Deploying apps and OneDrive with Intune

The point of Autopilot is that the person who receives the device does nothing. That includes not installing Office and not signing into OneDrive. Apps marked Required and assigned to the Autopilot group install during the Enrollment Status Page, so the desktop that appears at the end is already furnished.

This chapter covers the two app types you will actually need — a Microsoft suite and something that is not in the Store — and the OneDrive configuration that makes the folders back themselves up.

Microsoft 365 Apps

This one has a dedicated app type, so you configure it rather than package it.

Two choices worth making deliberately:

Update channel. Current Channel ships features as soon as they are ready. Monthly Enterprise bundles them into one predictable monthly release. On managed devices the second is easier to live with: everyone changes on the same day, and support calls arrive in one wave rather than continuously.

Languages. Leave this alone unless you need it. By default Office follows the operating system language. If the image is en-US and you want Italian, the language has to be added here — and see the chapter on keyboard and locale, because the Autopilot profile setting does not install anything, it only requests it.

Apps that are not in the Store

Google Chrome is the usual example. Microsoft does not ship it, and the Store version is not the enterprise one.

OneDrive: silent sign-in and Known Folder Move

This is the highest-value policy on the list. Configured properly, Desktop, Documents and Pictures are backed up before the user knows OneDrive exists, and a lost laptop stops being a data loss event.

Intune → Devices → Configuration → Create policy → platform Windows 10 and later, profile type Settings catalog. Search for OneDrive and add these:

Setting	Value
Silently sign in users to the OneDrive sync app with their Windows credentials	Enabled
Silently move Windows known folders to OneDrive	Enabled — with your Tenant ID
Use OneDrive Files On-Demand	Enabled
Prevent users from redirecting their Windows known folders to their PC	Enabled

Assign to the Autopilot group.

The Tenant ID, and the silent failure

The Known Folder Move setting has a field for the Tenant ID. It is not decoration: OneDrive uses it to check that the account signing in belongs to your organisation before moving anybody’s Desktop into it.

Get it from Entra ID → Overview → Tenant ID. It is a GUID.

Verify on the device rather than in the portal: open OneDrive settings → Backup → the three folders should be listed as managed, and the option to stop backing them up should be greyed out.

Files On-Demand

Files appear in Explorer with a cloud icon and download when opened. On a 128 GB device with a 400 GB OneDrive this is the difference between working and not working. It is enabled by default on current Windows builds, but setting it explicitly means you know what state the device is in rather than assuming.

Blocking personal OneDrive accounts

A corporate device with the personal OneDrive client signed in is a supported, silent path for company files to leave the company. The setting that closes it lives in the same Settings catalog:

Setting	Value
Prevent users from syncing personal OneDrive accounts	Enabled

The effect is that the client refuses to add a personal Microsoft account. It does not remove one that is already signed in on an existing device, so on a fleet you are migrating rather than provisioning, check for those separately.

What “Required” actually does during OOBE

Required apps assigned to the device group install during the Enrollment Status Page, before the desktop appears. Required apps assigned to a user group install after sign-in, which on a slow connection means the user reaches a desktop that is still filling up.

For anything that should be present the first time someone looks at the machine — Office, the browser, the VPN client — assign to the device group.

Verifying

On the device, after the first sign-in:

The last one is the check people skip, and it is the one that catches an app that failed for a single device rather than for everybody.