Managed by an organization

Organizations can manage CloudMount for Windows with Group Policy or Intune. They can set settings that users can’t change, limit the drive types users may add, and add drives to everyone’s File Explorer. On Android, the same drives come from Android Enterprise managed configuration.

Install the templates

CloudMount’s administrative templates are in the CloudMount repository: CloudMount.admx, with its language file en-US/CloudMount.adml.

• Group Policy: copy CloudMount.admx to the central store (\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions) and CloudMount.adml to its en-US folder. The policies are under Administrative Templates > CloudMount, for computers and for users.
• Intune: import the ADMX and ADML under Devices > Configuration > Import ADMX, then create a profile from Templates > Imported Administrative templates.

The policies are registry values under Software\Policies\CloudMount, so any tool that writes the registry can set them. A policy set for the computer wins over the same policy set for the user. CloudMount applies changes while it runs, after the next policy refresh.

Settings

Policy	What it does
Turn off usage and crash data	CloudMount sends no usage statistics or crash reports. A policy can’t turn them on.
Start CloudMount when the user signs in	On or off. A user who turned CloudMount off in Windows’ Startup apps keeps it off there.
Limit the upload speed, Limit the download speed	KB per second for all drives together. 0 is no limit.
Pause syncing on a metered connection	On or off.
Pause syncing in battery saver	On or off.

In Settings, CloudMount says Some of these settings are managed by your organization, and the settings you set are dimmed. Users’ own choices come back when you remove a policy.

Allowed drive types

Allow only these drive types lists the rclone backend types drives may use, such as onedrive, drive, s3, sftp or smb. Add drive offers only those. A drive that uses another type isn’t synced: it shows Not allowed by your organization, and transfers, sync tasks and vaults don’t use it. Its folder and files stay, and it syncs again if you allow its type.

Drives that build on other drives count them too: list crypt for vaults, union for combined drives, alias for aliases, and local for folders on the PC.

Drives the organization adds

Add drives takes a JSON array with one object per drive:

[
  {
    "id": "team",
    "name": "Team files",
    "type": "sftp",
    "options": { "host": "files.example.com" },
    "userSupplied": ["user", "pass"]
  }
]

• id: a stable ID you choose. Change name and keep id to rename a drive; its folder moves.
• name: the drive’s name and its folder’s name in File Explorer. If a user’s own drive has the name already, CloudMount adds “ - managed”.
• type: the rclone backend type.
• options: the backend’s options, as an object or as key = value lines, as in rclone.conf. Write passwords in plain text; CloudMount obscures them.
• userSupplied: options each user enters, such as their own user name and password. CloudMount asks for them on the Drives page and keeps them encrypted on the PC.

CloudMount shows these drives in File Explorer. Users can’t edit, rename, hide or remove them, and they never appear in an exported rclone.conf.

• Remove a drive from the list and it syncs until its changes have uploaded, then leaves File Explorer. Files with changes that couldn’t upload stay in its folder.
• A mistake in an entry keeps that drive as it was last added. A list that isn’t valid JSON changes nothing.
• Drives that sign in through a browser (OAuth, such as OneDrive or Google Drive) can’t be added this way. Users add those themselves.

Every user of a PC can read the policies set for the computer. Set passwords as user policies, or leave them to each user with userSupplied.