Week 4, Day 4 — OneDrive for Business Administration & Policies

Day 3 review & the user storage gap

• Ask: "The tenant sharing is now 'New and existing guests'. Finance and HR are locked to internal only. What personal storage does each user have that is completely separate from SharePoint site libraries?" — prime OneDrive as the answer
• Ask: "If a Finance user saves a payroll spreadsheet to their OneDrive instead of the Finance site, does the Finance site's 'Only people in your organisation' restriction apply to it?" — answer: no. OneDrive is personal storage governed by OneDrive sharing settings, not site settings
• Ask: "Tom Bellamy resigns today. What happens to the files in his OneDrive?" — prime the user departure answer that forms the core of today's lab
• Frame the day: OneDrive is the personal storage layer that sits alongside SharePoint. It needs its own governance — quotas, sync policies, Known Folder Move, and most critically, a defined process for what happens when a user leaves

OneDrive for Business — architecture, policies, and lifecycle

OneDrive for Business is personal cloud storage provisioned per licensed user — it is not the consumer OneDrive. Each user gets their own site collection (a SharePoint site behind the scenes) at a tenant-defined URL. Admins govern capacity, sync behaviour, and what happens at end-of-life.

• OneDrive is SharePoint, architecturally — each user's OneDrive is provisioned as a personal SharePoint site collection at [tenant]-my.sharepoint.com/personal/[username]. It shares the same permission model, the same sharing tiers, and many of the same admin controls. The OneDrive admin centre surfaces OneDrive-specific settings, but the underlying platform is SharePoint.
• Storage quotas — Business Standard includes 1 TB per user by default. Admins can set a tenant-wide default quota and override it per user. When a user approaches their quota, OneDrive sync pauses. When they exceed it, new uploads are blocked. Storage pooling means unused quota from one user can be consumed by another up to the tenant total.
• Sync client policies — the OneDrive sync client runs on Windows and macOS, keeping local folders in sync with the cloud. Admins can control: which domains can sync (tenant restriction — prevents personal accounts from syncing on corporate devices), which file types are blocked from sync, and whether users can sync shared libraries from SharePoint sites. These are configured via Group Policy or Microsoft Intune (covered in Week 6).
• Known Folder Move (KFM) — automatically redirects the user's Desktop, Documents, and Pictures folders to OneDrive, making them cloud-backed without user action. This is the most impactful single OneDrive feature for data protection — it ensures that even if a device is lost, stolen, or fails, the user's key working files are safe. KFM is configured via Group Policy or Intune.

User departure — the OneDrive lifecycle

• Preservation period — when a user account is deleted, their OneDrive is preserved for a configurable period (default 30 days, max 3650 days). During this time an admin or designated secondary owner can access and migrate the content. After the period expires, OneDrive is permanently deleted.
• Secondary owner and manager notification — admins can configure OneDrive to automatically notify the departed user's manager and grant them temporary access. The manager can then download files, move them to a SharePoint site, or share them with colleagues. This is configured in the OneDrive admin centre.
• The OneDrive admin centre — accessible from the SharePoint admin centre or directly at [tenant]-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx → OneDrive. Shows all users' OneDrive usage, allows per-user quota overrides, and surfaces the access delegation and retention settings.

Lab 4-D: Configuring OneDrive policies for Lakeview Logistics

Students explore the OneDrive admin centre, configure storage quotas, set the retention policy for departed user OneDrives, configure manager notification and secondary owner access, explore sync client settings, and simulate the user departure process by granting admin access to a test user's OneDrive.

• Step 1 — Explore the OneDrive admin centre (5 min)
  Navigate to the SharePoint admin centre → OneDrive in the left navigation (or from admin.microsoft.com → OneDrive). Explore the sections: Storage, Sync, Notifications, Data access. Record which settings are available in each section.
• Step 2 — Configure storage quotas (10 min)
  In the OneDrive admin centre → Storage. Review the default storage quota per user (should be 1024 GB / 1 TB for Business Standard).
  
  Set a default quota of 100 GB for new OneDrives provisioned in the tenant. Record the before and after values.
  
  Then set a per-user override: navigate to the SharePoint admin centre → Active sites → [your admin UPN's OneDrive] (listed as /personal/[username]) → set storage limit to 50 GB. This demonstrates per-user override capability.
• Step 3 — Configure retention for departed user OneDrives (10 min)
  In the OneDrive admin centre → Storage → Retention. Set the retention period for deleted users' OneDrives to 180 days (6 months — appropriate for a logistics company with potential regulatory obligations). Record the before and after values.
• Step 4 — Configure manager notification and secondary owner access (10 min)
  In the OneDrive admin centre → Notifications. Enable:
  · Notify OneDrive owners of inactivity — after 90 days of inactivity
  · Notify OneDrive owners before files are deleted — 7 days before deletion
  
  Then navigate to → Data access → When a OneDrive owner is deleted. Configure:
  · Enable the secondary owner option
  · Set the access duration to 90 days
  Record all settings.
• Step 5 — Explore sync settings (5 min)
  In the OneDrive admin centre → Sync. Review the available sync controls:
  · Allow syncing only on PCs joined to specific domains
  · Block syncing of specific file types (by extension)
  · Allow users to sync SharePoint site libraries
  
  Record which controls exist and note that enforcement requires Group Policy or Intune (covered Week 6). In your Lab Journal: why would an organisation restrict OneDrive sync to domain-joined PCs only?
• Step 6 — Simulate user departure: grant admin access to a OneDrive (20 min)
  This step simulates the process of granting a manager access to a departed user's OneDrive.
  
  Navigate to the SharePoint admin centre → Active sites. In the search box, type /personal/ to filter for OneDrive sites. Find any user's personal OneDrive site (e.g. Kevin Park's).
  
  Click the site → right panel → Membership → Site admins → + Add admins. Add your Global Admin account as a site admin on Kevin Park's OneDrive.
  
  Open Kevin Park's OneDrive by navigating to the site URL shown in Active sites. Verify you can browse and access content as an admin.
  
  In your Lab Journal: what is the difference between this admin access method (direct site admin) and the automatic secondary owner configured in Step 4? When would you use each?

⭐ Bonus: OneDrive quota reporting & Known Folder Move via PowerShell

Reflection & preview

• Ask: "Tom Bellamy's account is deleted today. His OneDrive retention is set to 180 days. His manager is Marcus Webb. What exactly happens on Day 0, Day 1, Day 180, and Day 181?" — walk through the full lifecycle explicitly
• Ask: "You set the default storage quota to 100 GB. Kevin Park already had 1 TB of quota before the change. What is his quota now?" — answer: still 1 TB — existing quotas are not reduced by the default change
• Ask: "A user complains their Desktop folder has disappeared and everything is now in their OneDrive. What happened and was it a mistake?" — surface the KFM user experience and the importance of communicating the change before deploying it
• Exit ticket: describe the complete process — step by step — that you would follow when a Lakeview Logistics employee is terminated today, covering both their OneDrive and their SharePoint site access
• Preview Day 5: Week 4 assessment — a simulated SharePoint permissions breach. A user has accessed a document library they should not have access to. Students audit the permissions chain, identify the misconfiguration, remediate it, and recommend a governance improvement. Come with all lab work complete and your tenant in a clean state