OneDrive Connector
Documentation
Version: 9
Documentation
Authentication

Application Credentials


Description

Application-only access is broader and more powerful than delegated access (User Credentials), so you should only use app-only access where needed. Use it when: 1. The application needs to run in an automated way, without user input (for example, a daily script that checks emails from certain contacts and sends automated responses). 2. The application needs to access resources belonging to multiple different users (for example, a backup or data loss prevention app might need to retrieve messages from many different chat channels, each with different participants). 3. You find yourself tempted to store credentials locally and allow the app to sign in 'as' the user or admin. [API reference]

Instructions

Follow these simple steps below to create Microsoft Entra ID application with application access permissions. Using following steps, you can grant very granular app permissions to access File(s). Choose permission based on your need.

Create OAuth app

  1. Navigate to the Azure Portal and log in using your credentials.
  2. Access Microsoft Entra ID.
  3. Register a new application by going to App registrations and clicking on New registration button: Start new app registration in Microsoft Entra ID
    INFO: Find more information on how to register an application in Graph API reference.
  4. When configuration window opens, configure these fields:
    • Supported account type
      • e.g. select Accounts in this organizational directory only if you need access to data in your organization only.
    • Redirect URI:
      • Set the type to Public client/native (mobile & desktop).
      • Leave the URL field empty.
    Register app in Microsoft Entra ID
  5. After registering the app, copy the Application (client) ID for later: Copy client ID of Microsoft Entra ID app
  6. Then copy OAuth authorization endpoint (v2) & OAuth token endpoint (v2) URLs: Copy Auth and Token URLs in Microsoft Entra ID app
  7. Continue and create Client secret: Add Client secret for Microsoft Entra ID app
  8. Then copy the Client secret for later steps: Copy Client secret
  9. Continue by adding permissions for the app by going to the API permissions section, and clicking on Add a permission: Start adding permissions to Microsoft Entra ID app
  10. Select Microsoft Graph: Select Graph API permissions for Microsoft Entra ID app
  11. Then choose Application permissions option: Select app permissions for Microsoft Entra ID app
  12. Continue by adding these Files (OneDrive) permissions (Just search for "Files" and then select desired permissions): Select OneDrive scopes
  13. Finish by clicking Add permissions button: Add permissions to Microsoft Entra ID app
  14. Now it's time to Grant admin consent for your application: Grant admin consent for Microsoft Entra ID app
  15. Confirm all the permissions are granted: Admin consent granted successfully in Entra ID
  16. Now go to SSIS package or ODBC data source and use the copied values in Application Credentials authentication configuration:
    • In the Token URL field paste the OAuth token endpoint (v2) URL value you copied in the previous step.
    • In the Client ID field paste the Application (client) ID value you copied in the previous step.
    • In the Client Secret field paste the Client secret value you copied in the previous step.
    • Optional step. Choose Default Drive Id from the drop down menu.
  17. Click Test Connection to confirm the connection is working.

Parameters

Parameter Required Default value Options
Name: TokenUrl

Label: Token URL

YES
Name Value
For Single Tenant https://login.microsoftonline.com/{ENTER-TENANT-ID-HERE}/oauth2/v2.0/token
For Multi Tenant https://login.microsoftonline.com/common/oauth2/v2.0/token
Name: ClientId

Label: Client ID

YES
Name: ClientSecret

Label: Client Secret

YES
Name: GroupOrUserId

Label: Default Group or User Id (additional Scopes needed to list - If fails enter manually)

To list all users and groups from your organizations you need additional scopes. See connection UI - Choose User.Read.All and Group.Read.All Scopes and regenerate token. You can manually type value too if you know Group or User Id. Format is /users/{id} OR /groups/{id}
YES
Name Value
My self (Not Valid for Application Credentials)
For any group /groups/ENTER-GROUP-EMAIL-OR-ID
For any user /users/ENTER-USER-EMAIL-OR-ID
Name: DriveId

Label: Default Drive Id

YES
Name: Scope

Label: Scope

Permissions you want to use.
https://graph.microsoft.com/.default
Name: RetryMode

Label: RetryMode

RetryWhenStatusCodeMatch
Name Value
None None
RetryAny RetryAny
RetryWhenStatusCodeMatch RetryWhenStatusCodeMatch
Name: RetryStatusCodeList

Label: RetryStatusCodeList

429 is API limit reached, 423 is File locked
429|503|423
Name: RetryCountMax

Label: RetryCountMax

5
Name: RetryMultiplyWaitTime

Label: RetryMultiplyWaitTime

True
Name: SearchOptionForNonIndexedFields

Label: Search Option For Non-Indexed Fields (Default=Blank - Search Only Indexed)

If you wish to do certain operations e.g. search / order by on non-indexed fields then you have to set this option to HonorNonIndexedQueriesWarningMayFailRandomly. By default filter / orderby on non-indexed fields not allowed.
Name Value
Search Only Indexed
Search Both Indexed and Non-Indexed HonorNonIndexedQueriesWarningMayFailRandomly
Name: ExtraHeaders

Label: Extra Headers (e.g. Header1:AAA||Header2:BBB)

Name Value
MyHeader1:AAA MyHeader1:AAA
MyHeader1:AAA||MyHeader2:BBB MyHeader1:AAA||MyHeader2:BBB
Name: IsAppCred

Label: IsAppCred

For internal use only
1