Set-SPOTenantSyncClientRestriction

Set-SPOTenantSyncClientRestriction
    [-Enable]
    [-DomainGuids <String>]
    [-BlockMacSync]
    [<CommonParameters>]

Set-SPOTenantSyncClientRestriction
    [-ExcludedFileExtensions <String>]
    [<CommonParameters>]

Set-SPOTenantSyncClientRestriction
    [-GrooveBlockOption <String>]
    [<CommonParameters>]

Set-SPOTenantSyncClientRestriction
    -DisableReportProblemDialog <Boolean>
    [<CommonParameters>]

This cmdlet contains more than one parameter set. You may only use parameters from one parameter set, and you may not combine parameters from different parameter sets. For more information about how to use parameter sets, see Cmdlet Parameter Sets.

You must be at least a SharePoint administrator to run the cmdlet.

Requires a valid Connect-SPOService context to identify the tenant. For information on how to connect to the tenant, see Connect-SPOService

The Set-SPOTenantSyncClientRestriction cmdlet is used to control a variety of tenant-wide administrative settings related to syncing files from OneDrive and SharePoint. You may use it to:

• Set restrictions on whether users can sync items to non-domain joined machines, control the list of allowed domains, and manage whether Mac clients (which do not support domain join) can sync.

• Prevents files with specific extensions from being synced.

• Controls whether users can continue to sync OneDrive for Business libraries with the old OneDrive for Business sync client.

Restrict non-domain joined machines from syncing

The Set-SPOTenantSyncClientRestriction cmdlet can be used to enable the feature for tenancy and set the domain GUIDs in the safe recipients list. When this feature is enabled it can take up to 24 hours for the change to take effect. However, any changes to the safe domains list are reflected within five minutes.

When the feature is enabled the following will occur:

• All OneDrive for Business Sync client requests originating from a domain that is not on the safe recipients list will be blocked.

• All Microsoft OneDrive Mac Sync client and Mac Beta client requests will not be blocked by default.

• Microsoft OneDrive mobile apps are not blocked when this feature is enabled.

• Regardless whether a computer is managed by a device management solution, a sync relationship will not be established unless they are joined to a domain in the Safe Recipient List.

• Any files that have been previously been synced down to your computer will not be deleted.

• When this feature is enabled, please be aware the following upload behavior:

  • New or existing files added to the client will still be uploaded to the server and will not be blocked.
  • Regardless if the computer is joined to a domain which is set in the Safe Recipient List.
  • Regardless if the computer is joined to a domain which is not set in the Safe Recipient List.
  • And for all non-domain joined computers.

• Microsoft OneDrive for Business sync client prior to version 15.0.4693.1000 will stop syncing existing libraries.

• The latest OneDrive for Business sync client can be downloaded from Download OneDrive for Windows or How to install OneDrive for Business for SharePoint and SharePoint Online.

For additional information about how to troubleshoot the OneDrive for Business sync client, see How to switch from an MSI installation of OneDrive for Business (formerly SkyDrive Pro) standalone to a Click-To-Run installation of OneDrive for Business (formerly SkyDrive Pro) standalone.

Block specific file extensions from syncing

The Set-SPOTenantSyncClientRestriction cmdlet can be used to configure a list of file extensions that should not be synced by the OneDrive sync client, such as .PST files.

Any file extension may be blocked using this feature, but note that it may take up to 24 hours for a change to take affect across all user devices. When this feature is enabled, users syncing any file that is in the exclusion list will see an error message informing them of the block.

Set-SPOTenantSyncClientRestriction  -Enable -DomainGuids "786548DD-877B-4760-A749-6B1EFBC1190A; 877564FF-877B-4760-A749-6B1EFBC1190A"

This example enables the feature for the tenancy and adds the domains GUIDs to the safe recipient list.

Set-SPOTenantSyncClientRestriction  -Enable -DomainGuids "786548DD-877B-4760-A749-6B1EFBC1190A; 877564FF-877B-4760-A749-6B1EFBC1190A" -BlockMacSync:$true

This example turns on the Block Mac sync functionality.

Set-SPOTenantSyncClientRestriction  -ExcludedFileExtensions "pptx;docx;xlsx"

This example blocks syncing of PowerPoint, Word, and Excel file types using the new sync client (OneDrive.exe).

Set-SPOTenantSyncClientRestriction  -ExcludedFileExtensions ""

This example clears the ExcludedFileExtension list and lets all file types synced with the new client (OneDrive.exe).

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.