OneDrive
MICROSOFT 365 · FILES & DOCS
The files that person can already reach, and nothing past them.
Acts as the person, not as itself
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Credentials never touch the agent
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Every call on the record
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
microsoft_onedrive_copy_fileWRITECopy a file or folder to another location in OneDrive.
microsoft_onedrive_create_folderWRITECreate a new folder in OneDrive.
microsoft_onedrive_create_share_linkWRITECreate a shareable link for a OneDrive file or folder.
microsoft_onedrive_delete_any_user_fileWRITEDelete a file from any user's OneDrive in the organization.
microsoft_onedrive_delete_fileWRITEDelete a file or folder from OneDrive.
microsoft_onedrive_download_fileREADDownload the binary content of a file from OneDrive.
microsoft_onedrive_get_fileREADGet metadata for a specific file or folder in OneDrive.
microsoft_onedrive_get_file_versionsREADList version history of a file in OneDrive (OneDrive Business only).
microsoft_onedrive_grant_file_permissionWRITEGrant a specific user read or write access to a OneDrive file.
microsoft_onedrive_list_file_permissionsREADList all permissions (share links and direct grants) on a OneDrive item.
microsoft_onedrive_list_filesREADList files in OneDrive root or a specific folder.
microsoft_onedrive_list_recent_filesREADList recently accessed files from the user's OneDrive.
microsoft_onedrive_list_shared_with_meREADList files shared with the user from other OneDrive accounts.
microsoft_onedrive_list_sharepoint_site_drivesREADList document libraries (drives) within a SharePoint site.
microsoft_onedrive_list_sharepoint_sitesREADList SharePoint sites in the organization.
microsoft_onedrive_move_fileWRITEMove a file or folder to a different location in OneDrive.
microsoft_onedrive_read_any_user_fileREADRead a file from any user's OneDrive in the organization.
microsoft_onedrive_read_selected_fileREADRead a specific file the user explicitly selected/consented to share.
microsoft_onedrive_read_sharepoint_fileREADRead a file from a SharePoint document library.
microsoft_onedrive_rename_fileWRITERename a file or folder in OneDrive.
microsoft_onedrive_restore_file_versionWRITERestore a file to a previous version in OneDrive.
microsoft_onedrive_revoke_file_permissionWRITERevoke a specific permission from a OneDrive file.
microsoft_onedrive_search_all_org_filesREADSearch files across all users' OneDrive storage in the organization.
microsoft_onedrive_search_filesREADSearch for files in OneDrive by name or content.
microsoft_onedrive_upload_fileWRITEUpload a file to OneDrive (simple upload, max ~4 MB).
microsoft_onedrive_upload_large_fileWRITEUpload a large file (>4 MB) to OneDrive using an upload session.
microsoft_onedrive_write_any_user_fileWRITEWrite or update a file in any user's OneDrive in the organization.
microsoft_onedrive_write_selected_fileWRITEWrite to a specific file the user explicitly selected/consented to share.
microsoft_onedrive_write_sharepoint_fileWRITEUpload or update a file in a SharePoint document library.
Often connected alongside
Put OneDrive behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.