OneDrive for Business (OD4B) is a key workload in Office 365 and can be an integral part of your collaboration strategy. OD4B provides a cloud location to store, share, and sync your work files and then work with them from any device. Microsoft has spent a lot of effort to get a rock-solid solution including a well-oiled sync engine together. Whether you are looking to roll-out OneDrive for Business or are already are utilizing it, there are a lot of important things that you should know about administration. This session will go through things such as: • When to use it and when not to • Sync capabilities and restrictions • Overall limits, guidance, and best practices • Security capabilities from the user to the tenant • Reporting • What’s new for administration

1. OneDrive for Business
for Administrators
SharePoint Saturday NYC 2018
#SPSNYC

2. EVALS / PRIZES
Bring all items to the 6th Info Desk
• Bingo Cards = how you win prizes at the
end of the event.
• The cards must be stamped by ALL the
Sponsors by the last session (4pm)
• Fill out speakers evaluations (located in
the front of the rooms
• Fill out the event evaluations And more …
Surface Go
Xbox One X

3. THANK YOU
EVENT SPONSORS
We appreciated you supporting the
New York SharePoint Community!
• Diamond, Platinum, Gold, & Silver have
tables scattered throughout
• Please visit them and inquire about their
products & services
• To be eligible for prizes make sure to get
your bingo card stamped by ALL sponsors
• Raffle at the end of the day and you must
be present to win!

4. Beer Authority
300 W 40h St
[across the street]
Join us for a round of drinks
http://www.beerauthoritynyc.com

5. Drew Madelung
Email : dmadelung@concurrency.com
Twitter : @dmadelung
Website: drewmadelung.com
Managing Architect – SharePoint & Office 365

6. OneDrive for Business Intro
When to use it
Administration
All about sync
Awareness & Insights
Security
OneDrive for Business
for Administrators
SharePoint Saturday NYC 2018

8. Anywhere access and sharing
for all your files
Content collaboration for
teams and organizations

10. OneDrive for Business Admin Basics
Each user gets it’s own site collection under /personal path
Site collection created first time users accesses it
1 TB of storage per user -> qualifying plans can have more
Does not count against SPO storage
Comes with O365 SKU’s or purchased separately
Administration closely connected with SharePoint Online settings

11. Administration

12. Administration
OneDrive Admin Center
SharePoint Admin Center
PowerShell

13. OneDrive Admin Center
Manage
• Sharing
• Sync
• Storage
• Device Access
• Compliance
• Notifications
Important
• You must allow access to onedrive.com
https://admin.onedrive.com

14. SharePoint Admin Center (Classic)
• Show or Hide OneDrive app launcher tile
• Set default OneDrive experience to new or classic
• Show or Hide OneDrive sync button
• Allow or Disable OneDrive mobile push notifications
• Set secondary administrator for new sites
• Set secondary owner when a user’s manager cannot be
determined
https://domain-admin.sharepoint.com

15. External Sharing
 Sharing for OneDrive can be MORE restrictive but not LESS restrictive than SPO
 If sharing turned off globally in SPO any shared links will stop working
Sharing Options
 No external sharing
 Only existing external users (sign-in required)
 New and existing external users (sign-in required)
 Anyone, including anonymous users (on by default)
Your SharePoint Online sharing
settings determine which OneDrive
sharing settings are available
Setting Sharing in OneDrive Admin
Center affects SPO

16. Set External Sharing Limitations
Default link type
 Direct links
 Only users who have specific permission
 Internal Links
 Only users within your organization
 Sharable access links
 Anyone with a link (anonymous)
Anonymous access link expiration
 Up to 2 years / 730 days
The following settings apply to both SPO and OneDrive
Anonymous access link permission
 Separate for Files & Folders
 View, Edit & Upload
 View Only for
Limit by domain
 Allow or block on selected domains
Other
 Must accept using same account
 Let external users share items they don’t own

17. Demo!

18. Sync

19. Sync Client
OneDrive sync client (NGSC)
vs
Groove sync client (YUCK)
 NGSC can sync OD4B and SPO libraries
 Can run both clients simultaneously
 NGSC support for Mac
 NGSC does not work for on-premises
 Until SP 2019

20. Sync Client Restrictions (NGSC)
Invalid characters
 < > : “ | ? * /
Strings in filenames
 Icon .lock CON PRN AUX NUL
 COM1-9, LPT1-9
 Starts with ~$
 Desktop.ini
 _vti_ anywhere in file
Folder names
 _t _w _vti_
 “forms” at the root level
Number of items
 Performance declines after 300,000 files
Size limit
 15 GB
Other
 Can’t add network/mapped drive as sync location
 Can’t sync Shared with Me view
 Can’t sync as an external user
 IRM sync requires 17.3.7294.0108
 Checkout & required columns synced as read-only
 Don’t use roaming profiles
http://bit.ly/odsynclimits

21. Sync Client Restrictions (NGSC)
Windows Specific
 Roaming, mandatory and temporary windows profiles aren’t supported
 Sessions not supported on:
 Windows 2008 Terminal Services
 Windows Server 2012
 Windows Server 2016 RDS
 Includes both persistent and non-persistent VDI
 Requirements
 Sync client must be installed
 User must be able to write to user profile
 Data written to the user profile must be saved to local hard disk and be available without
network connection
https://support.microsoft.com/en-us/help/3125202/restrictions-and-limitations-when-you-sync-files-and-folders

22. Sync Administration
Hide the sync button
 Helps users install & set up
Allow sync to specific domains
 Add GUID of each domain
Block sync of file types
 Example: mp3, pst
 Do not include periods or punctuation
OneDrive Admin Center

23. Sync Administration
Redirects windows known folders
 Desktop, Documents, Pictures
 Requires version 18.111.0603.0004
Users continue to work normally
 Managed via Group Policy
 Intune later this year
 Windows 7, 8.1, 10
Plan, test and remove redirection if currently exists
Known Folder Move

24. Sync Administration
Saves space on your device
 Requires Windows 10 Fall Creators
 Unique per device
 Deleting “Online-only” file deletes from the web
Files On-Demand

25. Sync Administration
Sync Control
 Allow & Block Tenant list
 Prevent changing of sync location
 Set default location
 Disable personal sync
Network
 Manage upload/download limits
 Automatic bandwidth percentage
 Prevent network traffic before sign in
 Overall max limit of all files downloaded
Group Policy
http://bit.ly/onedrivegpo
Files on-demand
 Enabled by default
 Migrate SP sites to on-demand
Known Folder Move
 Prompt users to opt in
 Silently redirect
 Prevent redirect to local
 Prevent redirect to OneDrive
Sign in
 Silent account configuration
 Set default location
 Disable first time tutorial
Office
 Prevent remote file fetch
 Handle office files in conflict
 Coauthoring and in-app
sharing
Admin
 Delay client update to 2nd
release

26. Demo!

27. Deployment

28. Deployment
Software requirements
 Windows 7, 8, 8.1, 10
 Sync client included in Windows 10
 macOS
Plan
 Phased is ok – Provide comms
Use enterprise deployment tool
 MS System Center Configuration Manager
 OneDrive NGSC deployment guide
 How to deploy NGSC with SCCM
Deploy admin settings
 Use OneDrive.admx and OneDrive.adml
 Download with OneDrive Deployment Package
Deploy RMS client
 Enables IRM-protected file sync
Assisting sign in
 odopen://launch
 odopen://sync?useremail=email@domain.com
 odopen://sync?siteId=X&webId=X&listId=X&userEma
il=x&webUrl=x
 %localappdata%MicrosoftOneDriveOneDrive.exe

29. Deployment - macOS
Standalone Mac App Store
PList Location ~/Library/Preferences/com.mi
crosoft.OneDrive.plist
~/Library/Containers/com.mic
rosoft.OneDrive-
mac/Data/Library/Preferences
/com.microsoft.OneDrive-
mac.plist
Domain com.microsoft.OneDrive com.microsoft.OneDrive-mac
Use the following keys to preconfigure or
change settings for your users

30. Deployment - Transitioning
If using Groove.exe (YUCK)
 OneDrive sync automatically takes over sync if possible
 During a “takeover”
 Groove.exe stops sync
 OneDrive starts sync without re-downloading
 Groove.exe stops running and removes from auto
start
Deploying a takeover
 Automatically transition without user interaction
 User must be signed in to OneDrive sync
 Can use SCCM
OneDrive.exe /takeover

31. Deployment – Pre-provisioning sites
Build a users OneDrive for Business site before they try to access it
User PowerShell info listed on TechNet

32. Other Admin Goodness

33. Admin Goodness – OD Admin Center
Storage
 Set default storage for all new and existing users
 Set retention of files after user marked for deletion up to 10 years
Notifications
 Display device notifications when files shared with them
 Email owners when
 Other users invite additional external users to shared files
 External users accept invitations to access files
 An anonymous link is created or changed

34. O365 Admin Center by User
Grant Yourself Access
View Quota
View Retention
Set Sharing
Initiate Sign-out

35. What if someone leaves?
Access
 Default sets ownership to manager declared in user profile
 Follows access delegation set in SP Admin Center
Cleanup
 If user profile manually deleted the site won’t be deleted
 Email sent on initial assignment and 7 days prior to retention
 If site is on eDiscovery hold the site won’t be deleted
 Deletion of user account in Azure AD is only thing to trigger

36. Security & Compliance

37. Access
Control access based on network location
 Allow access only from specific IP addresses
 One IP address per line
 No overlapping IP addresses
Control access from apps that don’t use modern auth
 Without modern auth, can’t enforce device-based restrictions
 Some 3rd party apps
 Office versions prior to 2013
Utilize Azure AD conditional access policies

38. Access
Mobile apps
 Requires Intune or EMS
 Admin account requires Intune
license

39. Other admin
Idle-session timeout for OneDrive and SharePoint
 Set-SPOBrowserIdleSignOut -Enabled $true -WarnAfter
(New-TimeSpan -Seconds 2700) -SignOutAfter (New-
TimeSpan -Seconds 3600)
 Mouse movement is not activity
 Idle for SPO & OD4B but will sign out of everything
 WarnAfter and SignOutAfter cannot be the same
 Entire tenant only
DLP & Labels

40. Data Loss Prevention (DLP)
Managed in O365 Security &
Compliance Center
 Helps identify and protect content from
inadvertent disclosure
Runs on search
 After you create a DLP policy in the Security &
Compliance Center, it’s stored in a central policy
store, and then synced to the various content
sources

41. Data Loss Prevention (DLP)
Pick info to protect
 Build in policy templates
 Custom policy

42. Data Loss Prevention (DLP)
Pick location

43. Data Loss Prevention (DLP)
Adjust the policy

44. Labels (retention)
Managed in O365 Security & Compliance Center
 Classify data and enforce retention rules
 Apply manually or automatically based on sensitive information or keyword queries
 Auto apply requires E5
 Content can only have 1 label
 Auto apply can take 7 days
 Can apply to:
 Outlook
 OneDrive for Business
 SharePoint
 O365 Groups

45. Labels (retention)
Setting a label

46. Demo!

47. Awareness & Insights

48. Reporting & Auditing
Usage Reports
Activity Reports
Audit Log Search

49. Usage Reports
Requires permission
View by
 Account
 Total/active
 Files
 Total/active
 Storage
 Amount

50. Activity Reports
View by
 Number of files by
 Viewed/edited
 Synced
 Shared internally
 Shared externally
 Number of users by
 Viewed/edited
 Synced
 Shared internally
 Shared externally

51. Audit Log Search
Unified audit log across SharePoint, OneDrive, Azure AD,
Exchange, Sway, Teams, Yammer
Must turn on audit logging (soon set to default)
Data exists for 90 days
Can take up to 30 minutes
to 24 hours to show up

52. Audit Log Search
Handy things that are audited
 Deletes file/folder from second stage
recycle bin
 Created an anonymous access link
 User initiates sync or is blocked from a
sync

53. Demo!

54. What’s next

55. What’s next
Tenant branding of sharing emails
Malware detect
Sync for SP 2019
Block download on share
Updated secured external sharing
user management
Multi-geo
Password protected sharing
Transfer ownership for deleted users
External sharing reports
Team site auto-mount

56. • xxxx
Help Contribute &
Stay Informed!
OneDrive UserVoice
https://onedrive.uservoice.com/forums/262982-onedrive/category/86090-onedrive-for-
business
Microsoft Tech Community
https://techcommunity.microsoft.com
Office 365 Roadmap
https://fasttrack.microsoft.com/roadmap
Office Blogs
https://blogs.office.com/
Office 365 Admin Center – Message Center
https://portal.office.com/AdminPortal
Office 365 for IT Pros
http://exchangeserverpro.com/ebooks/office-365-for-it-pros

57. Questions?
Email: dmadelung@concurrency.com
Twitter: @dmadelung
Website: drewmadelung.com
Slides: http://bit.ly/DrewSlides

58. OneDrive for
Business for
Administrators
SharePoint Saturday NYC 2018
#SPSNYC