> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asteragents.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft OneDrive

> Give agents delegated access to search, read, download, upload, and organize OneDrive for Business files

## Overview

The Microsoft OneDrive integration gives agents a Drive- and Box-style toolkit for the connected OneDrive for Business account. It uses delegated Microsoft Graph access and supports two authentication modes:

* **Each member connects (recommended):** every Aster member authorizes their own Microsoft 365 account. Agents inherit that member's OneDrive permissions.
* **Shared Microsoft account:** one admin-authorized Microsoft account supplies OneDrive access for every member using the integration.

OneDrive is configured independently from Microsoft SharePoint and Outlook. Connecting, reconnecting, or disabling one Microsoft service does not change either of the others.

## Setup Guide

<Steps>
  <Step title="Choose an authentication mode">
    An Aster admin opens **Control Hub > Integrations**, selects **Microsoft OneDrive**, and chooses **Each member connects** or **Shared Microsoft account**.
  </Step>

  <Step title="Authorize Microsoft 365 access">
    Sign in with a Microsoft 365 work or school account and approve delegated file access. A tenant may still require an Entra administrator to approve the application under its consent policies.
  </Step>

  <Step title="Add OneDrive tools to an agent">
    Edit an agent and select only the OneDrive tools it needs. Read, download, upload, and organization actions are granted independently per agent.
  </Step>

  <Step title="Connect each member when using per-user mode">
    The admin's authorization enables OneDrive for the organization and connects that admin. Other members receive an in-chat connection prompt when a OneDrive-enabled agent first needs their account.
  </Step>
</Steps>

## Available Tools

* `onedrive_search` — Search file and folder names in the connected OneDrive.
* `onedrive_list_folder` — Browse the OneDrive root or a folder by item ID or path.
* `onedrive_read_file` — Read text, CSV, JSON, XML, source, and other text-based files inline.
* `onedrive_get_file_info` — Inspect metadata, timestamps, hashes, parent, sharing scope, and web link.
* `onedrive_download_file` — Download a file up to 50 MB as an Aster attachment for `read_file` or `execute_python`.
* `onedrive_upload_file` — Upload inline text or an existing Aster attachment/generated file.
* `onedrive_create_folder` — Create a folder at the root or inside an existing folder.
* `onedrive_move_item` — Move or rename a file or folder.
* `onedrive_copy_item` — Copy a file or folder. Microsoft may complete large copies asynchronously.

For PDF, Word, PowerPoint, Excel, image, and other binary content, use `onedrive_download_file` first, then `read_file` or `execute_python`. `onedrive_read_file` is intentionally limited to formats Microsoft Graph can return directly as text.

## Choosing a Mode

Use **Each member connects** when permissions differ by person, activity should be attributable to the acting member, or the organization does not maintain a dedicated shared account.

Use **Shared Microsoft account** when the organization intentionally maintains a narrowly permissioned Microsoft 365 account whose OneDrive should act as a common team file store.

Changing modes is fail-safe: the current connection remains active unless the replacement OAuth flow completes successfully.

## Security

* **Delegated access:** Aster requests `Files.ReadWrite`, the least-privileged delegated permission that supports the integration's write operations on the connected account's files.
* **Credential isolation:** per-user tokens are stored separately for each Aster member and are never copied into the organization connection.
* **Independent Microsoft services:** OneDrive credentials are stored separately from SharePoint and Outlook credentials.
* **Per-agent tools:** connecting OneDrive does not automatically give an agent upload, move, or copy capabilities.
* **Server-side tokens:** access and refresh tokens are never returned to the browser or agent.
* **Bounded downloads:** agent attachment downloads are limited to 50 MB.
* **Untrusted content:** agents should treat file names and contents as data, never as instructions.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The agent asks me to connect OneDrive">
    The organization uses per-user mode, but your Aster member has not authorized OneDrive or the saved refresh token needs to be reconnected. Use the in-chat prompt or open **Control Hub > Integrations > Microsoft OneDrive**.
  </Accordion>

  <Accordion title="Microsoft says admin approval is required">
    Ask a Microsoft Entra administrator to approve the Aster application's delegated `Files.ReadWrite` permission for the tenant, then retry.
  </Accordion>

  <Accordion title="A member cannot see another member's files">
    In per-user mode, this is expected. OneDrive tools run with the acting member's Microsoft permissions. Share the content with that member in Microsoft 365, or intentionally use a restricted shared account.
  </Accordion>

  <Accordion title="An Office or PDF file is not returned as text">
    Use `onedrive_download_file`, then `read_file` for document understanding or `execute_python` for programmatic processing.
  </Accordion>
</AccordionGroup>