Real-time access for OneDrive

Data fetching supplements indexed OneDrive results with real-time content from Microsoft 365. Users can find recently created or updated content without waiting for the next crawl. It doesn't change the crawl schedule.

Sensitivity-label exclusions

Sensitivity-label indexing exclusions don't apply to Data fetching. Content excluded from indexing by a label can still appear in real-time results if the user has access to it in Microsoft 365. If your organization relies on these exclusions, review this limitation with your security team before enabling real-time access. See Restrict O365 content via sensitivity labels.

How real-time access works

Real-time access retrieves content live from OneDrive when a query targets this source. This applies to the following Glean surfaces:

Search

Any query that specifies app:onedrive, or search results explicitly filtered for OneDrive, can include real-time results alongside indexed results.

Assistant and agents

When Assistant or an agent is highly confident that a query is about OneDrive — for example, when the user mentions OneDrive or includes a link — it adds real-time search results from that source to the chat context.

Explicitly specifying app:onedrive in a query or agent run also triggers real-time results. Assistant and agents can also scope real-time results to a specific OneDrive folder.

Supported content

Real-time access supports the following content types:

Source	Supported content
OneDrive	Documents

Glean also supports native file access for Microsoft Excel (.xlsx) files stored in OneDrive. When native file access is available, Assistant and agents can read the original spreadsheet rather than extracted text, preserving formatting, formulas, and structure.

Enable real-time access

Which setup do you have?

If your OneDrive Setup tab has a data-fetching option, enable it using the previous setup steps here. The new setup enables real-time access as part of the guided flow, so there is no checkbox to select. Both paths need the delegated permissions, native OAuth redirect URI, and end-user connection described here. If you completed that configuration during setup, continue at Authenticate end users.

Enabling real-time access requires both administrator setup and end-user authentication:

• Configuring your Admin console and Azure portal
• Having end users authenticate

Configure the Admin console and Azure portal

For previous setup, a Glean admin must enable data fetching for OneDrive. In either setup, use a Microsoft Global Admin account to configure the delegated permissions and native redirect URI in Azure.

Enable data fetching in the Admin console

For previous setup, enable data fetching for OneDrive:

1. Navigate to Admin console → Connectors.
2. Select OneDrive.
3. Go to the Setup tab.
4. Select the checkbox to enable data fetching.

Configure delegated permissions in Azure

A Microsoft Global Admin must add delegated permissions to the default app used by the OneDrive connector. Use the app whose client ID is configured on OneDrive. If Glean marks that client ID as inherited from Microsoft 365, use the existing shared app instead. These permissions aren't required on every additional crawler app.

1. Sign in to the Azure portal.

2. Go to Microsoft Entra ID → App registrations and select the app used by OneDrive.

3. Select Manage → API Permissions.

4. Select Add a permission, then select Microsoft Graph.

5. Choose Delegated permissions and add the following:

   • offline_access
   • User.Read
   • Files.ReadWrite.All
   • Sites.Read.All

6. Grant admin consent for the delegated permissions.

tip

Grant Files.ReadWrite.All so Glean can access files from shared URLs. See Microsoft's Accessing shared driveItems documentation for details.

info

These delegated permissions are separate from the application permissions used for crawling. They enable per-user, on-demand access to content that may not yet be indexed.

Configure the OAuth redirect URL

Configure the native user-connection callback on the same default app used by OneDrive. This is separate from the Central or Custom OAuth configuration for tools.

1. In the Azure portal, open the app's Authentication → Platform configurations.
2. Select Add a platform → Web.
3. Copy your Glean backend URL from Server instance (QE) in About Glean. Append /instance/o365/oauth/verify_code to that backend URL and enter the complete value as the redirect URI. Don't use a tools OAuth callback or an OAuth authorization endpoint.
4. Select Configure to save.

note

These instructions apply to the standard Azure Portal App Authentication experience, not the preview experience.

Authenticate end users

After the admin configuration is complete, each user needs a OneDrive connection to use real-time access. Users with working connections don't need to sign in again because the setup instructions changed. Users who aren't connected can authenticate in either of these ways:

• Proactively: Users navigate to Your Settings → Connectors and select OneDrive to authenticate.
• On demand: Glean prompts users to authenticate when a query includes a link to a document that Glean has not indexed yet.

Consider communicating to your organization that real-time access is available and encouraging users to authenticate.

Frequently asked questions

Yes. Because real-time access retrieves content live from OneDrive, results may be slower than indexed results in some cases.

Yes. Real-time access generates Microsoft API calls when users trigger queries that include live results. Because these calls are on demand rather than part of a full crawl, the impact is generally lower than indexing.

Not directly from the search results page. To summarize real-time fetched content, open or paste the OneDrive link in Glean, where Glean fetches the content live.

No. For OneDrive, these restrictions are not applied during indexing or real-time access.

No. Real-time access is enabled at the organization level and cannot target a specific group of users.

Assistant and agents can narrow real-time OneDrive results to a specific folder.