Set Up the OneDrive (Service Account) ConnectorProfessional

The OneDrive (Service Account) Connector allows you to ingest files from your users' OneDrive accounts into your project using application authentication (Microsoft Entra client credentials) instead of signing in as a user. It is a separate connector from the OneDrive and SharePoint Connector, built for organizations that cannot grant delegated user consent and can only approve application-level permissions.

Because the connector authenticates as an application, there is no signed-in user and therefore no personal drive of its own. You choose whose OneDrive to ingest by selecting those people from your tenant directory in the content selector.

How it differs from the OneDrive and SharePoint Connector:

Configure Your Azure AD App

This one-time setup is performed by an Azure administrator in the Microsoft Entra tenant that owns the OneDrive accounts.

1. Register Your Application in Azure AD

1. Navigate to Azure Portal > Microsoft Entra ID > App registrations.
2. Click New registration.
3. Configure the application details:
   • Name: Enter a descriptive name, such as Airia OneDrive Ingestion.
   • Supported account types: Select Accounts in this organizational directory only.
   • Redirect URI: Leave empty. There is no interactive sign-in for this connector.
4. Click Register.
5. From the app's Overview page, save the Application (client) ID and the Directory (tenant) ID. You will need both later.

2. Configure API Permissions

1. In your registered application's left menu, navigate to API permissions.

2. Click Add a permission.

3. Select Microsoft Graph.

4. Choose Application permissions.

5. Add the following permissions:

   Permission	Needed for	Required
   Files.Read.All or Sites.Read.All	Reading the selected users' drives and downloading files	Yes, one of the two
   User.Read.All	Listing your tenant's users so you can choose whose drives to ingest	Yes
   GroupMember.Read.All	Expanding Microsoft Entra ID group membership	Only for permission enforcement

6. Click Add permissions.

7. Click Grant admin consent for [Your Tenant Name] and confirm. Application permissions do not take effect without admin consent.

⚠️ Warning: User.Read.All is required to configure this connector, not only to enforce permissions. Users are chosen from a directory-backed selector, so without it the selector cannot list anyone and setup cannot be completed — even though ingestion itself would only need Files.Read.All. Confirm your organization will approve tenant-wide directory read before planning around this connector.

⚠️ Warning: Files.Read.All lets the app registration read every user's OneDrive in the tenant, not only the users you select in Airia. Your Airia selection scopes what gets ingested; it is not a boundary enforced by Microsoft. OneDrive has no per-drive equivalent of SharePoint's Sites.Selected, so use a dedicated app registration for this connector rather than reusing a broadly permissioned one.

3. Obtain Your Client Secret

1. In your registered application's left menu, navigate to Certificates & secrets.
2. Click New client secret.
3. Provide a Description (e.g., Airia Client Secret) and set an appropriate Expires duration.
4. Click Add.
5. Copy the Value of the client secret immediately. It will only be shown once and is required for the Airia credential.

⚠️ Warning: When the client secret expires or is rotated in Azure, syncing stops until you update the credential in Airia. Track the secret's expiry date.

Create the Credential in Airia

1. In Airia, go to Settings > Ecosystem > Credentials.
2. Click Add credentials.
3. Select Microsoft Graph Access Token as the Credential Type.
4. Fill in the values you saved from Azure:
   • Azure Tenant ID: The Directory (tenant) ID.
   • Azure Client ID: The Application (client) ID.
   • Azure Client Secret: The client secret value.
5. Select the Project within Airia where you want to use this credential. The credential must be visible to the project where you will create the data source.

💡 Tip: One credential can back several OneDrive, SharePoint, and Outlook service account data sources.

Create a OneDrive (Service Account) Data Source

1. Add a Data Source

1. In the Airia platform, navigate to Available data sources.
2. Select the OneDrive (service account) card.

2. Configure Data Source Details

1. Provide the following details:
   • Name: A mandatory, descriptive name for your data source (e.g., Research Team Drives).
   • Description: (Optional) A brief description up to 1000 symbols.
   • Scope: Select the Airia project for this data source.
   • Microsoft Graph application credential: From the dropdown, select the credential you created above. There is no authentication step — the stored credential is the only authentication input.
   • Filter search results based on end user's access permissions: (Optional) Enable to trim search results to each end user's OneDrive permissions. See Permissions.

💡 Note: You do not type user addresses on this form. The people whose drives to ingest are chosen in the content selector in step 4.

💡 Note: If the credential dropdown empties itself after you change the data source's project scope, the credential you had selected is not available in the new scope. Select a credential that belongs to the new project or is shared tenant-wide.

3. Specify Ingestion Settings

(Optional) Configure the ingestion settings based on your specific use case and data requirements. More info can be found under Ingestion settings.

4. Select Users, Folders, and Start Ingestion

Browse and select the content you want to ingest.

• Click Next. The content selector opens, listing the users in your Microsoft Entra directory. The list is searchable, so you can find people directly in large tenants.
• Expand a user to see their OneDrive and a Shared folder, which holds the items other people have shared with them.
• Select a whole user to sync everything they own, or expand further and select individual folders.
• At least one selection is required — a data source with nothing selected cannot be saved.

💡 Tip: Selecting a user or folder will sync all supported content within it, including subfolders. Reprocessing the data source will automatically sync newly added content, update modified content, and delete removed items within the selected content. This also applies to configuration changes: if you remove a user or deselect a folder, their previously ingested files are removed on the next sync.

What Gets Ingested

• Files: Every supported file in a selected user's drive or folder is ingested, including files in subfolders. Standard per-file-type ingestion size limits apply.
• Shared items: Files under a user's Shared folder are ingested as part of that user's content.
• Metadata: File name, path, size, last modified date, and the identities that created and last modified the file.

Ingested files are grouped by the user they came from, so each person's content stays under their own address in the data source:

[email protected]/Documents/policy.docx
[email protected]/Documents/policy.docx
[email protected]/Shared/Team Plans/roadmap.xlsx

💡 Note: Because OneDrive gives everyone the same default folder names — Documents, Desktop, Pictures — this grouping is what keeps two users' identically named folders separate in the data source.

💡 Note: An item that someone shared into a user's OneDrive lives in the sharer's drive. It is filed under the user you selected, inside their Shared folder, rather than under the person who owns it.

Permissions

This connector supports per-user permission enforcement: Airia filters search results based on each end user's access permissions in OneDrive.

Prerequisites

• Single Sign-On (SSO) must be enabled for your Airia project.
• The app registration must have User.Read.All and GroupMember.Read.All granted and admin-consented.
• Filter search results based on end user's access permissions must be enabled on the data source.

Permission update timing

OneDrive (Service Account) checks each user's access with Microsoft when content is requested, so sharing and group membership changes apply without waiting for a sync. Each result is cached for a short time, so with the default cache a change in the source system can take up to about an hour to apply. For full details, see Permissions Enforcement.

With permission enforcement disabled

If you leave the option off, access is granted at the data store level: every user with access to the data store can retrieve content from all ingested drives, including other people's personal files. Decide this deliberately before ingesting several users' OneDrive accounts into a single data store.

Citation links point at the file's own OneDrive URL rather than a generated sharing link, so a user opening a citation must already have access to that file in OneDrive.

Troubleshooting

Next Steps

After your data has been successfully ingested, the OneDrive (service account) data source is ready to be used with an Agent.