Fix: “Sorry, OneDrive Can’t Add Your Folder Right Now” Caused by Legacy Sync Restrictions
This typically points to legacy tenant-level sync restrictions conflicting with modern device management and Zero Trust practices.
🔍 The Problem
⚠️ Error Message
“Sorry, OneDrive can’t add your folder right now.”
- OneDrive client fails to start or sync libraries
- Users can access files via browser but cannot sync to local device
- Occurs primarily on non-domain joined or cloud-only devices (AADJ / Entra ID joined)
🧠 Root Cause
🔴 Legacy SharePoint Sync Restriction
The issue is caused by a legacy SharePoint Online tenant configuration: “Allow syncing only on computers joined to specific domains”. This setting was designed for on-premises domain-joined (AD DS) devices and:
- Does not support Azure AD Joined or Hybrid Azure AD devices
- Blocks syncing from modern managed devices
- Conflicts with Windows 365 and cloud-first security models
Set-SPOTenantSyncClientRestriction
🛠️ Step-by-Step Resolution
Verify Tenant Sync Restriction Setting
Connect to SharePoint Online and check if the restriction is currently enabled.
# Install module if needed Install-Module Microsoft.Online.SharePoint.PowerShell # Connect to SharePoint Online Connect-SPOService -Url https://yourtenant-admin.sharepoint.com # Check configuration Get-SPOTenant | Select-Object RestrictSyncClient, AllowedDomainList
⚠️ Problematic Output (means restriction is active)
RestrictSyncClient= TrueAllowedDomainListcontains on-premises domain GUIDs
Disable Legacy Sync Restriction
Remove the legacy domain restriction to restore OneDrive sync functionality.
Set-SPOTenant -RestrictSyncClient $false
💡 Alternatively — Use the GUI
- Go to SharePoint Admin Center
- Navigate to Settings → Sync
- Uncheck: “Allow syncing only on computers joined to specific domains”
- Click Save
🔴 Important Security Consideration
Disabling this setting removes the device-level restriction — meaning any device could attempt to sync OneDrive data, introducing potential data exfiltration risks. Always pair this change with a modern Conditional Access policy (Step 3 below).
Implement Modern Solution — Conditional Access (Recommended)
Replace the legacy restriction with a Zero Trust-based Conditional Access policy to allow OneDrive access only from corporate-managed devices.
📍 Navigation: Microsoft Entra Admin Center
Protection → Conditional Access → Policies → New Policy
| Setting | Value |
|---|---|
| Users | All Users (or a scoped group) |
| Cloud Apps | Office 365 |
| Conditions | Filter for devices |
| Device State | Exclude compliant / hybrid-joined devices |
| Grant Control | Block Access |
Monitor and Validate
Use Entra ID sign-in logs to confirm the policy is working as expected.
📍 Navigation: Entra ID → Sign-in logs
- Filter Application: OneDrive / SharePoint
- Success → Known/compliant device ✅
- Failure → Unknown device correctly blocked ✅
Optional — Validate via Microsoft Graph PowerShell
# Connect to Graph Connect-MgGraph -Scopes "Policy.Read.All","AuditLog.Read.All" # Get Conditional Access policies Get-MgIdentityConditionalAccessPolicy # Review sign-in logs Get-MgAuditLogSignIn -Top 10 | Select-Object UserDisplayName, AppDisplayName, Status, DeviceDetail
💡 Best Practices & Recommendations
- ✅ Retire legacy SharePoint sync restrictions in favour of Conditional Access for all modern environments
- ✅ Implement device compliance policies via Intune and align them with Conditional Access rules
- ✅ Follow Zero Trust principles — Verify explicitly, Use least privilege, Assume breach
- ✅ Regularly review sign-in logs and Conditional Access policy impact to catch unexpected blocks