Getting rid of onedrive library sync

Microsoft has been pushing ‘Add to Onedrive’ over ‘Synchronize’ for a while now. I missed the enhancement from 500k to 1000k max items.

This makes a lot more viable!

Ensuring users don’t sync is easy with the HideSyncButtonOnTeamSite parameter of Set-SPOTenant, but that does not invalidate existing sync relationships.

So how do we detect which users are syncing, and which libraries? Because we want to transition them too, right?

Here’s a nice remediation script to throw into Intune that’ll help you do just that!

download/readme: https://github.com/jflieben/assortedFunctionsV2/tree/main/O4B/Unsync

DriftMaester sending mail with least privileges

By default, the broad Mail.Send graph api permission was/is often used for applications/managed identities to send emails.

Obviously it is quite rarely the case that an SPN has to be able to send email as ANY user in your tenant…

So for DriftMaester at least, this has now been corrected by removing the Mail.Send permission and instead using an Exchange Online custom RBAC assignment scoped to only the email you specify 🙂

https://github.com/jflieben/DriftMaester