Skip to main content
Review the validated minimum standard delegated scopes for every Microsoft OneDrive action. The mapping covers personal OneDrive files and site or group drives.
When a Sensitivity Label Policy is applied, OneDrive withholds files whose labels the workspace has blocked.
Personal OneDrive and site-backed drives have different permission requirements.Files.Read and Files.ReadWrite cover personal /me/drive operations, while site or group drives require the applicable .All scope or permissions for selected sites.

​
Minimal scopes per action

Each Microsoft OneDrive connection also requests openid, offline_access, and User.Read. These connection scopes apply in addition to the action scopes in the table.
ActionDescriptionMinimum scopes
Check file accessChecks whether a file can be accessed.Files.Read.All
Create folderCreates folder.Files.ReadWrite.All
Download fileDownloads file.Files.Read.All
Download OneDrive fileDownloads a OneDrive file.Files.Read.All
Get file metadataGets file metadata.Files.Read.All
Get folder by nameGets a folder by name.Files.Read.All
List available drivesLists available drives.Files.Read.All
Sites.Read.All
Group.Read.All
List files in folderLists files in folder.Files.Read.All
List files in OneDrive folderLists files in a OneDrive folder from a folder URL.Files.Read.All
List folder changesLists folder changes.Files.Read.All
Resolve driveResolves drive.Files.Read.All
Resolve fileResolves file.Files.Read
Resolve folderResolves folder.Files.Read.All
Search filesSearches files.Files.Read.All
Search OneDriveSearches OneDrive.Files.Read.All
Upload fileUploads file.Files.ReadWrite
Some rows use a thinner scope because the action only reaches personal OneDrive:
  • Resolve file uses Files.Read for personal /me/drive, including an explicit personal drive ID.
  • Upload file writes only to personal /me/drive, so Files.ReadWrite is enough.
  • Create folder needs Files.ReadWrite.All to write to an arbitrary site drive.
  • List available drives also needs Group.Read.All for /me/memberOf and Sites.Read.All for followed-site discovery.
  • Shared-link resolution through /shares works with Files.Read.All. Site and group drive reads need Files.Read.All.

​
Actions affected by Sites.Selected

The following actions may not work completely with selected site permissions:
The List available drives action discovers personal, group, and followed-site drives. These discovery results are empty with selected-only permissions, and the action reports notices for group and SharePoint discovery.
The Resolve drive action can resolve a known drive ID, but its name search enumerates /me/drives. That enumeration is empty with selected-only permissions.
The Resolve folder action starts with personal /me/drives and fans out across those drives. It does not resolve site folder IDs with selected-only permissions.
The Resolve file action accesses personal OneDrive only. Sites.Selected does not apply, and personal /me/drives is empty with selected-only permissions.
The Upload file action writes to personal OneDrive only. Sites.Selected does not apply, and personal /me/drives is empty with selected-only permissions.

​
Native features

Additionally, the following native features may be affected by a Selected grant:
  • Folder Sync: Synchronizes local and cloud folders across your workspace.
  • Company Knowledge: Indexes connected drives and documents for AI search and chat context.
When using selected-only permissions, the drive picker cannot list granted site drives because the underlying drive discovery relies on broad listing actions. While Langdock can still read known files from a granted site if you provide explicit drive and item IDs, dynamic browsing and automatic drive selection in the UI will not work.