Microsoft OneDrive

Microsoft OneDrive is a cloud storage service that lets users store, sync and share files across devices, with integration into Microsoft Office applications, secure backup and real-time collaboration. The UnifyApps Microsoft OneDrive connector uses the Microsoft Graph API to upload, download, search and organize files and folders, manage sharing permissions and file versions, read drive, user and group details, and react to new or changed files from workflows and agents.

This guide covers every authentication type available on the connection form, and the actions and triggers supported, along with the Microsoft Graph permission each one needs.

Authentication

Before you begin, you should have the following information:

• Connection name: a descriptive name such as MyAppOneDriveIntegration, so the connection is easy to identify later.

• Authentication type: select the type of authentication for connecting to your Microsoft OneDrive account:

  1. OAuth 2.0 (Authorization)

  2. OAuth 2.0 (Authorization) With Custom Credentials

  3. OAuth 2.0 (Client Credentials)

The two OAuth 2.0 (Authorization) types act on behalf of the Microsoft user who signs in, using the delegated permissions you select in the required Scopes field (offline_access is always added so the connection can refresh its token). OAuth 2.0 (Client Credentials) is app-only: it requests https://graph.microsoft.com/.default, so the connection gets the application permissions granted to your app registration in Azure. If Tenant ID is left empty, common is used.

By default, Scopes has Sites.Read.All, Files.Read.All, Group.Read.All and offline_access selected. These cover the read actions and the New File, New Folder and New/updated file triggers. Add more scopes from the list if you use: Add permission, Add permission for site files, Create folder, Delete file or folder, Remove permission, Upload file from URL or Upload file via file content (Files.ReadWrite, or Files.ReadWrite.All for other users' drives and SharePoint); the two real-time triggers (Files.ReadWrite.All, also needed to remove their subscription); List users, Get user details from email or Fetch member groups for a user (User.Read.All); Fetch owned groups for a user (User.Read); or Fetch teams for a user (Team.ReadBasic.All). Keep Files.Read.All (or another Files read scope) selected, because Test Connection lists the root folder of your drive.

Every authentication type also shows optional Event Hub fields. Fill them in only if you use the real-time triggers; see Event Hubs delivery settings below.

1. OAuth 2.0 (Authorization)

Use this when you want to connect with your own Microsoft account and do not need to register an app.

1. Enter a Connection name.

2. Select OAuth 2.0 (Authorization) as the Authentication type.

3. Leave Tenant ID empty to use common, or enter your tenant ID or domain to restrict sign-in to one organization (organizations allows any work or school account, consumers only personal Microsoft accounts).

4. In Scopes, select the permissions for the actions you plan to use (the Delegated value in the tables below).

5. Leave Delegated scopes on, and optionally fill in the Event Hub fields.

6. Click Authorize. You are redirected to the Microsoft sign-in page.

7. Sign in with the Microsoft account whose OneDrive the connection should use.

8. Review the permissions requested on the consent screen and click Accept. Permissions such as Files.Read.All, User.Read.All and Group.Read.All may need administrator consent in your organization.

9. You are redirected back to UnifyApps with a confirmation that the account is connected.

2. OAuth 2.0 (Authorization) With Custom Credentials

Use this when your organization wants the connection to use its own Azure app registration while actions still run on behalf of a signed-in user.

Step 1: App registration in Azure

1. Log in to the Azure portal, search for App registrations and click New registration.

2. Enter a name and choose the supported account type, single tenant or multitenant.

3. Under Redirect URI, choose platform Web and paste the Callback URL shown on the connection form (it is copyable and differs per environment).

4. Click Register.

5. On the Overview tab, copy the Application (client) ID and the Directory (tenant) ID.

6. Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions and add the permissions you will select in Scopes, plus offline_access so the connection can refresh its token. Click Grant admin consent if your tenant requires it.

7. Go to Certificates & secrets → New client secret, add a description and expiry, and click Add. Copy the secret Value immediately and store it securely. It is not shown again.

Step 2: Connection setup in UnifyApps

1. Open Connections → New Connection → Microsoft OneDrive and enter a Connection name.

2. Select OAuth 2.0 (Authorization) With Custom Credentials as the Authentication type.

3. Enter the Client ID, Client Secret and Tenant ID copied from Azure.

4. In Scopes, select the same permissions you added to the app registration.

5. Leave Delegated scopes on, and optionally fill in the Event Hub fields.

6. Click Authorize, sign in with Microsoft and accept the consent screen.

7. Confirm the success message after the redirect back to UnifyApps.

3. OAuth 2.0 (Client Credentials)

Use this for app-only access that does not depend on a signed-in user, for example to work with the OneDrive of any user in your organization. The app acts as itself with application permissions.

Step 1: Register the app in Azure

1. Log in to the Azure portal, search for App registrations and click New registration.

2. Enter a name and supported account type, and click Register. No redirect URI is needed for this flow.

3. From Overview, copy the Application (client) ID and Directory (tenant) ID.

4. Go to API permissions → Add a permission → Microsoft Graph → Application permissions and add the permissions for the actions you plan to use (the Application value in the tables below), for example Files.Read.All or Files.ReadWrite.All.

5. Click Grant admin consent for your tenant. Application permissions always need administrator consent.

6. Go to Certificates & secrets → New client secret, add a description and expiry, and click Add. Copy the secret Value immediately and store it securely. It is not shown again.

Step 2: Create the connection in UnifyApps

1. Open Connections → New Connection → Microsoft OneDrive and enter a Connection name.

2. Select OAuth 2.0 (Client Credentials) as the Authentication type.

3. Enter the Client ID and Client Secret copied from Azure.

4. Enter your tenant ID (or primary domain) in Tenant ID. The field is optional, but this flow needs your actual tenant; the default common is meant for the sign-in based flows.

5. Turn Delegated scopes off. It is on by default, and with it on the connection calls the signed-in user's drive (/me), which an app-only token cannot use. With it off, actions that do not take a user ID work on the OneDrive of the UnifyApps user running the automation, matched by email address; the (for user) actions work on the user you specify.

6. Optionally fill in the Event Hub fields.

7. Click Test Connection to validate the credentials (it lists the root folder of the drive), then click Create.

Event Hubs delivery settings (optional)

The real-time triggers, New/updated file (realtime, for user) and On file change (Event Hubs delivery), receive Microsoft Graph change notifications through Azure Event Hubs. Set this up once and enter the values on the connection.

1. In the Azure portal, click Create a resource, search for Event Hubs and create an Event Hubs namespace. In the namespace, select Event Hubs → + Event Hub and create an event hub.

2. In the namespace, open Access Control (IAM) → + Add → Add role assignment, select the Azure Event Hubs Data Sender role, add the Microsoft Graph Change Tracking service principal as a member and click Review + assign. This lets Microsoft Graph publish notifications to your event hub.

3. Open the event hub, go to Shared access policies → + Add, enter a name, select Listen and click Create. Open the policy and copy Connection string-primary key.

4. On the UnifyApps connection form, enter:

   • Event Hub Namespace: the namespace name, for example contoso-ns.

   • Event Hub Name: the event hub that receives the notifications.

   • Event Hub Consumer Group: leave empty to use $Default.

   • Event Hub Resource ID: https://<namespace>.servicebus.windows.net/eventhubname/<event hub name>.

   • Event Hub Tenant Domain: your tenant's primary domain, for example contoso.com (shown in Microsoft Entra ID → Overview).

   • Event Hub Listen Connection String: the connection string copied in step 3.

5. Leave Event Hub Decryption Private Key and Decryption Key Password empty. The connector's subscriptions send notifications without resource data, so nothing needs decrypting.

See Receive change notifications through Azure Event Hubs for details.

Actions

Scopes are Microsoft Graph permissions. A Delegated value applies to the two OAuth 2.0 (Authorization) types (select it in Scopes); an Application value applies to OAuth 2.0 (Client Credentials) (grant it on the app registration). A single value applies to both. Delegated only marks actions that Microsoft Graph supports with delegated permissions only. Files.Read and Files.ReadWrite cover only the signed-in user's own files; to work with files in other users' drives or in SharePoint, use Files.Read.All or Files.ReadWrite.All instead. Any broader permission also works.

Triggers