OneDrive, files & backup

Reprovisioning a device should never be a data-loss event. This section of the Decolla catalogue covers how user files are protected, synced and backed up in your own Intune tenant — before, during and after a zero-touch build.

Why this matters

The riskiest data in most fleets is not in SharePoint or a database — it is sitting in Desktop, Documents and Pictures on individual machines. Until Known Folder Move is genuinely on, every laptop is one stolen bag, failed SSD or hasty reimage away from unrecoverable loss. The default experience does not get you there: prompted KFM gets dismissed, users unlink the sync client when it "gets in the way", and machines migrated from on-premises Group Policy often still carry folder-redirection registry values pointing at a file server that no longer exists. Meanwhile, nothing out of the box stops a user signing a personal OneDrive account into the corporate client — a quiet, unaudited copy of company data into a consumer account. None of this announces itself. You usually find out during an incident, which is the most expensive possible time.

What a good build does

Decolla treats user-state protection as configure-phase work using Microsoft's own OneDrive and Intune mechanisms in your tenant — deployed deliberately rather than left to defaults. Known Folder Move is enabled silently, with the user opt-out locked so it cannot be quietly undone, and Files On-Demand keeps a fully hydrated OneDrive from eating a 256 GB SSD. Sync is restricted to your tenant, with personal accounts blocked. Critically, the plan sequences the unglamorous prerequisite: clearing any legacy Folder Redirection tattoo before KFM is switched on, because enabling KFM over a stale redirection is how you get "protected" folders still writing to a dead UNC path. The same section covers the shared file access users expect on day one, plus an optional local, KFM-safe backup fallback with simple generational rotation for the edge cases cloud sync does not cover. As with everything in the catalogue, each item appears in a written, itemised plan with a delivery and reversibility class before anything runs, and Decolla can roll back its own changes item by item — the policies it set, honestly scoped, not a promise to unwind what has happened to your users' data since.

Where it bites people

Two failure modes come up repeatedly in real migrations:

• The Folder Redirection tattoo. Classic GPO folder redirection writes shell-folder registry values that survive the policy itself. Point Intune-driven KFM at such a machine and it can fail silently — or appear to succeed while Documents still resolves to \\oldserver\home$. Users keep "saving to Documents" and files land somewhere nobody is backing up. The fix is ordering: clear the tattoo first, then enable KFM. Decolla's plan encodes that sequence instead of relying on someone remembering it.
• Silent KFM without the fence around it. Enabling KFM alone is not protection. Without the opt-out lock, a user can move their folders straight back out; without tenant sync restrictions, the same client will happily sync to a personal account. And a local backup tool still pointed at the old folder paths after KFM has relocated them will churn or quietly back up a stale, empty location — which is why the fallback backup here is explicitly designed to coexist with KFM rather than fight it.

What's in this section (11 items)

Reversibility: auto reverses when unassigned · reverse reversible with a documented step · irreversible flagged before you approve the plan.