Skip to main content
Review the validated minimum standard delegated scopes for every Microsoft OneDrive action. The mapping covers personal OneDrive files and site or group drives.
Personal OneDrive and site-backed drives have different permission requirements.Files.Read and Files.ReadWrite cover personal /me/drive operations, while site or group drives require the applicable .All scope or permissions for selected sites.

​
Minimal scopes per action

Each Microsoft OneDrive connection also requests openid, offline_access, and User.Read. These connection scopes apply in addition to the action scopes in the table.
ActionDescriptionMinimum scopes
Check file accessChecks whether a file can be accessed.Files.Read.All
Create folderCreates folder.Files.ReadWrite.All
Download fileDownloads file.Files.Read.All
Download OneDrive fileDownloads a OneDrive file.Files.Read.All
Get file metadataGets file metadata.Files.Read.All
Get folder by nameGets a folder by name.Files.Read.All
List available drivesLists available drives.Files.Read.All
Sites.Read.All
Group.Read.All
List files in folderLists files in folder.Files.Read.All
List files in OneDrive folderLists files in a OneDrive folder from a folder URL.Files.Read.All
List folder changesLists folder changes.Files.Read.All
Resolve driveResolves drive.Files.Read.All
Resolve fileResolves file.Files.Read
Resolve folderResolves folder.Files.Read.All
Search filesSearches files.Files.Read.All
Search OneDriveSearches OneDrive.Files.Read.All
Upload fileUploads file.Files.ReadWrite
Some rows use a thinner scope because the action only reaches personal OneDrive:
  • Resolve file uses Files.Read for personal /me/drive, including an explicit personal drive ID.
  • Upload file writes only to personal /me/drive, so Files.ReadWrite is enough.
  • Create folder needs Files.ReadWrite.All to write to an arbitrary site drive.
  • List available drives also needs Group.Read.All for /me/memberOf and Sites.Read.All for followed-site discovery.
  • Shared-link resolution through /shares works with Files.Read.All. Site and group drive reads need Files.Read.All.

​
Actions affected by Sites.Selected

The following actions may not work completely with selected site permissions:
The List available drives action discovers personal, group, and followed-site drives. These discovery results are empty with selected-only permissions, and the action reports notices for group and SharePoint discovery.
The Resolve drive action can resolve a known drive ID, but its name search enumerates /me/drives. That enumeration is empty with selected-only permissions.
The Resolve folder action starts with personal /me/drives and fans out across those drives. It does not resolve site folder IDs with selected-only permissions.
The Resolve file action accesses personal OneDrive only. Sites.Selected does not apply, and personal /me/drives is empty with selected-only permissions.
The Upload file action writes to personal OneDrive only. Sites.Selected does not apply, and personal /me/drives is empty with selected-only permissions.

​
Native features

Additionally, the following native features may be affected by a Selected grant:
  • Folder Sync: Synchronizes local and cloud folders across your workspace.
  • Company Knowledge: Indexes connected drives and documents for AI search and chat context.
When using selected-only permissions, the drive picker cannot list granted site drives because the underlying drive discovery relies on broad listing actions. While Langdock can still read known files from a granted site if you provide explicit drive and item IDs, dynamic browsing and automatic drive selection in the UI will not work.