onedrive silent sign in not working

[jrngsg]

am using onedrive per machine installation and azure ad joined and password. i cannot use whfb yet because organization is not ready for deployment.

i have below onedrive policy deployed to device-based group.

Silently sign in users to the OneDrive sync app with their Windows credentials
Enabled
Prompt users to move Windows known folders to OneDrive
Enabled
Prevent users from moving their Windows known folders to OneDrive
Enabled
Silently move Windows known folders to OneDrive
Enabled
Prevent users from syncing personal OneDrive accounts
Enabled
Set the sync app update ring
Enabled
Prevent users from redirecting their Windows known folders to their PC
Enabled
Allow syncing OneDrive accounts for only specific organizations
Enabled
Use OneDrive Files On-Demand
Enabled

after windows autopilot azure ad joined deployment, i login to work account. however, onedrive did not silent sign in. on the notification side, i received this suddenly. after i clicked on the notification and click my work account + 2fa + reboot, onedrive will silently sign in.

 

i checked azure ad logs when sign in, it is using the application called "Device Management Client"

i don't understand why and i am trying to achieve silent onedrive login. I cannot be asking user to take note of this notification and sign in manually and reboot everytime.

anyone encounter this issue can advise how you solve please? thanks.

[#2]

I assume you have conditional access in place and requireing mfa for all cloud apps?

[#3]

yes, that is one of the policy templates "Require multifactor authentication for all users"

[#4]

@jrngsg well thats probably the reason why you are getting that message (issue with work or school account)

https://call4cloud.nl/2022/06/enrollmenterrorsintune/#part4

and onedrive requires mfa so kfm will only work after you logged in with mfa… so i assume you have no windows hello in place (wwhich has the mfa claim in it)

[#5]

thanks Rudy. now i activated and enrolled windows hello for business during autopilot enrolment.

i saw my onedrive policy is reported as applied successfully in intune to the device but on the device, the registry at Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive is not there yet. i had to do several restart.

[#6]

See my thread on this: https://learn.microsoft.com/en-us/answers/questions/1430026/onedrive-silent-configuration-expectatio...

[#7]

So is the only way of addressing this without opening holes in your MFA to use Windows Hello for Business?