Skip to content
Leverage AI Developer Support

OneDrive Connector

Use this page when you need the Microsoft-side setup details for the OneDrive connector. For shared connector behavior, start with Connectors Overview and Provider Auth And Setup.

Runtime Shape

Section titled “Runtime Shape”
  • Implemented modes: live by default, optional indexed
  • Auth binding: Better Auth generic OAuth provider id microsoft
  • Callback URI examples:
    • http://localhost:3001/api/auth/oauth2/callback/microsoft
    • https://auth.example.com/api/auth/oauth2/callback/microsoft
  • Setup console URL:
  • Required connector scopes:
    • Files.Read.All

Provider-Specific Gotchas

Section titled “Provider-Specific Gotchas”
  • OneDrive uses live file document search by default. Live access includes Microsoft Graph file/folder resource listing for picker/focus flows and file-resource-live-query for provider full-text/keyword document search plus bounded transient reads.
  • Indexed mode is optional and recommended for faster, broader semantic document answers over larger or historical OneDrive corpora. If enabled, eligible extracted chunks and vectors are retained for retrieval. Keeping OneDrive live-only avoids embedding sync and indexed artifact retention.
  • Live and indexed OneDrive coverage must include items shared with the current user. Graph broad drive search and shared traversal can return shared items through remoteItem, which must be resolved before metadata/content fetches and before indexing shared-folder children. The connector requests Files.Read.All for full shared-with-user access; add Sites.Read.All only if real-provider smoke proves Files.Read.All cannot satisfy shared-file or shared-folder coverage.
  • OneDrive is not currently a Library upload destination. The Library upload picker lists upload-capable connectors only, and OneDrive should remain hidden there until a Microsoft Graph write-scope upload adapter is implemented and tested.
  • The future OneDrive upload adapter should use Microsoft Graph file upload APIs, request least-privileged delegated write scope such as Files.ReadWrite when accepted by product/security review, define folder/path behavior, and add tests proving read-only OneDrive remains browse/focus-only until the adapter is registered.
  • OneDrive live-only connections do not enqueue embedding sync. Manual sync is available when indexed mode is enabled.
  • OneDrive and Outlook share the same connector auth binding. If an existing linked microsoft account is missing Files.Read.All, reconnect and grant the expanded delegated permission set.
  • Local support verification for OneDrive file search should use connector prompt packs plus agent-browser chat smoke so source-backed answers, shared access, source panels, and user-facing terminology are checked together.
  • The repo keeps Microsoft connector auth on the generic OAuth path because tenant-scoped auth and account-selection behavior are already verified there. Make tenant restrictions explicit in the app registration instead of relying on browser-session reuse.

Canonical Sources

Section titled “Canonical Sources”
  • packages/domain/src/connectors/connectorRegistry.ts
  • apps/auth/src/genericOAuthProviders.ts
  • apps/api/src/connectors/oauthTokenClient.ts
  • docs/features/connectors/spec.md

Official Docs

Section titled “Official Docs”