🗺️ Course Module Map

🏠 Module 1: OneDrive Admin Center Overview

The OneDrive Admin Center is accessible directly at admin.onedrive.com or via Microsoft 365 Admin Center → SharePoint → OneDrive settings. Most OneDrive tenant settings are configured within the SharePoint Admin Center (admin.sharepoint.com) — the OneDrive admin portal surfaces the most-commonly used settings as a simplified view, while the full configuration depth lives in the SharePoint admin center.

OneDrive Storage Tiers & Licensing

💾 Module 2: Storage Settings & User Quotas

Storage in OneDrive for Business is managed at two levels: the tenant-level default quota (applied to every new OneDrive that is provisioned) and per-user quota overrides (applied to specific users who need more or less than the default). OneDrive sites are provisioned automatically on first sign-in or when an admin provisions them via PowerShell.

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current tenant OneDrive default storage quota
Get-SPOTenant | Select-Object OneDriveStorageQuota,OneDriveStorageQuotaAlerts

# Set default quota to 5 GB with 90% warning alert
Set-SPOTenant -OneDriveStorageQuota 5120 -OneDriveStorageQuotaAlerts 4608

# Export all OneDrive sites with storage usage
Get-SPOSite -IncludePersonalSite $true -Template "SPSPERS#10" -Limit All |
  Select-Object Owner,Url,StorageUsageCurrent,StorageQuota,StorageQuotaWarningLevel |
  Sort-Object StorageUsageCurrent -Descending |
  Export-Csv -Path "OneDriveStorageReport.csv" -NoTypeInformation

# Set custom quota for a specific user (10 GB)
Set-SPOSite -Identity "https://contoso-my.sharepoint.com/personal/john_doe_contoso_com" `
  -StorageQuota 10240 `
  -StorageQuotaWarningLevel 9216

# Flag users above 80% capacity
Get-SPOSite -IncludePersonalSite $true -Template "SPSPERS#10" -Limit All |
  Where-Object {$_.StorageQuota -gt 0 -and ($_.StorageUsageCurrent / $_.StorageQuota) -gt 0.8} |
  Select-Object Owner,Url,StorageUsageCurrent,StorageQuota |
  Sort-Object StorageUsageCurrent -Descending |
  Format-Table -AutoSize

# Pre-provision OneDrive for new users
Request-SPOPersonalSite -UserEmails @("newuser@contoso.com","anotheruser@contoso.com")

🔁 Module 3: Sync Client Policies

OneDrive sync policies control how the OneDrive sync client (OneDrive.exe) operates on user devices — whether sync is restricted to domain-joined devices, which file extensions are blocked from syncing, and how the client receives updates. These policies are configured in the SharePoint Admin Center under Sync and can also be deployed via Group Policy (GPO) or Intune (MDM) using the OneDrive ADMX templates.

OneDrive Sync Policy Settings

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current sync client restriction settings
Get-SPOTenantSyncClientRestriction

# Restrict sync to domain-joined devices only
Set-SPOTenantSyncClientRestriction -Enable `
  -DomainGuids @("your-ad-domain-guid-here")

# Block Mac sync and specific file extensions
Set-SPOTenant -BlockMacSync $true
Set-SPOTenant -ExcludedFileExtensionsForSyncClient @(".tmp",".vhd",".vhdx",".pst",".bak",".iso")

# Verify sync restrictions
Get-SPOTenantSyncClientRestriction | Select-Object TenantRestrictionEnabled,AllowedDomainList
Get-SPOTenant | Select-Object BlockMacSync,ExcludedFileExtensionsForSyncClient

🔗 Module 4: Sharing & External Collaboration

OneDrive sharing settings can be configured independently from SharePoint site sharing — allowing organisations to be more permissive for personal document sharing while being more restrictive for team sites. The OneDrive sharing setting can be set to any level up to (but not exceeding) the tenant-level SharePoint sharing setting.

OneDrive Sharing Levels

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current OneDrive sharing settings
Get-SPOTenant | Select-Object SharingCapability,OneDriveForGuestsEnabled,RequireAnonymousLinksExpireInDays,DefaultSharingLinkType

# Require anonymous links to expire after 14 days
Set-SPOTenant -RequireAnonymousLinksExpireInDays 14

# Set default sharing link type to Specific people
Set-SPOTenant -DefaultSharingLinkType Direct

# Get external users on a specific OneDrive
Get-SPOUser -Site "https://contoso-my.sharepoint.com/personal/john_doe_contoso_com" -Limit All |
  Where-Object {$_.LoginName -like "*#ext#*"} |
  Select-Object DisplayName,LoginName,IsSiteCollectionAdmin |
  Format-Table -AutoSize

# Export all OneDrive external users tenant-wide
Get-SPOExternalUser -SiteUrl "https://contoso-my.sharepoint.com" -Limit All |
  Export-Csv -Path "OneDriveExternalUsers.csv" -NoTypeInformation

📁 Module 5: Known Folder Move (KFM)

OneDrive Known Folder Move (KFM) — now labelled Folder Backup in the OneDrive sync client UI — automatically redirects a user’s Windows Desktop, Documents, and Pictures folders to their OneDrive, providing automatic cloud backup of critical user data. It is one of the most impactful OneDrive features for business continuity and the primary reason organisations can confidently decommission on-premises file servers and roaming profiles.

KFM Deployment Methods

Connect-MgGraph -Scopes "Reports.Read.All"

# Export OneDrive usage report (last 30 days)
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/beta/reports/getOneDriveUsageAccountDetail(period='D30')" `
  -OutputFilePath "OneDriveUsageReport.csv"
Write-Host "OneDrive usage report exported."

# Find KFM Intune configuration profiles
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"
Get-MgDeviceManagementConfigurationPolicy -All |
  Where-Object {$_.Name -like "*OneDrive*" -or $_.Name -like "*Known Folder*"} |
  Select-Object Name,Description,Platforms,SettingCount |
  Format-Table -AutoSize

# Report on per-user OneDrive storage consumption
Connect-MgGraph -Scopes "Files.Read.All","User.Read.All"
$Users = Get-MgUser -All -Property DisplayName,UserPrincipalName | Select-Object -First 20
foreach ($User in $Users) {
  try {
    $Drive = Get-MgUserDrive -UserId $User.Id
    Write-Host "$($User.UserPrincipalName) | Used: $([math]::Round($Drive.Quota.Used/1GB,2)) GB / $([math]::Round($Drive.Quota.Total/1GB,2)) GB"
  } catch { $null }
}

📤 Module 6: Data Migration to OneDrive

Microsoft provides two primary tools for migrating content to OneDrive: the SharePoint Migration Tool (SPMT) for SharePoint Server content and the Migration Manager (in the SharePoint Admin Center under Migration) for file shares, Google Drive, Box, and Dropbox. OneDrive personal storage migrations follow the same workflow as SharePoint Online migrations.

Migration Sources Supported to OneDrive

♻️ Module 7: Orphaned Account & Retention Management

When a user account is deleted from Microsoft 365, their OneDrive enters a retention period before being permanently deleted. During this period the content is preserved and can be accessed by a designated manager or admin. This is critical for business continuity — particularly for capturing project files, contracts, and correspondence from departing employees.

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current orphaned OneDrive retention period
Get-SPOTenant | Select-Object OrphanedPersonalSitesRetentionPeriod

# Set retention to 180 days after account deletion
Set-SPOTenant -OrphanedPersonalSitesRetentionPeriod 180

# Grant an admin site collection admin rights on an orphaned OneDrive
Set-SPOUser -Site "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" `
  -LoginName "admin@contoso.com" `
  -IsSiteCollectionAdmin $true
Write-Host "Admin access granted to orphaned OneDrive."

# Set user's manager as secondary owner for automatic access delegation
Set-SPOSite -Identity "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" `
  -SecondaryOwner "manager@contoso.com"

# Remove admin access after content review
Set-SPOUser -Site "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" `
  -LoginName "admin@contoso.com" `
  -IsSiteCollectionAdmin $false

🔒 Module 8: Admin Access to User OneDrives

Administrators sometimes need to access a user’s OneDrive content — for eDiscovery investigations, content recovery, or data governance reviews. This requires temporarily granting themselves (or a designated admin) site collection administrator rights on the specific OneDrive site. This action is logged in the Microsoft Purview audit log.

🔒 Module 9: Personal Vault & Files On-Demand

Personal Vault is a protected area within OneDrive that requires additional identity verification (step-up authentication — PIN, biometric, or authenticator app) to access, providing an extra layer of security for sensitive documents like passports, financial records, or legal documents.

Files On-Demand (also called Smart Sync) allows OneDrive to show all cloud-stored files as placeholders in Windows Explorer without downloading them locally — saving local disk space while maintaining full visibility of the user’s OneDrive content.

Personal Vault & Files On-Demand Settings

📊 Module 10: Compliance Integration

OneDrive for Business is fully integrated with Microsoft Purview compliance capabilities — every file stored in OneDrive can be protected by sensitivity labels, covered by DLP policies, retained by retention policies and labels, included in eDiscovery searches and holds, and audited in the Unified Audit Log.

Purview Compliance Integration with OneDrive

📊 Module 11: Reports & Usage Analytics

Connect-MgGraph -Scopes "Reports.Read.All"

# Per-user OneDrive usage (storage + activity, last 30 days)
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getOneDriveUsageAccountDetail(period='D30')" `
  -OutputFilePath "OneDriveUsageDetail.csv"

# OneDrive activity — who viewed, modified, shared, synced
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getOneDriveActivityUserDetail(period='D30')" `
  -OutputFilePath "OneDriveActivity.csv"

# Tenant-wide OneDrive storage trend (last 90 days)
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getOneDriveUsageStorage(period='D90')" `
  -OutputFilePath "OneDriveStorageTrend.csv"
Write-Host "All OneDrive reports exported."

🎓 Module 12: MS-102 Certification Alignment

💡 Best Practices Summary

• Deploy Known Folder Move silently for all Windows 10/11 corporate devices — it is the single highest-impact action for eliminating data loss from local drive failures and device theft
• Set orphaned OneDrive retention to at least 180 days (6 months) — the default 30 days is too short for organisations with complex HR offboarding timelines or compliance requirements
• Always set a secondary admin/manager on OneDrives of high-value users using Set-SPOSite -SecondaryOwner — this ensures automatic access delegation when the primary account is deleted
• Restrict sync to domain-joined or Intune-enrolled devices only — this is the primary control preventing personal devices from syncing corporate OneDrive data
• Set mandatory anonymous link expiry of 14–30 days — anonymous links that never expire are a persistent data exposure risk that grows over time as user intentions change
• Run the OneDrive usage report monthly and identify users with zero activity in 30+ days — inactive OneDrives with large storage consumption may indicate former employees whose accounts were not fully offboarded

📚 References

• 🔗 OneDrive for Business Admin Documentation — Microsoft Learn
• 🔗 Known Folder Move (Folder Backup) Documentation — Microsoft Learn
• 🔗 Migrate to OneDrive & SharePoint — Microsoft Learn
• 🔗 OneDrive Admin Center — admin.onedrive.com