OneDrive overview
Glean connects to Microsoft OneDrive in three ways, each serving a different use case. All content access runs under the shared Microsoft 365 parent connector app registration. OneDrive doesn't support client secrets — certificate authentication is the only method.
OneDrive is a child connector of the Microsoft 365 parent connector, which provides shared authentication and identity crawling. Set up Microsoft 365 first. OneDrive then inherits its credentials (client ID, tenant ID, and certificate) and needs only OneDrive-specific configuration.
Capabilities
Glean connects to OneDrive once, through the shared Microsoft 365 app registration, and that single connection provides three capabilities: indexed search, real-time access, and read and write tools. The new setup configures all three in one pass, because indexing and real-time access are both turned on when you connect and tools are set up in the same flow. With the previous setup, indexing is configured first and an administrator enables real-time access separately. Real-time access and tools each require the individual user to authorize their own OneDrive account before they take effect for that user.
Which capabilities do you need
Use the comparison below to see what each capability contributes to search, ranking, and agent behavior.
| What you get | Indexed connector | Real-time access | Read and write tools |
|---|---|---|---|
| Coverage | Org-wide: everything crawled is searchable by anyone with permission | Per-user: only content the querying user can access | – |
| Freshness | Near real-time (webhook-driven updates) | Always live (fetched at query time) | – |
| Fetch a specific document by URL | ✗ (only documents already in the index) | ✓ (fetched live, even if never indexed) | – |
| Agents can read and summarize documents | ✓ | ✓ | Through read tools |
| Agents can create, move, or share files | – | – | ✓ |
| Content stored in Glean's index | Yes (crawled and indexed) | No (nothing stored) | No |
| Separate app registration | No (inherits Microsoft 365) | No (inherits Microsoft 365) | Yes (separate setup) |
| Best for | Broad, ranked, everyday search | Volatile or sensitive content kept current | Agentic file management |
Set up OneDrive
- Choose your setup: Start with this page to identify which of Glean's two setup paths applies to you, which depends on when OneDrive was connected to your deployment.
- New setup: Follow this path if you are connecting OneDrive for the first time. The new setup connects OneDrive and configures indexing on a single page in the Admin console.
- Previous setup: Follow this path if OneDrive was already connected to your deployment before the new setup was introduced. Those connectors continue to work, and there is no migration to run. This page also covers indexing in detail—required permissions, what Glean crawls, and setup steps.
- Real-time access: An optional layer that fetches content live from OneDrive at query time — for content that must always be current, or that you'd rather not store in Glean's index.
- Read and write tools: The New setup configures these through a separate Central or Custom OAuth step. They let Glean agents act in OneDrive.
Permissions and security
Glean reads all user access permissions from OneDrive and enforces them at query time, so users only see results they have access to. All authentication uses certificate-based application permissions with admin consent. Indexing uses no delegated user privileges.