Microsoft OneDrive

MICROSOFT 365 · FILES & DOCS

List, read, and write the files in that person’s OneDrive.

Connect Microsoft OneDrive with Fabriq Developer

Your user consents at Microsoft OneDrive. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “microsoft_onedrive”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="microsoft_onedrive")   # consent at Microsoft OneDrive
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Microsoft OneDrive in practice

OneDrive is throttled by SharePoint Online’s resource-unit budget, so the ceiling is 1,250 resource units per minute per app for a tenant under 1,000 licences and Microsoft suggests estimating the request rate as the unit limit divided by two. Listing a folder costs 2 units per request and checking who can see each item costs 5, so a permissions-aware sync is priced very differently from a file copy.

Scopes that draw scrutiny

Files.ReadWrite.All Admin consent required for both delegated and application forms. It reaches every file the user can access, or every site collection under app-only auth.
Sites.Read.All With app-only authentication an app holding this is allowed to query all SharePoint Online content including users’ private OneDrive for Business content.
Sites.FullControl.All Admin consent in both forms; full control of site collections, which includes the OneDrive site collections behind personal files.

Rate limits

Per app per tenant: 1,250 resource units per minute for 0–1,000 licences, up to 6,250 for 50,000+, and 1,200,000 to 6,000,000 units per 24 hours across the same tiers.
Per app per tenant: 400 GB ingress and 400 GB egress per hour.
Per user: 3,000 requests per 5 minutes, 50 GB ingress and 100 GB egress per hour.
Unit costs: download a file 1, delta with a token 1, multi-item query or create/update/delete/upload 2, any permission operation 5.
Microsoft’s own estimate is an average of 2 resource units per request, so divide the unit limit by 2 to get an approximate request rate.

Who has to approve

Files.ReadWrite.All and Sites.FullControl.All require tenant admin consent in both their delegated and application forms, so an agent that reads across other people’s OneDrive cannot be enabled by the user whose files it reads.

Worth knowing

Delta with a token is deliberately cheaper — 1 unit instead of 2 — so a scanner that re-lists instead of using delta pays double for the same information.
CSOM and REST consume more resource units than Graph for the same functionality and are subject to additional internal limits, so a legacy client throttles earlier than the published numbers suggest.
Repeatedly probing OneDrive site collections that do not exist can get the client’s IP address throttled, after which every OneDrive request returns 429 during the throttling period.
Multi-geo tenants get separate limits per geo, but the licence-dependent limits use the total tenant licence count across all geos.

Checked against Avoid getting throttled or blocked in SharePoint Online (2026-09-29), Microsoft Graph permissions reference (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

microsoft_onedrive_copy_fileWRITE

Copy a file or folder to another location in OneDrive.

Files.ReadWrite

microsoft_onedrive_create_folderWRITE

Create a new folder in OneDrive.

Files.ReadWrite

microsoft_onedrive_create_share_linkWRITE

Create a shareable link for a OneDrive file or folder.

Files.ReadWrite

microsoft_onedrive_delete_any_user_fileWRITE

Delete a file from any user's OneDrive in the organization. Requires Files.ReadWrite.All (admin-consented scope for cross-user file deletion).

Files.ReadWrite.All

microsoft_onedrive_delete_fileWRITE

Delete a file or folder from OneDrive.

Files.ReadWrite

microsoft_onedrive_download_fileREAD

Download the binary content of a file from OneDrive.

Files.Read

microsoft_onedrive_get_fileREAD

Get metadata for a specific file or folder in OneDrive.

Files.Read

microsoft_onedrive_get_file_versionsREAD

List version history of a file in OneDrive (OneDrive Business only).

Files.Read

microsoft_onedrive_grant_file_permissionWRITE

Grant a specific user read or write access to a OneDrive file.

Files.ReadWrite

microsoft_onedrive_list_file_permissionsREAD

List all permissions (share links and direct grants) on a OneDrive item.

Files.Read

microsoft_onedrive_list_filesREAD

List files in OneDrive root or a specific folder.

Files.Read

microsoft_onedrive_list_recent_filesREAD

List recently accessed files from the user's OneDrive.

Files.Read

microsoft_onedrive_list_shared_with_meREAD

List files shared with the user from other OneDrive accounts.

Files.Read

microsoft_onedrive_list_sharepoint_site_drivesREAD

List document libraries (drives) within a SharePoint site. Requires Sites.Read.All (admin-consented scope for SharePoint drive enumeration).

Sites.Read.All

microsoft_onedrive_list_sharepoint_sitesREAD

List SharePoint sites in the organization. Requires Sites.Read.All (admin-consented scope for SharePoint site enumeration).

Sites.Read.All

microsoft_onedrive_move_fileWRITE

Move a file or folder to a different location in OneDrive.

Files.ReadWrite

microsoft_onedrive_read_any_user_fileREAD

Read a file from any user's OneDrive in the organization. Requires Files.Read.All (admin-consented scope for cross-user file access).

Files.Read.All

microsoft_onedrive_read_selected_fileREAD

Read a specific file the user explicitly selected/consented to share. Requires Files.Read.Selected (narrow scope — only accesses files the user explicitly granted).

Files.Read.Selected

microsoft_onedrive_read_sharepoint_fileREAD

Read a file from a SharePoint document library. Requires Sites.Read.All (admin-consented scope for SharePoint file access).

Sites.Read.All

microsoft_onedrive_rename_fileWRITE

Rename a file or folder in OneDrive.

Files.ReadWrite

microsoft_onedrive_restore_file_versionWRITE

Restore a file to a previous version in OneDrive.

Files.ReadWrite

microsoft_onedrive_revoke_file_permissionWRITE

Revoke a specific permission from a OneDrive file.

Files.ReadWrite

microsoft_onedrive_search_all_org_filesREAD

Search files across all users' OneDrive storage in the organization. Requires Files.Read.All (admin-consented scope for org-wide file search).

Files.Read.All

microsoft_onedrive_search_filesREAD

Search for files in OneDrive by name or content.

Files.Read

microsoft_onedrive_upload_fileWRITE

Upload a file to OneDrive (simple upload, max ~4 MB). Provide file content as base64-encoded string.

Files.ReadWrite

microsoft_onedrive_upload_large_fileWRITE

Upload a large file (>4 MB) to OneDrive using an upload session.

Files.ReadWrite

microsoft_onedrive_write_any_user_fileWRITE

Write or update a file in any user's OneDrive in the organization. Requires Files.ReadWrite.All (admin-consented scope for cross-user file write).

Files.ReadWrite.All

microsoft_onedrive_write_selected_fileWRITE

Write to a specific file the user explicitly selected/consented to share. Requires Files.ReadWrite.Selected (narrow scope — only modifies files the user explicitly granted).

Files.ReadWrite.Selected

microsoft_onedrive_write_sharepoint_fileWRITE

Upload or update a file in a SharePoint document library. Requires Sites.ReadWrite.All (admin-consented scope for SharePoint file write).

Sites.ReadWrite.All