Appearance

Cloud Storage Integration (Turbo Drive) ​

Provide direct, secure access to enterprise cloud storage and file shares in Turbo Launcher without relying on local sync clients. Turbo Drive mounts provider-backed storage as a virtual filesystem that can be selectively exposed to applications via structured mounts and policy. This enables seamless open/save workflows with OneDrive, Dropbox, and SMB shares inside isolated Turbo containers.

This page focuses on Turbo Drive provider namespaces and platform-specific patterns. For mount fundamentals (shape, scope, precedence, validation), see Mounts & Shared Storage. For an administrator overview of how Storage Contexts, structured mounts, Turbo Drive, and file handling fit together, see Storage and File Management.

What You'll Learn

  • How Turbo Drive exposes cloud storage to Turbo containers
  • Recommended patterns for mounting cloud folders into apps
  • Provider examples: OneDrive, Dropbox, SMB
  • Security posture, ABAC gating, and DLP considerations

Overview ​

Turbo Drive is a virtual filesystem that appears as a mounted location on the host. The host mechanism is platform-specific: a mapped drive (T:) on Windows, a FUSE mount (/mnt/tdrive) on Linux, and a File Provider domain under ~/Library/CloudStorage/Turbo Drive on macOS (the same mechanism OneDrive and Dropbox use to present cloud storage on modern macOS). It brokers secure, policy-controlled access to enterprise storage providers configured on the Turbo Server.

macOS: File Provider, not /Volumes

On macOS, Turbo Drive is delivered as a File Provider domain materialized under ~/Library/CloudStorage/Turbo Drive — not a volume under /Volumes. This is what lets sandboxed Apple apps (Preview, TextEdit, …) open and save through it, and it is gated so that only sandboxed processes can read the storage root (regular Finder and other non-sandboxed host processes are denied). When authoring policy source values, write the home directory as the @HOME@ token, e.g. @HOME@/Library/CloudStorage/Turbo Drive/OneDrive/....

Applications launched from Turbo Launcher can access cloud storage by mapping Turbo Drive folders into the container using structured mounts — no local sync client required.

Key capabilities

  • Direct, brokered access to enterprise storage providers (no local sync)
  • Per-app, per-profile, or global mounts
  • Read-write or read-only access, with ABAC gating
  • Predictable container destinations using tokens (e.g., @DOCUMENTS@)
  • Works across native and SaaS apps launched via Turbo

See provider setup and server-side options:

How it works ​

  1. Admins configure cloud storage connections on Turbo Server.
  2. Turbo Drive mounts those connections into a single virtual namespace on the endpoint (for example, T:\\... on Windows, ~/Library/CloudStorage/Turbo Drive/... on macOS, or /mnt/tdrive/... on Linux).
  3. Turbo Launcher maps selected Turbo Drive folders into application containers using structured mounts defined in policy.
  4. Users open and save files directly to cloud folders from within the application.

Notes

  • Turbo Drive brings its own secure caching and access logic; do not rely on OS-mapped UNC or local sync clients.
  • You can globally expose common cloud folders to all apps, or scope mounts to specific apps/profiles only.
  • Use structured mounts to map from Turbo Drive (source) to a stable container path (destination):
    • Source example: T:\\OneDrive\\Tenants\\contoso.onmicrosoft.com\\Users\\{User.UPN}\\Documents
    • Destination example: @DOCUMENTS@\\Cloud\\OneDrive
    • Platform-specific source examples:
      • Windows: T:\\OneDrive\\Tenants\\contoso.onmicrosoft.com\\Users\\{User.UPN}\\Documents
      • macOS: ~/Library/CloudStorage/Turbo Drive/OneDrive/Tenants/contoso.onmicrosoft.com/Users/{User.UPN}/Documents
      • Linux: /mnt/tdrive/OneDrive/Tenants/contoso.onmicrosoft.com/Users/{User.UPN}/Documents
  • Prefer read-only mounts for high-risk apps; selectively allow read-write where required.
  • Use ABAC requirements to restrict mounts by user attributes, device posture, or geography.

Configuration examples ​

Cloud storage mounts follow a common pattern:

  1. Choose a Turbo Drive source (provider namespace path).
  2. Choose a stable container destination (typically under a well-known token such as @DOCUMENTS@).
  3. Decide on scope (global, per app, or per launch profile).
  4. Optionally add ABAC requirements for visibility.

Example 1 — Global OneDrive Documents ​

1. Global mount scaffold ​

json
{
  "configuration": {
    "launch": {
      "mounts": [
        {
          "name": "OneDriveDocs",
          "source": "<TDRIVE_ONEDRIVE_USER_DOCS>",
          "destination": "@DOCUMENTS@\\Cloud\\OneDrive",
          "options": ["read-write"]
        }
      ]
    }
  }
}
  • name — identity key used for merging and troubleshooting.
  • source — Turbo Drive path to the user's OneDrive Documents folder.
  • destination — where the folder appears inside the container.
  • options — "read-write" or "read-only".

2. Platform-specific source values ​

Use the appropriate Turbo Drive mount point for each OS:

PlatformExample source value
WindowsT:\\OneDrive\\Tenants\\contoso.onmicrosoft.com\\Users\\{User.UPN}\\Documents
macOS~/Library/CloudStorage/Turbo Drive/OneDrive/Tenants/contoso.onmicrosoft.com/Users/{User.UPN}/Documents
Linux/mnt/tdrive/OneDrive/Tenants/contoso.onmicrosoft.com/Users/{User.UPN}/Documents

Substitute the correct value for <TDRIVE_ONEDRIVE_USER_DOCS> in your policy.

3. Optional ABAC gating ​

json
{
  "name": "OneDriveDocs",
  "source": "T:\\OneDrive\\Tenants\\contoso.onmicrosoft.com\\Users\\{User.UPN}\\Documents",
  "destination": "@DOCUMENTS@\\Cloud\\OneDrive",
  "options": ["read-write"],
  "visibility": {
    "abac": {
      "requirements": {
        "userAttributes": { "m365Licensed": "true" }
      }
    }
  }
}

Only users with m365Licensed=true will see this mount.

Example 2 — Per-app Dropbox Team folder (read-only) ​

Use a per-app mount to expose a shared team folder to a specific application:

json
{
  "apps": [
    {
      "id": "adobe-reader",
      "modifications": {
        "mounts": [
          {
            "name": "DropboxTeam",
            "source": "<TDRIVE_DROPBOX_TEAM_FOLDER>",
            "destination": "@DOCUMENTS@\\Cloud\\DropboxTeam",
            "options": ["read-only"]
          }
        ]
      }
    }
  ]
}

Typical source values:

PlatformExample source value
WindowsT:\\Dropbox\\Teams\\Contoso\\Engineering
macOS~/Library/CloudStorage/Turbo Drive/Dropbox/Teams/Contoso/Engineering
Linux/mnt/tdrive/Dropbox/Teams/Contoso/Engineering

Use read-only mounts broadly for shared team folders; grant read-write only where editing is required.

Example 3 — Profile-scoped SMB share for editors (read-write) ​

Use a launch profile to grant additional access (for example, an editor role):

json
{
  "apps": [
    {
      "id": "contoso-doc-editor",
      "profiles": [
        {
          "id": "editor",
          "label": "Editor Mode",
          "mounts": [
            {
              "name": "DeptShare",
              "source": "<TDRIVE_SMB_DEPT_SHARE>",
              "destination": "@DOCUMENTS@\\Cloud\\DeptDocs",
              "options": ["read-write"],
              "visibility": {
                "abac": {
                  "requirements": {
                    "userAttributes": { "role": "editor" }
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

Typical source values:

PlatformExample source value
WindowsT:\\SMB\\Shares\\Dept\\Docs
macOS~/Library/CloudStorage/Turbo Drive/SMB/Shares/Dept/Docs
Linux/mnt/tdrive/SMB/Shares/Dept/Docs

Here, only users with role=editor see the DeptShare mount when they choose the Editor Mode profile.

Provider specifics ​

OneDrive ​

  • Namespace (typical):
    • Windows: T:\\OneDrive\\Tenants\\<tenant>\\Users\\{User.UPN}\\...
    • macOS: ~/Library/CloudStorage/Turbo Drive/OneDrive/Tenants/<tenant>/Users/{User.UPN}/...
    • Linux: /mnt/tdrive/OneDrive/Tenants/<tenant>/Users/{User.UPN}/...
  • Use {User.UPN} or enterprise-defined attributes to route to the correct user folder.
  • Pair with Identity Access policy for browser-based apps to ensure SSO alignment.

Dropbox ​

  • Namespace (examples):
    • Windows
      • Personal: T:\\Dropbox\\Users\\{User.UPN}
      • Teams: T:\\Dropbox\\Teams\\<teamName>
    • macOS
      • Personal: ~/Library/CloudStorage/Turbo Drive/Dropbox/Users/{User.UPN}
      • Teams: ~/Library/CloudStorage/Turbo Drive/Dropbox/Teams/<teamName>
    • Linux
      • Personal: /mnt/tdrive/Dropbox/Users/{User.UPN}
      • Teams: /mnt/tdrive/Dropbox/Teams/<teamName>
  • Recommended: make Teams folders read-only for viewers, grant read-write in editor profiles.

SMB ​

  • Namespace (typical):
    • Windows: T:\\SMB\\Shares\\<shareName>\\...
    • macOS: ~/Library/CloudStorage/Turbo Drive/SMB/Shares/<shareName>/...
    • Linux: /mnt/tdrive/SMB/Shares/<shareName>/...
  • Use read-only mounts broadly; scope read-write to editing workflows or trusted apps.
  • For path portability, prefer provider namespaces over raw UNC paths.

Security posture and DLP ​

  • Turbo Drive access is brokered and audited by Turbo; containers see only the folders you mount.
  • Combine with Data Motion policy for clipboard and screen capture controls.
  • Use ABAC requirements to gate cloud mounts by classification, device posture, geo, or user group.
  • Do not configure cloud folders as Files tab Storage Contexts; use structured mounts instead. For how this differs from Files tab Storage Contexts, see Storage Contexts vs Structured Mounts.

Troubleshooting ​

  • Verify Turbo Drive is enabled and connected to the configured providers.
  • Confirm mount paths exist in the provider namespace and the user is entitled.
  • If a mount does not appear, check ABAC requirements and provider availability.
  • For server-side setup and diagnostics, see provider docs:
  • For Files tab errors or Storage Context posture failures, see Files Troubleshooting and Secure Sandbox Storage.

Turbo.net © 2025