Setup (Certificate)

Set up certificate authentication for the OneDrive indexing app. Microsoft 365 provides identity crawling and the tenant ID, while you enter the OneDrive app's client ID, certificate, and private key on the OneDrive connector.

If Glean marks those credentials as inherited from Microsoft 365, keep using the shared app and manage its credentials on the parent connector. You don't need to recreate the connection or reauthenticate users because these instructions changed.

Required permissions for setup

Complete these prerequisites before you configure the app:

• Have the Microsoft 365 Global Admin role to grant admin consent. See Commonly used Microsoft 365 admin center roles.
• Set up the Microsoft 365 parent connector for identity crawling and tenant settings. See Microsoft 365.

Register the OneDrive app

If your credentials are inherited, use the existing shared app and continue to Add content permissions to the OneDrive app. Otherwise, create a separate app for OneDrive:

1. Sign in to the Azure portal. Select Microsoft Entra ID → Manage → App registrations → New registration.
2. Name the app Glean OneDrive and select Accounts in this organizational directory only (single tenant). Use the same tenant as the Microsoft 365 parent connector. Leave Redirect URI blank for now.
3. Click Register and copy the Application (client) ID.
4. Generate a certificate and private key, then upload the public certificate under Manage → Certificates and secrets → Certificates on the OneDrive app. Use the certificate-generation procedure in Microsoft 365 setup, but upload the certificate to this OneDrive app rather than the parent.

Add content permissions to the OneDrive app

The identity permissions User.Read.All, GroupMember.Read.All, Member.Read.Hidden, and Reports.Read.All stay on the Microsoft 365 parent app. Don't add them to a separate OneDrive app.

Grant these Microsoft Graph application permissions on the app used by OneDrive:

Permission	Requirement	Purpose
Files.ReadWrite.All	Required	Reads files and creates webhook subscriptions over drives. Glean doesn't write to your files.
Sites.FullControl.All	Recommended	Helps Glean track permission changes. It isn't required to complete OneDrive indexing setup.

In the Azure portal, select the app under Microsoft Entra ID → Manage → App registrations. Go to Manage → API Permissions → Add a permission → Microsoft Graph → Application permissions and add the permissions.

Grant admin consent

As a Microsoft 365 Global Admin, grant consent for the permissions you added:

1. Open Enterprise applications in Azure.
2. Select the app used by OneDrive.
3. Open Security → Permissions, review the permissions, and click Grant admin consent.

Configure OneDrive in Glean

Enter credentials on the OneDrive child connector, unless its fields are marked as inherited:

1. In the Admin console, select OneDrive under Microsoft 365 and open Setup.
2. Enter the OneDrive app's Application (client) ID and upload the certificate (.crt) and private key (.key). The Directory (tenant) ID comes from the Microsoft 365 parent. It may appear as read-only in the previous setup and isn't shown in the guided indexing form.
3. Click Save. If you are using the guided Set up indexing step, click Continue instead.

Don't register extra apps for crawl speed. If additional apps are already configured, keep them in place and maintain their permissions and credentials. Manage them on Microsoft 365 if the additional-app fields are inherited.

When you rotate a OneDrive certificate, upload the new public certificate to the OneDrive app and any additional OneDrive apps that use it. Replace the certificate and private key on the OneDrive connector in Glean. Change the parent credentials only if the OneDrive fields identify them as inherited.

For native real-time access, configure delegated permissions and the redirect URI on the default app used by OneDrive, not on every additional crawler app. This is separate from tools OAuth. See Real-time access for OneDrive.