OneDrive doesn't start on Mac: the Intune fix

The symptom: a brand-new machine, a silent sync

Picture it. New employee, Mac freshly enrolled, everything is supposed to be ready on the first morning. Except their Desktop and Documents files never reach OneDrive. They open the app once, by hand, and off it goes. The next day, nothing: OneDrive didn't relaunch at login.

For an IT manager this is the worst kind of problem: invisible until somebody complains. The Intune dashboard shows the profile as applied. The configuration is there. Nothing flashes red. The breakage hides in the gap between "the setting is present" and "the setting actually does something".

The technical trap: "allowed" is not "enabled"

This is where it gets sneaky. Since version 24.113 of the sync app, the OpenAtLogin setting (the one almost every macOS Intune baseline deploys, the one the documentation was still teaching) is deprecated. It is a silent no-op. The profile applies, defaults read shows the key, and OneDrive does not start at login. No error message. The setting exists, but it is no longer wired to anything.

Its apparent replacement, a Managed Login Items profile (com.apple.servicemanagement, team UBF8T346G9), falls into a second trap that is subtler still. It allows the login item, but never enables it. In practice, inside macOS's background task management registry (BTM), the disposition stays [disabled, allowed]. You can check it yourself:

sfltool dumpbtm | grep -A8 "OneDrive Launcher"

allowed, yes. enabled, no. Since macOS Ventura, enabling a login item goes through SMAppService, and that activation is triggered by the application itself, in the context of the signed-in user. An MDM cannot do it on its behalf. Intune can permit; it cannot press the button.

Here is the real trap: Macs already in service registered their login item a long time ago, and it survives updates. So the existing fleet looks perfectly healthy. Only fresh enrolments come out broken. The problem is real, but it only shows up on new machines, exactly where nobody is looking.

The fix: trigger the activation in the user's context

Since only the application can enable the login item, the solution is to ask it to do so, from the user and not from the system:

OneDrive.app/Contents/MacOS/OneDrive /createloginitem

Two conditions make this robust rather than a bandage:

• run it as the signed-in user (never as root: SMAppService lives in the session context);
• deploy it as a recurring Intune script, not a one-shot. A script that runs once misses every machine enrolled after it fired, and misses the cases where the user was not yet signed in when it ran.

Once applied, revalidate in the same place you diagnosed. The BTM disposition must have moved to [enabled, allowed]:

sfltool dumpbtm | grep -A8 "OneDrive Launcher"

Green for green this time, but a green that means something.

How we caught it at ProsperIT

This article is not a theoretical find. The source is Roy Klooster (RK Solutions), who documented the trap and verified it on his own machine: rksolutions.nl/posts/macos-onedrive-open-at-login/. The credit is entirely his.

What we can tell you about is the monitoring behind it. The same day it was published, the article was analyzed by our fleet management agents, distilled for our exact stack, and a verdict was recorded: deploy, but only after validation on our internal bench. We immediately opened the right questions. Does our own baseline still ship OpenAtLogin=True? Does the /createloginitem script respect our house rules (recurring, user context)?

We never deploy a fix to a client fleet without proving it on our own hardware first. The sequence is simple and non-negotiable: internal bench, sfltool capture before and after on a freshly enrolled Mac, then replication.

That is the kind of IT concierge work we aim for: a glitch that stays invisible elsewhere, because it only hits new machines, gets spotted, framed and tested before a single user complains about it.

Do you manage a fleet of Macs under Intune? Check OneDrive's BTM disposition on a recently enrolled machine. If it reads [disabled, allowed], you are exactly in the trap described here, and we can help you close it.

---

Source

• Roy Klooster, RK Solutions, macOS OneDrive Open at Login: rksolutions.nl/posts/macos-onedrive-open-at-login/ (published 15 July 2026, verified on-device by the author on OneDrive 26.113 / macOS 26.x). Credit for the discovery is entirely his.