133333+00:00

Thanks for the response. We do require mfa for all our users via conditional access. I don’t think we’d be able to convince our security teams to relax this. Does any component of silent configuration work when mfa is is place? Ideally we’d like the username and password to pre-populate (or not be required based on the hybrid join primary refresh token) and then simply prompt the user for MFA.

Jiajing Hua-MFST 10,560 Reputation points Microsoft Vendor

2023-11-21T07:31:33.1433333+00:00

Hi @shockoMS

Thanks for your back.

As far as I know, your needs cannot be achieved that use MFA and SSO for OneDrive at the same time.

Sandeep G-MSFT 19,686 Reputation points Microsoft Employee

2023-11-23T03:53:37.09+00:00

@shockoMS

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

John Jovanovski 15 Reputation points

2024-03-01T04:28:07.38+00:00

@Jiajing Hua-MFST Could you kindly escalate this matter to the OneDrive product team for further review?

It is concerning that Microsoft is requesting IT/Security teams to compromise the overall security posture of their organizations to configure a native Microsoft/Windows application on trusted and hybrid-joined devices.

We will be logging this as a ticket promptly. Rest assured, I will update the community on our progress as we find this situation unacceptable.

Thank you for your attention to this matter.

AJ Prigge 5 Reputation points

2024-03-27T18:17:51.64+00:00

I fully agree with John Jovanovski with this to add...

The Teams client seams to work just fine with MFA configurations. It isn't silent but it automatically prompts the user with the correct username and then an MFA prompt. Loading the Teams client includes access to OneDrive so it's clear that this behavior is possible for the OneDrive client as well. Instead, the OneDrive client just gives up when the silent process is challenged with MFA. MFA should absolutely be accounted for in any authentication process involving current Microsoft apps and enterprise management solutions. The fact that is wasn't accounted for here is disappointing.

If we can't rely on the group policy settings to configure silent login for OneDrive when MFA is enabled then the OneDrive client should at least be extended to behave similarly to the Teams client so that it prompts the end user to log in with the correct information. The "Allow syncing OneDrive accounts for only specific organizations" computer policy along with the "Prevent users from syncing personal OneDrive accounts" user policy can be used to prevent users from syncing with unapproved M365 accounts on corporate devices.

It's imperative to our organization that the OneDrive client runs automatically, authenticates successfully but only to our tenant and that MFA be enabled for all our users at all times. Please escalate this to the OneDrive Product team.

Red217 1 Reputation point

2024-04-04T15:56:15.7166667+00:00

What to do if we have MFA on?, it's mandatory for us

shockoMS 281 Reputation points

2024-05-07T11:07:43.7133333+00:00

@John Jovanovski did you get any update? What I did find was that if I sign-in to MS teams desktop app or MS Edge for business with MFA then silent config for the OneDrive client sycn app appears to work (on inital testing so not 100% certain yet).
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Onedrive Silent Configuration Expectation and Troubleshooting

1 additional answer

Your answer