Known Folder Move (KFM) redirects and moves a user’s Windows known folders, primarily Desktop, Documents, and Pictures, into OneDrive. This helps ensure business data is backed up to the cloud, available across devices, and easier to recover during device replacement, reset, or reimage. Microsoft recommends Known Folder Move for enterprises and large organizations and provides policies to deploy it using Intune, Group Policy, or registry.
In this post, you will configure silent KFM using the Intune Settings catalog and also enable Microsoft’s two recommended supplement settings: Prompt users to move Windows known folders to OneDrive (to remediate silent failures) and Prevent users from turning off Known Folder Move (to stop users from opting out after the move).
Before moving on to the steps for creating a policy to silently move known Windows folders to OneDrive, it is important to highlight a recommended policy that you should enable. This policy is available in the Settings catalog and is called Silently sign in users to the OneDrive sync app with their Windows credentials. When this policy is enabled and applied, Known Folder Move (KFM) can run without requiring users to manually sign in to OneDrive. For more information, go to the link: IT Admins – Use OneDrive policies to control sync settings – SharePoint in Microsoft 365 | Microsoft Learn.
Contents
Silently move Windows known folders to OneDrive Policy
The Intune policy to silently move known Windows folders to OneDrive is called Silently move Windows known folders to OneDrive. You will find two versions of the same setting in the Settings catalog. The first one only asks for the tenant ID and notification option and effectively targets the KFM silent opt-in as a single setting, with no per-folder toggles. The second one includes per-folder controls such as Desktop (Device), Documents (Device), and Pictures (Device) for KFM silent opt-in.
Before You Start
Before creating a policy to enable Silent KFM for OneDrive, there are a few important points to note:
- Silent policy rollout: limit existing devices to 1,000 devices/day and do not exceed 4,000 devices/week (combined across Windows and macOS).
- If users have many files, consider temporarily enabling Limit the sync app upload rate to a percentage of throughput during initial uploads, then disable it after the migration completes.
- Cross-tenant redirection scenario: If a user’s known folders are already redirected to a different organization’s OneDrive, redirecting to your organization can create new folders, and the user may see an empty desktop. Users must manually migrate content from the other organization’s OneDrive and are recommended to disable the other redirect first if possible.
- Prompt users to move Windows known folders to OneDrive: Microsoft recommends using this setting together with Silently move Windows known folders to OneDrive. If moving the known folders silently does not succeed, users will be prompted to correct the error and continue.
- Prevent users from redirecting their Windows known folders to their PC: This is also a recommended policy to use together with Silently move Windows known folders to OneDrive. This setting forces users to keep their Documents, Pictures, and Desktop folders directed to OneDrive. If you enable this setting, the “Stop protecting” button in the Your IT department wants you to protect your important folders window will be disabled, and users will receive an error if they try to stop syncing a known folder.
Create OneDrive KFM policy in Intune
- Go to Intune admin center > Devices > Configuration > + Create > New Policy.
- Select Platform: Windows 10 and later. Profile type: Settings Catalog.
- Click Create.
- On the Basics tab, provide a name and description of the policy and click Next.
- On the Configuration Settings tab, click on + Add settings and search for Onedrive and then select OneDrive category. Then select and enable below settings:
- Silently move Windows known folders to OneDrive.
- Prompt users to move Windows known folders to OneDrive.
- Prevent users from redirecting their Windows known folders to their PC.
- To configure this setting, Tenant ID is required. Go to Entra ID admin center > Identity > Overview and copy the Tenant ID value.
- Enable the policies and provide the tenant ID as shown in below screenshot.
- Scope tags (optional): A scope tag in Intune is an RBAC label that you assign to resources such as policies, apps, and devices to control which administrators can view and manage them. For more information, see How to use scope tags in Intune.
- Assignments: Assign the policy to Microsoft Entra security groups that include the target users or devices. As a best practice, start with a small pilot group, and once validated, expand the assignment more broadly. For guidance on assignment strategy, see Intune assignments: User groups vs. Device groups.
- Review + create: Review the deployment summary and click Create.
How to Confirm If OneDrive KFM is Applied
Enabling silent OneDrive KFM will create below two registry entries on the target devices:
HKLM\SOFTWARE\Policies\Microsoft\OneDrive\KFMSilentOptIn = <TenantID> (string)
HKLM\SOFTWARE\Policies\Microsoft\OneDrive\KFMSilentOptInWithNotification = 1 (DWORD, optional)
Along with that, users Desktop, Documents, and Pictures folders will be redirected to OneDrive. This means any content stored in these folders will automatically be backed up to OneDrive. There are various ways to check and confirm if the KFM policy has been applied successfully. Let’s take a look.
Method 1: Using OneDrive Client UI
Open OneDrive settings and verify the Backup status for Desktop, Documents, and Pictures, and confirm they show as being protected/backed up.
- Right-click on the OneDrive icon from the system tray.
- Click on the Settings icon, then click Settings.
- Under Sync and backup, click Manage backup button.
- As shown in the screenshot below, the Documents, Pictures, and Desktop folders are backed up, and the toggle switches to disable redirection are greyed out. This occurs because the policy Prevent users from redirecting their Windows known folders to their PC is enabled.
- If the Silent OneDrive KFM policy fails, users may see a message in the OneDrive app prompting them to manually back up their Desktop, Documents, and Pictures folders to OneDrive. Click the button to proceed with the backup process. This is because of the policy setting Prompt users to move Windows known folders to OneDrive.
Method 2: Using Folder location
Right-click Desktop or Documents > Properties > Location and confirm the path points under the user’s OneDrive directory (for example, …\OneDrive – <Org>\Documents).
Method 3: Registry verification
This is the best method when you are troubleshooting issues related to OneDrive KFM. Check and confirm if the registry entries are existing and configured as per the Intune deployment. This check makes it certain that the policies are in place. To check and confirm:
- Press the Windows key + R together to open the Run dialog box.
- Type
regeditand press Enter to open the Registry editor. - Navigate to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive\ and confirm below registry entries:
- KFMSilentOptIn = <TenantID> (String)
- KFMSilentOptInWithNotification = 1 (DWORD, if you enabled notifications)
- KFMOptInWithWizard = <TenantID> (String, if you enabled the prompt policy)
- KFMBlockOptOut = 1 (DWORD, if you enabled “Prevent users from turning off KFM”)
Optional per-folder selectors (if configured):
- KFMSilentOptInDesktop = 1
- KFMSilentOptInDocuments = 1
- KFMSilentOptInPictures = 1
Method 4: Verify using Event Viewer
- Open Start > Event Viewer. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
- Right-click on the Admin folder and Filter the events using Event ID 814 or 813. Go through the filtered events to find the logs related to the deployment.
Method 5: Using PowerShell
Open a PowerShell console and execute below command to verify OneDrive KFM configuration values from Windows registry.
PowerShell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive" -ErrorAction SilentlyContinue |
Select-Object @{n='KFMSilentOptIn';e={$_.KFMSilentOptIn}},
@{n='KFMSilentOptInWithNotification';e={$_.KFMSilentOptInWithNotification}},
@{n='KFMSilentOptInDesktop';e={$_.KFMSilentOptInDesktop}},
@{n='KFMSilentOptInDocuments';e={$_.KFMSilentOptInDocuments}},
@{n='KFMSilentOptInPictures';e={$_.KFMSilentOptInPictures}}Other Recommended OneDrive Policies
- Use OneDrive Files On-Demand: OneDrive Files On-Demand lets users see all their OneDrive and SharePoint files in File Explorer without downloading everything to local storage. Files download only when opened, which saves disk space and reduces network usage. For more information, refer to the link: Enable/Disable OneDrive Files On-Demand Using Intune.
List of OneDrive Policies Available in the Settings Catalog
Please find the list of OneDrive settings available in the Intune admin center settings catalog. For more information about these settings, refer to the link: Use OneDrive policies to control sync settings.
| Other OneDrive Policies in Settings Catalog |
|---|
| Allow OneDrive to disable Windows permission inheritance in folders synced read-only |
| Allow users to choose how to handle Office file sync conflicts (User) |
| Allow users to contact Microsoft for feedback and support |
| Always use the user’s Windows display language when provisioning known folders in OneDrive |
| Always use the user’s Windows display language when provisioning known folders in OneDrive (User) |
| Block file downloads when users are low on disk space |
| Block syncing OneDrive accounts for specific organizations |
| Cause sync client to ignore normal web proxy detection logic |
| Coauthor and share in Office desktop apps (User) |
| Configure team site libraries to sync automatically |
| Configure team site libraries to sync automatically (User) |
| Continue syncing on metered networks (User) |
| Continue syncing when devices have battery saver mode turned on (User) |
| Convert synced team site files to online-only files |
| Disable animation that appears during OneDrive Setup (User) |
| Disable silently sign in users to the OneDrive sync app with an existing credential that is made available to Microsoft applications |
| Disable the tutorial that appears at the end of OneDrive Setup (User) |
| Enable automatic upload bandwidth management for OneDrive |
| Enable sync health reporting for OneDrive |
| Exclude specific kinds of files from being uploaded |
| Hide the “Deleted files are removed everywhere” reminder |
| Limit the sync app download speed to a fixed rate (User) |
| Limit the sync app upload rate to a percentage of throughput |
| Limit the sync app upload speed to a fixed rate (User) |
| Prevent the sync app from generating network traffic until users sign in |
| Prevent users from changing the location of their OneDrive folder (User) |
| Prevent users from moving their Windows known folders to OneDrive |
| Prevent users from redirecting their Windows known folders to their PC |
| Prevent users from syncing libraries and folders shared from other organizations |
| Prevent users from syncing personal OneDrive accounts (User) |
| Prompt users to move Windows known folders to OneDrive |
| Prompt users when they delete multiple OneDrive files on their local computer |
| Require users to confirm large delete operations |
| Set the default location for the OneDrive folder (User) |
| Set the maximum size of a user’s OneDrive that can download automatically |
| Set the sync app update ring |
| Silently move Windows known folders to OneDrive |
| Silently sign in users to the OneDrive sync app with their Windows credentials |
| Specify SharePoint Server URL and organization name |
| Specify the OneDrive location in a hybrid environment |
| Use OneDrive Files On-Demand |
| Warn users who are low on disk space |
