The problem
Why domain-only sync becomes a poor fit
SharePoint can restrict OneDrive syncing to computers joined to specified on-premises Active Directory domains. Microsoft confirms that this setting does not apply to Microsoft Entra domains. As organisations adopt Entra-joined devices, Intune and Windows Autopilot, the legacy restriction can block properly managed cloud devices while offering incomplete coverage for browser, mobile and bring-your-own-device access.
Do not remove the old control first
Build, test and monitor the replacement controls before disabling the domain restriction. Otherwise, the change may unintentionally broaden access to organisational data.
| Legacy decision | Is this Windows computer joined to one of the listed on-premises domains? |
|---|---|
| Modern decision | Who is signing in, is the device managed and compliant, which application is being used, and what access is appropriate? |
| Important limitation | Conditional Access and Intune capabilities depend on licensing, supported platforms, enrolment and correctly reported compliance. |
Target design
Use layered access rather than one universal rule
Managed staff devices
Require multifactor authentication and a compliant or otherwise approved device for full SharePoint and OneDrive access.
Personal and mobile devices
Where appropriate, use approved applications, app-protection controls or restricted web access instead of automatically allowing downloads.
Guests and volunteers
Define whether browser-only access is sufficient, restrict downloads where justified, and review external access regularly.
Emergency administration
Maintain carefully protected emergency access accounts excluded from policies that could cause a tenant-wide lockout. Monitor every use.
Migration plan
Move in controlled stages
Document the current state
Record the domain restriction, device join types, Intune enrolment, compliance rules, guest access and any existing Conditional Access policies. Confirm the licences available to each user group.
Define access by user and device scenario
Create a small matrix covering staff, administrators, volunteers, guests, managed Windows devices, mobile devices and unmanaged browsers. State the allowed access and business reason for each combination.
Make compliance meaningful
Do not rely on a generic “compliant” label. Confirm that compliance checks important conditions such as supported operating systems, encryption and protection status, and that non-compliance is handled predictably.
Test policies without immediate enforcement
Use report-only evaluation where supported and pilot with representative users. Test new devices, remote workers, guests, mobile access, device replacement and emergency administration.
Enforce gradually
Expand in stages, provide clear user guidance and monitor sign-in failures and support demand. Keep a defined stop condition and recovery route for each stage.
Retire the legacy restriction
Only remove domain-only syncing after the replacement controls are validated. Record approval, the implementation date, exceptions and the evidence used to confirm success.
Operational checks
What good looks like
- Managed Entra-joined devices can sync without relying on an on-premises domain GUID.
- Unmanaged devices receive the deliberately chosen restricted experience rather than accidental full access.
- Guests and volunteers can complete approved tasks without permanent broad exceptions.
- Administrators can recover from a policy mistake without weakening normal access.
- Sign-in and compliance evidence is reviewed after rollout and at planned intervals.
RACF-CC context
Four domains working together
The change supports Domain 1 through access policy, Domain 2 through device compliance, Domain 5 through control of data access and download, and Domain 8 through ownership, testing, exceptions and review.
Primary sources
Microsoft implementation guidance
- Allow syncing only on computers joined to specific domains
- Enable Conditional Access support in the OneDrive sync app
- Use OneDrive policies to control sync settings
Confirm current Microsoft licensing and feature behaviour before changing a production tenant.
Voluntary support
Found this useful? Support Trends4You
Trends4You's practical guides, RACF-CC resources and downloadable tools are provided free of charge. If they've helped you or your organisation, you can support the time and hosting that keeps them freely available.
Support is optional, handled securely by Stripe and does not provide additional access.