0

Performing a migration of all users "personal" files to OneDrive and I'm quite new to this all.

My small organization is in the process of migrating to SharePoint and OneDrive, and our Users are not synced between On Premise AD and AzureAD/365.

Pretty straightforward right, use SharePoint Migration Tool, use an admin account that has read access to FS shares and a Microsoft account that has access to the destination, and set up CSV with sources and destinations.

Problem, The Folder Redirect GPO has the setting :

  • Grant the user exclusive rights. This setting is enabled by default and is a recommended setting. This setting specifies that the administrator and other users do not have permissions to access this folder.

No admin rights, on the targeted files. And the SharePoint Migration Tool requires READ rights on the source and READ/WRITE on the destination of the migration.

So we have something akin to :

\fileserver\users\user1\Documents \fileserver\users\user2\Documents

Admin Full Control ends after \user1\ and anything beyond requires taking ownership ...

Now my original idea was to just take ownership recursively, migrate to OneDrive and be done with that, my "boss" view is that there should be a way with user logins.

Running completely blank...

Mostly looking for ideas, alternatives or warnings for problems that I would not be expecting.

If it can't be done like this, it can't be done...

Improve this question
5
  • For GDPR reasons, admins are not supposed to have read access to user documents Says who? Someone has to be able access them. This is nonsense. If you make a statement like that, you need to be able to provide hard data to support it.
    – Greg Askew
    Commented Apr 5, 2023 at 10:53
  • Not my statement per say, but it's the limitation put on us, my "manager" is a GDPR referee in our public organization, and it's set up that way.
    – paypercorn
    Commented Apr 5, 2023 at 11:24
  • GDPR typically applies where entities are interacting with the public. To ensure the data they provide the entity is used in the manner specified in their agreement, and limit the types of data collected and usages. This forum, and M365 in particular are typically used by end user organizations, where most of the data is private/internal and belongs to the entity. Furthermore, you cannot even provide any assurance whatsoever that other entities, such as Microsoft employees, can access the data. Which they certainly can, unless you have encrypted it.
    – Greg Askew
    Commented Apr 5, 2023 at 11:34
  • In other words, your question would be simpler and easier to present and answer if you removed all of the non-relevant information on GDPR and just asked how to migrate and manage the data without granting administrators permissions. There are much better ways to protect confidentiality of data than co-mingling non-related concepts and assuming permissions are the solution.
    – Greg Askew
    Commented Apr 5, 2023 at 11:37
  • You're definitely correct, wanted to illustrate context but waste of time, adjusted the post. For more unecessary context, my entity is a public one, which may lead to a more rigid application of GDPR.
    – paypercorn
    Commented Apr 5, 2023 at 13:08

1 Answer 1

Reset to default
0

You can migrate user data to OneDrive without ever needing to touch user data.

You'll first need to disable your existing Folder Redirection and have the user folders redirected back to the default location. Then you'll need to implement a OneDrive KFM GPO to redirect the user folders to OneDrive.

This doesn't require that admins access user folders in any way, shape, or form.

https://learn.microsoft.com/en-us/sharepoint/redirect-known-folders

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789199(v=ws.11)

As for Microsoft accessing your data, if you have the licensing for it, you can implement Microsoft Purview Customer Lockbox to ensure that they don't without your explicit approval.

https://learn.microsoft.com/en-us/microsoft-365/compliance/customer-lockbox-requests?view=o365-worldwide

Improve this answer
4
  • Wish I could do it that way and it's what we want to enable once their account has been pre-provisionned (by migrating current folders). Currently this is not an option as OneDrive redirect / syncing does not like Fileserver redirect. serverfault.com/questions/1023197/…
    – paypercorn
    Commented Apr 5, 2023 at 13:20
  • Tested it out on a user unaffected by GPO, OneDrive Known Folder Sync is available until the GPO is applied and his Documents are moved to the network share.
    – paypercorn
    Commented Apr 5, 2023 at 13:32
  • I'm not quite understanding what you're saying, but the users folder redirection to the network share needs to be disabled and the users folders need to be redirected back to the local profile before you can implement the OneDrive KFM.
    – joeqwerty
    Commented Apr 5, 2023 at 15:38
  • That's what I meant :^)
    – paypercorn
    Commented Apr 5, 2023 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .