OneDrive is every employee's personal storage, but it's still the organization's data. Without agreements, one user shares everything with "Anyone", another syncs company files to a home PC, and files disappear as soon as someone leaves. With good governance you decide how much storage there is, who users can share with, which devices they sync on and what happens when someone leaves.
Why governance for OneDrive?
Users choose OneDrive because it's convenient: access everywhere, backup and easy sharing, as described in 10 OneDrive tips. Precisely because sharing is so easy, as an admin you want to set the boundaries beforehand. OneDrive runs on SharePoint, so most settings are in the SharePoint admin center. Align them with your SharePoint Online governance, so the rules for personal and shared storage match.
1. Storage
Set the default storage per user via SharePoint admin center > Settings > OneDrive storage limit. For most plans that's 1 TB. For one user you change it separately, for example for someone who works with large video or design files. Read change one user's storage limit.
2. Sharing
Go to Policies > Sharing. OneDrive's sharing level can be as strict as SharePoint's or stricter, never more open. Choose for example New and existing guests instead of Anyone, and set an expiration date for links.
- Set the default link type to Specific people or Only people in your organization, so a quick click on Share doesn't immediately create a public link.
- Optionally limit external sharing to specific partner domains.
- Do staff need to send large files to customers? Explain how to share large files securely within your rules.
3. Sync
- Only allow sync on devices joined to your domain (Settings > Sync). That setting works with the domain GUID of your on-premises Active Directory. For devices that are only in Entra ID, Conditional Access with Intune compliance is the better choice.
- Block file types that don't belong in OneDrive, such as .pst or .ost files.
- Use Intune to turn on Files On-Demand and PC folder backup centrally. Use the OneDrive settings in the settings catalog to sign users in silently and move their folders automatically.
4. Access from unmanaged devices
Under Policies > Access control you decide what's possible on devices your organization doesn't manage. You can allow full access, allow browser-only access without downloading or printing, or block access. That's also where you set inactive browser sessions to be signed out automatically.
5. When someone leaves
When you delete a user, their OneDrive is kept for 30 days by default (adjustable under Settings > Retention). Their manager gets access to move files, or you choose someone yourself when deleting the user in the Microsoft 365 admin center. Move important files to Teams or SharePoint beforehand. A retention policy in Microsoft Purview takes precedence: if the OneDrive falls under one, the content is kept longer.
Checklist
- Storage limit set and exceptions documented.
- Sharing level and default link type configured, with an expiration date for external links.
- Sync restricted and unwanted file types blocked.
- PC folder backup rolled out via Intune.
- Policy for unmanaged devices configured.
- Process for leavers agreed with HR and managers.
Frequently asked questions
- Do users see the sharing options greyed out? Then sharing is set more strictly at organization or site level. That's what your governance intends, but communicate it. See sharing options greyed out for the causes.
- Do changes apply immediately? Usually within a few minutes to an hour. New settings don't always apply to links that already exist.
- Does an unlicensed OneDrive stay around indefinitely? No. Microsoft charges for or archives accounts that remain unlicensed for a long time. Check the current rules and clean up in time.
Nederlandstalige versie: Een goede governance voor OneDrive voor werk inrichten