OneDrive
Glean connects to Microsoft OneDrive in three ways, each serving a different use case. All content access runs under the shared Microsoft 365 parent connector app registration. OneDrive doesn't support client secrets — certificate authentication is the only method.
OneDrive is a child connector of the Microsoft 365 parent connector, which provides shared authentication and identity crawling. Set up Microsoft 365 first; OneDrive then inherits its credentials (client ID, tenant ID, and certificate) and needs only OneDrive-specific configuration.
Connection options
The indexed connector is the foundation; real-time access and read and write tools are optional add-ons.
Which option do you need?
You can use the options independently or together, and many organizations enable all three.
| What you get | Indexed connector | Real-time access | Read and write tools |
|---|---|---|---|
| Coverage | Org-wide: everything crawled is searchable by anyone with permission | Per-user: only content the querying user can access | — |
| Freshness | Near real-time (webhook-driven updates) | Always live (fetched at query time) | — |
| Fetch a specific document by URL | ✗ (only documents already in the index) | ✓ (fetched live, even if never indexed) | — |
| Agents can read and summarize documents | ✓ | ✓ | Through read tools |
| Agents can create, move, or share files | — | — | ✓ |
| Content stored in Glean's index | Yes (crawled and indexed) | No (nothing stored) | No |
| Separate app registration | No (inherits Microsoft 365) | No (inherits Microsoft 365) | Yes (separate setup) |
| Best for | Broad, ranked, everyday search | Volatile or sensitive content kept current | Agentic file management |
Set up OneDrive
- Set up the indexing connector: The foundation — crawls OneDrive files and folders into Glean's index for permission-aware, ranked, org-wide search. Covers required permissions, what gets indexed, and setup steps.
- Real-time access: An optional layer that fetches content live from OneDrive at query time — for content that must always be current, or that you'd rather not store in Glean's index.
- Read and write tools: Configured separately — lets Glean agents act in OneDrive.
Permissions and security
Glean reads all user access permissions from OneDrive and enforces them at query time, so users only see results they have access to. All authentication uses certificate-based application permissions with admin consent; indexing uses no delegated user privileges.