What KFM does
Known Folder Move (KFM) redirects the Windows Desktop, Documents and Pictures known folders into OneDrive. Content moves under the user's OneDrive and syncs like any other folder — so a re-imaged or stolen laptop means a new machine signs in, KFM re-points the folders, and the user's working files reappear. It's the single highest-value endpoint-resilience feature most tenants under-deploy.
Silent deployment (the way to roll it out)
KFM is meant to be pushed, not clicked. Via ADMX/Intune policy:
SilentAccountConfig— sign the user into OneDrive automatically using their Windows (Entra) credentials, no manual setup.KFMSilentOptIn(set to the tenant ID) — silently redirect the known folders without user interaction.KFMBlockOptOut— stop users un-redirecting the folders back to local.
Pre-provision OneDrives first (Request-SPOPersonalSite) so there's a destination
before the policy fires.
The dangerous misconception: sync is not backup
KFM keeps files in sync, both directions and continuously. That means:
- Delete propagates. Delete a file locally and it deletes in OneDrive (recoverable from the recycle bin for a window, not forever).
- Ransomware propagates. Locally encrypted files sync their encrypted versions up. KFM does NOT stop this — what saves you is version history and OneDrive Files Restore (rewind the whole OneDrive to a point in time within ~30 days), covered in the ransomware-recovery concept. KFM plus versioning is resilience; KFM alone is not backup.
The gotchas
- OneNote notebooks are not moved by KFM — they sync through their own mechanism; don't assume a redirected Documents folder captures notebooks.
- Path length and existing conflicts. If Documents already contains deeply nested or duplicate-named content, redirection can partially fail (the sync-client path-length limit applies).
- Shared/multi-user PCs. KFM redirects per-user; a shared kiosk or a device with roaming profiles needs careful handling, or you sync the wrong person's data.
- Large/old folders can take a long time on first upload and hammer a slow link; stagger rollout.
- Non-redirectable content. App data, PSTs and huge media libraries either won't move or shouldn't — KFM covers Desktop/Documents/Pictures, not the whole profile.
What to watch (proofs)
- Policy applied: the OneDrive ADMX/Intune settings on the device
(
HKCU\Software\Policies\Microsoft\OneDrive—KFMSilentOptIn,SilentAccountConfig) — proof KFM is actually enforced, not just available. - Redirection status: the OneDrive client's Backup tab shows each known folder as "Backed up" or not — the per-user truth.
- Coverage across the fleet: OneDrive sync health / Intune reporting — percentage of devices with KFM active (the resilience metric).
- Recovery readiness: confirm version history and Files Restore are available on the OneDrives (ransomware-recovery concept) — KFM without them is not protection.