# Microsoft OneDrive

<!-- BEGIN GENERATED:intro -->

The Microsoft OneDrive connector is a [Palantir-provided driver](../../data-integration/foundry-provided-drivers/index.md) for Microsoft OneDrive.

To create a new Microsoft OneDrive source, follow the [standard setup flow for Palantir-provided drivers](../../data-integration/foundry-provided-drivers/index.md#setup), then use the sections below for Microsoft OneDrive-specific configuration and networking. For the complete property reference, see the [official Microsoft OneDrive driver documentation ↗](https://cdn.cdata.com/help/UOK/jdbc/pg_connectionj.htm).

<!-- END GENERATED:intro -->

<!-- BEGIN GENERATED:capabilities -->

:::callout{theme="neutral" title="Beta"}
The Microsoft OneDrive connector is in the [beta](../../platform-overview/development-life-cycle/index.md) phase of development and may not be available on your enrollment. Functionality may change during active development.
:::

## Supported capabilities

| Capability | Status |
|---|---|
| Exploration | 🟡 Beta |
| Batch syncs | 🟡 Beta |
| Incremental | 🟡 Beta |
| [OAuth 2.0 authentication](#oauth-20-authentication) | 🟡 Beta |

<!-- END GENERATED:capabilities -->

<!-- BEGIN GENERATED:configuration -->

## Configuration

The properties below are mandatory or recommended.

| Property | Required? | Description | Default |
|---|---|---|---|
| [`AuthScheme` ↗](https://cdn.cdata.com/help/UOK/jdbc/RSBOneDrive_p_AuthScheme.htm) | Recommended | Specifies the type of authentication to use when connecting to Microsoft OneDrive. If this property is left blank, the default authentication is used. | `AzureServicePrincipal` |
| [`AzureTenant` ↗](https://cdn.cdata.com/help/UOK/jdbc/RSBOneDrive_p_AzureTenant.htm) | Recommended | Identifies the Microsoft OneDrive tenant being used to access data, either by name (for example, contoso.onmicrosoft.com) or ID. (Conditional). | — |
| [`InitiateOAuth` ↗](https://cdn.cdata.com/help/UOK/jdbc/RSBOneDrive_p_InitiateOAuth.htm) | Recommended | Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working. | `GETANDREFRESH` |
| [`OAuthClientId` ↗](https://cdn.cdata.com/help/UOK/jdbc/RSBOneDrive_p_OAuthClientId.htm) | Recommended | Specifies the client Id that was assigned when the custom OAuth application was created. (Also known as the consumer key.) This ID registers the custom application with the OAuth authorization server. | — |
| [`OAuthClientSecret` ↗](https://cdn.cdata.com/help/UOK/jdbc/RSBOneDrive_p_OAuthClientSecret.htm) | Recommended | Specifies the client secret that was assigned when the custom OAuth application was created. (Also known as the consumer secret). This secret registers the custom application with the OAuth authorization server. | — |

<!-- END GENERATED:configuration -->

<!-- BEGIN GENERATED:networking -->

## Networking

The table below lists the domains that the source must be able to access to run.

For each domain, add a corresponding [egress policy](../../administration/configure-egress/index.md). If the source is hosted on-premises and not directly reachable from Foundry, use an [agent proxy egress policy](../../administration/configure-egress/index.md#agent-proxy-egress-policies) instead. The agent host itself must also be able to reach the listed domains. See [using an agent as a proxy](../../data-connection/agent-proxy/index.md) for details.

| Domain  | Required |
|--- |--- |
| graph.microsoft.com | If `AzureEnvironment=GLOBAL` (default) |
| login.microsoftonline.com | If `AuthScheme=AzureAD` (default), AzureServicePrincipal, AzureServicePrincipalCert AND `AzureEnvironment=GLOBAL` |
| microsoftgraph.chinacloudapi.cn | If `AzureEnvironment=CHINA` |
| login.chinacloudapi.cn | If `AuthScheme=AzureAD` (default), AzureServicePrincipal, AzureServicePrincipalCert AND `AzureEnvironment=CHINA` |
| graph.microsoft.us | If `AzureEnvironment=USGOVT` |
| login.microsoftonline.us | If `AuthScheme=AzureAD` (default), AzureServicePrincipal, AzureServicePrincipalCert AND `AzureEnvironment=USGOVT` or USGOVTDOD |
| dod-graph.microsoft.us | If `AzureEnvironment=USGOVTDOD` |

<!-- END GENERATED:networking -->

<!-- BEGIN GENERATED:oauth -->

## OAuth 2.0 authentication

This connector supports OAuth 2.0 authentication. Follow the [OAuth 2.0 guidance for Palantir-provided drivers](../../data-integration/foundry-provided-drivers/index.md#oauth-20-authentication) to configure and authorize the connection.

<!-- END GENERATED:oauth -->

## Extracting files

Files can be extracted from Microsoft OneDrive by executing the [DownloadFile ↗](https://cdn.cdata.com/help/UOK/jdbc/pg_sp-downloadfile.htm) stored procedure.

To extract a file, add the following SQL query in the sync definition.

```sql
EXECUTE DownloadFile ResourceId = '1234'
```

This will produce an output dataset with the file content stored in a Base64 encoded string column, which should be decoded to binary in a downstream data transformation.

![Microsoft OneDrive sync extracting a file using a stored procedure.](../../../assets/aa7f71bedaa42db0873aefc853464c0d8e810b7f61b159fbed0dbdbd9275b37d.webp)