Files & storage
Set up OneDrive / SharePoint / Teams
This source runs on your company's OWN Entra app credentials — three values your IT admin creates once (about ten minutes), with no vendor approval involved and no personal sign-in to break. By default it syncs the whole organisation; narrowing to one library is a click. Microsoft Teams is covered too: files shared in a Teams channel live in that team's SharePoint library.
Create the app credentials (IT, once)
- Entra admin center (entra.microsoft.com) → App registrations → New registration — any name, single tenant.
- Under API permissions add the Microsoft Graph APPLICATION permissions (not Delegated) Files.Read.All, Sites.Read.All and User.Read.All, then press Grant admin consent.
- Certificates & secrets → New client secret; copy its VALUE right away (it's shown once), plus the Application (client) ID and Directory (tenant) ID from the Overview page.
Set up the source
- Documents → OneDrive / SharePoint / Teams: name it, paste the three values, choose access groups, Create.
- Press Test — in whole-organisation mode it reports how many libraries were discovered across users and sites, a quick sanity check before the first big sync.
- Whole organisation is the default (Drive ID stays blank). For ONE library instead, press Choose library on the source and pick it — for Teams files, pick the team's library.
- Sync — documents come in, and keep coming in on a schedule from then on.
Whole-organisation mode
Whole-organisation mode gives the assistant everything the company has — every user's OneDrive and every SharePoint/Teams library, discovered and swept automatically, with new users and new sites picked up on their own. You are in this mode exactly when the credentials are set and Drive ID is BLANK; picking a library leaves it, clearing Drive ID returns to it.
| One library instead | Choose library lists every library the credentials reach and fills Drive ID for you (pasting a Graph drive ID works too). Only that library then syncs, and Folder path (Advanced) can narrow it to a sub-folder like /Policies. |
|---|---|
| Scoping the whole organisation | Folder path is ignored in whole-organisation mode (there is no single library to scope); use the Advanced Exclude patterns to leave out folders or file types across the whole sweep. |
Set Access to “Mirror each file's own sharing” to keep documents readable here by exactly the people they're shared with in Microsoft 365 — matched by email, re-checked on every sync (see Access). The client secret expires (IT chooses 6–24 months when creating it): when it does, the source shows a credentials error — paste a fresh secret to heal it.
Last updated 29 Aug 2026