OneDrive Full Disk Access

Hello all,

I am in the process of rolling out OneDrive to our Mac environment. I assigned the app from the Jamf app catalog and put together a plist with all of our settings. I discovered that OneDrive has to have full disk access in order to automatically back up the desktop folder. I used the Jamf PPPC tool to grant onedrive full disk access, however it does not seem to take. I check in system settings → general → device management and I see the config profile, however when I run sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"' in Terminal, onedrive is not listed as one of the apps that has full disk access. Any ideas?

Page 1 / 1

That query isn’t going to report settings applied via a Configuration Profile but if the profile is showing as installed on the Mac it should be working. Are you seeing any evidence the profile isn’t allowing OneDrive the necessary access?

That query isn’t going to report settings applied via a Configuration Profile. Are you seeing any evidence the profile isn’t allowing OneDrive the necessary access?

The desktop folder is not automatically being backed up on my test mac. I am going to push to another mac tomorrow to see if it is a “me” issue or something else

@DJJazzyJamf Note that OneDrive will still prompt to start syncing even with the FDA permissions in place, and the user will have to explicitly provide that permission.

Do you have the Jamf PPPC Utility installed?

You can use this to get the correct domain and identifier information but to enable the automatic backing up of the Desktop & Documents folders, you need to enable the Known Folder Move keys

I’ve linked from the KFMBlockOptIn so all are visible but the ones you’ll need are just below but by the sounds of it, if you want it to do it automatically without any user intervention, you’ll need to look at KFMSilentOptIn

To second @sdagley, once you configure KFM, the users will receive a prompt to enable the sync. If they ignore this prompt or close out of it the sync will never begin.

Can you share your configuration profile? Make sure to remove your tenant keys.

To second @sdagley, once you configure KFM, the users will receive a prompt to enable the sync. If they ignore this prompt or close out of it the sync will never begin.

Can you share your configuration profile? Make sure to remove your tenant keys.

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
   <dict>
       <key>PayloadContent</key>
       <array>
           <dict>
               <key>BlockExternalSync</key>
               <true />
               <key>DefaultFolderLocation</key>
               <array>
                   <dict>
                       <key>DefaultFolderPath</key>
                       <string>~/</string>
                       <key>TenantID</key>
                       <string>*redacted*</string>
                   </dict>
               </array>
               <key>AllowTenantList</key>
               <dict>
               <key>*redacted*</key>
               <true/>
               <key>DisableTutorial</key>
               <true />
               <key>HideDockIcon</key>
               <true />
               <key>KFMBlockOptOut</key>
               <true />
               <key>KFMSilentOptIn</key>
               <string>*redacted</string>
               <key>KFMSilentOptInDesktop</key>
               <true />
               <key>KFMSilentOptInDocuments</key>
               <true />
               <key>OpenAtLogin</key>
               <true />
               <key>PayloadDisplayName</key>
               <string>Microsoft OneDrive</string>
               <key>PayloadIdentifier</key>
               <string>com.microsoft.OneDrive.45ba19d4-b352-4f82-8a2f-a606f87b705d</string>
               <key>PayloadType</key>
               <string>com.microsoft.OneDrive</string>
               <key>PayloadUUID</key>
               <string>45ba19d4-b352-4f82-8a2f-a606f87b705d</string>
               <key>PayloadVersion</key>
               <integer>1</integer>
           </dict>
       </array>
       <key>PayloadDisplayName</key>
       <string>Untitled</string>
       <key>PayloadIdentifier</key>
       <string>*redacted*</string>
       <key>PayloadType</key>
       <string>Configuration</string>
       <key>PayloadUUID</key>
       <string>99e8da09-7f60-48a6-9fc8-b39c2f3451e0</string>
       <key>PayloadVersion</key>
       <integer>1</integer>
   </dict>
</plist>

Do you have the Jamf PPPC Utility installed?

You can use this to get the correct domain and identifier information but to enable the automatic backing up of the Desktop & Documents folders, you need to enable the Known Folder Move keys

Yes, I initially used the PPPC utility to create the config profile

@DJJazzyJamf Note that OneDrive will still prompt to start syncing even with the FDA permissions in place, and the user will have to explicitly provide that permission.

Even with the KFMSilentOptIn option set to true?

@DJJazzyJamf Note that OneDrive will still prompt to start syncing even with the FDA permissions in place, and the user will have to explicitly provide that permission.

Even with the KFMSilentOptIn option set to true?

Even with that set to true (that disables the MS prompts but has no effect on the macOS prompts)