a week ago - last edited Thursday by talkingmoose
I'm deploying the following PLIST config to Macs but users can still sign into other OneDrive Business accounts and they can still disable folder backup.
Is there anything wrong with the below config?
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AllowTenantList</key>
<array>
<string>482a4ef9-66e4-4e76-9f24-6da09a713ee5</string>
</array>
<key>BlockExternalSync</key>
<true/>
<key>DisablePersonalSync</key>
<true/>
<key>DisableTutorial</key>
<true/>
<key> KFMBlockOptOut</key>
<true/>
<key>KFMSilentOptIn</key>
<string>482a4ef9-66e4-4e76-9f24-6da09a713e5</string>
</dict>
</plist>
Solved! Go to Solution.
Thursday - last edited Thursday
The Tenant ID in AllowTenantList, should be a key set to true, and is a dict instead of an array, i.e.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AllowTenantList</key>
<dict>
<key>12345678-1234-1234-1234-1234567890zx</key>
<true/>
</dict>
<key>BlockExternalSync</key>
<true/>
<key>DisablePersonalSync</key>
<true/>
<key>DisableTutorial</key>
<true/>
<key>KFMBlockOptOut</key>
<true/>
<key>KFMSilentOptIn</key>
<string>12345678-1234-1234-1234-1234567890zx</string>
</dict>
</plist>
Also it should be noted the KFMBlockOptOut key had a space at the beginning, so that might also have been invalidating that plist key.
Thursday - last edited Thursday
The Tenant ID in AllowTenantList, should be a key set to true, and is a dict instead of an array, i.e.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AllowTenantList</key>
<dict>
<key>12345678-1234-1234-1234-1234567890zx</key>
<true/>
</dict>
<key>BlockExternalSync</key>
<true/>
<key>DisablePersonalSync</key>
<true/>
<key>DisableTutorial</key>
<true/>
<key>KFMBlockOptOut</key>
<true/>
<key>KFMSilentOptIn</key>
<string>12345678-1234-1234-1234-1234567890zx</string>
</dict>
</plist>
Also it should be noted the KFMBlockOptOut key had a space at the beginning, so that might also have been invalidating that plist key.
Thursday
Thanks. I've changed it to a key set to true, and I've also removed the space at the beginning of KFMBlockOptOut but I'm not seeing any difference when I deploy that to the Mac. I can still turn off the backup of the Desktop and Documents as well as sign in with a OneDrive for Business account from another organisation.
For clarity, here is the updated PLIST I'm using:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AllowTenantList</key>
<array>
<key>TENANT ID</key>
<true/>
</array>
<key>BlockExternalSync</key>
<true/>
<key>DisablePersonalSync</key>
<true/>
<key>DisableTutorial</key>
<true/>
<key>KFMSilentOptIn</key>
<string>TENANT ID</string>
<key>KFMBlockOptOut</key>
<true/>
</dict>
</plist>
Thursday - last edited Thursday
What version of OneDrive is installed? Mac App Store or downloaded from Microsoft? To check try ls /Applications/OneDrive.app/Contents/_MASReceipt, in Terminal, if it doesn't complain with No such file or directory, It's the App Store version, which is not the version to be managing, and as such is probably why the settings are not applying.
Also check the settings are being applied to: com.microsoft.OneDrive
The App Store versions of the Microsoft Office apps do miss several business related features, and as such should not be used in a managed environment.
Thursday
It's not the Mac App Store version. It's downloaded from the Jamf App Catalog.
It seems to be working now. I'll do some more testing to make sure it's consistent.
Thursday
Blocking the KFM Opt Out is working now.
I can still sign in with another OneDrive account though so just that part to fix now.
Thursday - last edited Thursday
From deploy-and-configure-on-macos I just noticed one other detail, AllowTenantList is a dict, not an array, I've corrected my example above.
Thursday
That did the trick! Thank you
Thursday
Hey, just a heads up, if the AllowTenantList
value in your post is real, you should probably remove it. Sharing your organization's tenant ID online could make it a target for malicious actors.
Thursday
Thanks to MacAdmins Slack, I just noticed moderator @talkingmoose fudged the last couple of characters of the tenant ID before I responded, because they are no longer identacle. That said, Thanks, I had a thought about it for a sadly fleeting moment when I wrote my response, but forgot to mention or do anything about it my response, so I have now edited the response to something very unlikely.
Thursday
It's not a real Tenant ID