OneDrive setup

You're reading the new setupSee the previous setup interface →

Connect OneDrive through the guided Microsoft 365 flow to configure tools and set up permission-aware indexing. Microsoft 365 provides identity crawling and tenant settings. Configure OneDrive's own app client ID and certificate in the Set up indexing step when those fields are editable.

If Glean marks the app credentials as inherited from Microsoft 365, keep the existing shared app and manage its credentials on Microsoft 365. You don't need to recreate a connection, replace an existing app, or reauthenticate users because these instructions changed.

• The Connect step configures read and write tools. Each user must authorize their own OneDrive account to use them. Tools run with that user's permissions.
• Permission-aware search. Glean crawls your OneDrive files and folders into its index and mirrors OneDrive access controls, enforced at query time, so each user sees only the files they can open in OneDrive.
• Real-time access. OneDrive also supports fetching always-live results at query time, alongside the indexed search. See Real-time access for details.

1. Configure tools in Connecttoday — current step
2. Set up indexingtoday — current step
3. Review setup and begin indexingtoday — current step
4. Crawl runs in the backgroundtoday — happens automatically
5. Permission-aware search switches ona few days — happens automatically

Feature availability after setup

The Connect step configures tools, which each user authorizes separately. Search switches on once you begin indexing and the first crawl completes. How long the first crawl takes depends on the size of your corpus.

Capability	When it becomes available	Whose permissions apply
Read and write tools	After you complete Connect and the user authorizes tools	Each user's own OneDrive permissions, through their own authorization
Permission-aware search	Once you begin indexing and the first crawl completes	OneDrive access controls, mirrored into the index and enforced at query time
Real-time access	Once the connector is connected and each user authenticates	Each user's own OneDrive permissions, checked at query time

Connector setup

Complete the Microsoft 365 parent setup before configuring OneDrive's tools and indexing.

Prerequisites

Confirm the following before you begin.

Requirement	Why it is needed
A Glean admin who can add and configure connectors	Adds the OneDrive connector and completes setup in the Admin console
A Microsoft 365 Global Admin	Registers the OneDrive app, uploads the certificate, and grants admin consent for the API permissions
A configured Microsoft 365 parent connector	Provides identity crawling and the tenant ID. See Microsoft 365.

Step 1. Log in to the Admin console

Sign in to Glean and go to Connectors in the Admin console. Add the OneDrive connector under Microsoft 365.

Step 2. Connect

Configure the OAuth app for OneDrive's tools. Users authorize their own accounts separately.

1. Under Select an authorization method, pick one option.

   • Central (recommended). Use Glean's managed OAuth app, which needs no configuration.
   • Custom. Use your own Azure OAuth app. You provide a client ID and client secret.

   See Central and custom authentication for Microsoft 365 tools for the full instructions. The same steps apply to OneDrive, SharePoint, and Outlook.

2. Select Continue to save the tools configuration and proceed to Set up indexing.

Step 3. Set up indexing

These indexing setup instructions use certificate-based authentication for the OneDrive app. Tools authorization is separate from these credentials.

1. Check the credential fields. If Glean marks them as inherited, use the existing Microsoft 365 app and continue to step 5. Manage its credentials on the parent. Otherwise, register a OneDrive app as described in the next step.

2. Sign in to the Azure portal. Select Microsoft Entra ID → Manage → App registrations → New registration. Register the app in the same tenant as the Microsoft 365 parent connector:

   • Set Name to Glean OneDrive.
   • Set Supported account types to Accounts in this organizational directory only (single tenant).
   • Leave Redirect URI blank for now.

   Click Register.

3. Generate a certificate and upload its public certificate to the OneDrive app under Manage → Certificates and secrets → Certificates. Use the certificate-generation procedure in Microsoft 365 setup, but upload the certificate to the OneDrive app, not the parent app. Never paste certificate contents into a documentation page or a support ticket.

4. In the OneDrive Set up indexing form, enter the app's Application (client) ID and upload the certificate (.crt) and private key (.key). The tenant ID is inherited from Microsoft 365 and isn't shown in this form.

5. In the app, select Manage → API Permissions → Add a permission → Microsoft Graph → Application permissions. Add Files.ReadWrite.All, which is required for file access and webhook subscriptions. Glean doesn't write to your files. Glean also recommends Sites.FullControl.All to track permission changes, but it isn't required to complete OneDrive indexing setup.

6. Configure native real-time access on this same default app. Add the delegated Microsoft Graph permissions offline_access, User.Read, Files.ReadWrite.All, and Sites.Read.All. Under Authentication → Add a platform → Web, add your Glean backend URL followed by /instance/o365/oauth/verify_code. Use the backend URL shown as Server instance (QE) in About Glean. This isn't the tools OAuth callback.

7. As a Microsoft 365 Global Admin, open Enterprise applications in Azure, select the app used by OneDrive, and go to Security → Permissions. Click Grant admin consent for the permissions you added.

8. Set the crawl scope. By default Glean crawls all personal drives. You can scope indexing to a specific Microsoft Entra ID group. See OneDrive crawl restrictions.

9. Click Continue to save the indexing configuration and open Review setup. This doesn't start the crawl.

The identity permissions User.Read.All, GroupMember.Read.All, Member.Read.Hidden, and Reports.Read.All stay on the Microsoft 365 parent app. Don't re-add them to the OneDrive app. See Required permissions.

Don't register extra apps for crawl speed. If additional apps are already configured, keep them in place and maintain their permissions and credentials. Manage them on Microsoft 365 if the additional-app fields are inherited. Native real-time access uses delegated permissions and the redirect URI on the default app, not every additional app.

Step 4. Review setup and begin indexing

In Review setup, review the configuration and click Begin indexing to start the crawl. Search switches on for your organization once the first crawl completes.

Authenticate users for real-time access

This setup enables native real-time access. Sensitivity-label indexing exclusions don't apply to real-time results. Each user still needs to authenticate their native OneDrive connection in Glean. Tools authorization doesn't replace this connection. Users with working native connections don't need to reconnect. See Authenticate end users.

Manage tools

After configuring tools in Connect, you can see them on the connector's Tools tab and edit permissions through Advanced settings. Each user must authorize tools before using them.

Tool settings you can change afterwards

• Which tools are on. Keep read tools enabled and leave write tools off until you are ready for agents to act in OneDrive. See Enabling or disabling individual tools.
• Where they appear. Across Glean Assistant, Agents, and the Glean MCP server. See Enabling tools for Chat and Agents.
• Who can use them. Scope each tool to specific users or groups. See Tool visibility scoping and role-based access to tools.
• How write tools run. Control whether a tool runs without user confirmation. See Run tools without user confirmation and Allowing in-line execution of write tools.

For the full guide, see Tools overview.

Permissions and security

• Permission propagation. Glean maps document-level permissions from OneDrive one-to-one and enforces search-result visibility from those mappings at query time.
• Certificate authentication. File indexing uses certificate-based application permissions with admin consent. Consumer OneDrive on personal Microsoft accounts is not supported. Glean supports OneDrive for Business only.

After setup

• Refine what is indexed with crawl restrictions and Microsoft Purview sensitivity labels. See OneDrive crawl restrictions.
• Verify real-time access by asking a connected user to paste a link to an accessible, unindexed OneDrive document in Glean.
• Check progress any time from the OneDrive connector page in the Admin console.

See also

• Choose your OneDrive setup shows which setup is yours and how tools, indexed search, and real-time access fit into each.
• OneDrive overview covers connection methods, what gets indexed, permissions, and limitations.
• Set up the indexing connector is the previous connector setup reference.