Skip to main content

​
Overview

The Microsoft OneDrive integration gives agents a Drive- and Box-style toolkit for the connected OneDrive for Business account. It uses delegated Microsoft Graph access and supports two authentication modes:
  • Each member connects (recommended): every Aster member authorizes their own Microsoft 365 account. Agents inherit that member’s OneDrive permissions.
  • Shared Microsoft account: one admin-authorized Microsoft account supplies OneDrive access for every member using the integration.
OneDrive is configured independently from Microsoft SharePoint and Outlook. Connecting, reconnecting, or disabling one Microsoft service does not change either of the others.

​
Setup Guide

1

Choose an authentication mode

An Aster admin opens Control Hub > Integrations, selects Microsoft OneDrive, and chooses Each member connects or Shared Microsoft account.
2

Authorize Microsoft 365 access

Sign in with a Microsoft 365 work or school account and approve delegated file access. A tenant may still require an Entra administrator to approve the application under its consent policies.
3

Add OneDrive tools to an agent

Edit an agent and select only the OneDrive tools it needs. Read, download, upload, and organization actions are granted independently per agent.
4

Connect each member when using per-user mode

The admin’s authorization enables OneDrive for the organization and connects that admin. Other members receive an in-chat connection prompt when a OneDrive-enabled agent first needs their account.

​
Available Tools

  • onedrive_search — Search file and folder names in the connected OneDrive.
  • onedrive_list_folder — Browse the OneDrive root or a folder by item ID or path.
  • onedrive_read_file — Read text, CSV, JSON, XML, source, and other text-based files inline.
  • onedrive_get_file_info — Inspect metadata, timestamps, hashes, parent, sharing scope, and web link.
  • onedrive_download_file — Download a file up to 50 MB as an Aster attachment for read_file or execute_python.
  • onedrive_upload_file — Upload inline text or an existing Aster attachment/generated file.
  • onedrive_create_folder — Create a folder at the root or inside an existing folder.
  • onedrive_move_item — Move or rename a file or folder.
  • onedrive_copy_item — Copy a file or folder. Microsoft may complete large copies asynchronously.
For PDF, Word, PowerPoint, Excel, image, and other binary content, use onedrive_download_file first, then read_file or execute_python. onedrive_read_file is intentionally limited to formats Microsoft Graph can return directly as text.

​
Choosing a Mode

Use Each member connects when permissions differ by person, activity should be attributable to the acting member, or the organization does not maintain a dedicated shared account. Use Shared Microsoft account when the organization intentionally maintains a narrowly permissioned Microsoft 365 account whose OneDrive should act as a common team file store. Changing modes is fail-safe: the current connection remains active unless the replacement OAuth flow completes successfully.

​
Security

  • Delegated access: Aster requests Files.ReadWrite, the least-privileged delegated permission that supports the integration’s write operations on the connected account’s files.
  • Credential isolation: per-user tokens are stored separately for each Aster member and are never copied into the organization connection.
  • Independent Microsoft services: OneDrive credentials are stored separately from SharePoint and Outlook credentials.
  • Per-agent tools: connecting OneDrive does not automatically give an agent upload, move, or copy capabilities.
  • Server-side tokens: access and refresh tokens are never returned to the browser or agent.
  • Bounded downloads: agent attachment downloads are limited to 50 MB.
  • Untrusted content: agents should treat file names and contents as data, never as instructions.

​
Troubleshooting

The organization uses per-user mode, but your Aster member has not authorized OneDrive or the saved refresh token needs to be reconnected. Use the in-chat prompt or open Control Hub > Integrations > Microsoft OneDrive.
Ask a Microsoft Entra administrator to approve the Aster application’s delegated Files.ReadWrite permission for the tenant, then retry.
In per-user mode, this is expected. OneDrive tools run with the acting member’s Microsoft permissions. Share the content with that member in Microsoft 365, or intentionally use a restricted shared account.
Use onedrive_download_file, then read_file for document understanding or execute_python for programmatic processing.