OneDrive

OneDrive (opens new window) is a cloud storage and file hosting service by Microsoft, fully integrated with Microsoft Office. Workato's OneDrive connector enables you to seamlessly integrate and automate workflows between OneDrive and third-party applications, supporting a wide range of file processing use cases.

FEATURE AVAILABILITY

The OneDrive connector isn't available to workspaces in the CN data center. This reflects local regulatory requirements and applies to our multi-tenant and Virtual Private Workato (VPW) offerings.

API version

The OneDrive connector uses the Microsoft Graph API v1.0 for OneDrive (opens new window).

How to connect to OneDrive

Workato supports the following types of connections to OneDrive:

• Authorization code grant authentication (OAuth 2.0)
• Client credentials-based authentication (OAuth 2.0)

MICROSOFT MFA ENFORCEMENT

Microsoft is rolling out mandatory multifactor authentication (MFA) gradually to different applications and accounts in phases. This enforcement continues throughout 2025 and beyond. Refer to the Microsoft Mandatory multifactor authentication for Azure and admin portals (opens new window) documentation for more information.

We strongly recommend enabling MFA now for all Microsoft accounts used with Workato to avoid service disruptions from short-notice enforcement changes.

Complete the following steps to maintain uninterrupted service:

1

Enable MFA for your Microsoft organization following the Microsoft MFA setup guide. Refer to Set up multifactor authentication for Microsoft 365 (opens new window) for more information.

2

Reconnect your Microsoft connection in Workato.

3

Complete the OAuth flow with MFA when prompted.

4

Test your recipes to ensure they work with the updated connection.

Authorization code grant authentication (OAuth 2.0)

Authorization code grant authentication consists of the following steps:

• Register the Workato App in Azure portal
• Complete setup in Workato

This authentication method requires the following value for tenant-specific account types:

• Tenant ID/Domain

Register the Workato App in Azure portal

Complete the following steps to register the Workato app and assign it permissions for authorization code grant connections:

1

Register the Workato app in the Azure Portal

Complete the following steps to register the Workato app in the Azure portal:

1

Sign in to the Azure portal (opens new window).

2

Select App registrations > + New registration.

3

Enter a unique name for the application.

4

Use the Supported account types drop-down menu to select an account type.

5

Select Web from the Select a platform drop-down menu.

6

Use the following URI for the Redirect URI:

https://www.workato.com/oauth/callback

7

Select Register.

2

Assign permissions to your app

1

Select Manage > API permissions in the navigation sidebar.

2

Click + Add a permission and select Microsoft Graph APIs.

3

Add the required permissions as outlined in the Permissions required to connect section. Depending on your connection type, you must assign Application or Delegated permissions.

Add permissions

4

Click Add permissions. If specific permissions require admin consent, refer to the Granting admin consent (opens new window) section for guidance.

3

Obtain the Directory (tenant ID) from the Azure portal

Complete the following steps to obtain the Directory (tenant) ID from the Azure portal:

1

Go to the Overview > Essentials section.

App details

2

Copy and save the Directory (tenant) ID for use in Workato.

Complete setup in Workato

1

Click Create > Connection.

2

Search for and select OneDrive as your connection on the New connection page.

3

Provide a name for your connection in the Connection name field.

4

Use the Location drop-down menu to select the project where you plan to store the connection.

5

Use the Connection account type drop-down menu to select the type of account you plan to use. The available choices are Personal, Business, and Tenant-specific.

• Personal: This option allows you to sign in using a personal account that isn't restricted to a specific organization (tenant).

Personal connections

• Business: This option allows you to sign in using a user account that belongs to a company or organization.

Business connections

• Tenant specific: This option is specifically designed for users who belong to a particular organization (tenant).

Tenant specific connections

Enter the Tenant ID/Domain. Use either the Directory (tenant) ID or the tenant domain for your Azure AD tenant. This ensures that you are accessing resources that are specifically configured for that tenant. Learn how to obtain this value.

6

Select Authorization code grant as the Authentication type.

7

Optional. Configure permissions in Advanced settings. The connector requests all required scopes by default.

The following scopes are required to establish a connection:

• Files.Read
• offline_access

Workato always requests these scopes. Refer to the permissions section for more information.

8

Optional. Use the Custom OAuth profile drop-down menu to select a custom OAuth profile for your connection.

9

Click Sign in with Microsoft.

Client credentials-based authentication (OAuth 2.0)

This authentication method consists of the following steps:

• Register the Workato App in the Azure portal
• Complete setup in Workato

COMPATIBLE AUTHENTICATION

Client credentials-based authentication is only compatible with tenant-specific connections.

This method requires the following fields:

• Tenant ID/Domain
• User ID
• Client ID
• Client Secret

Register the Workato App in the Azure Portal

Complete the following steps to register the Workato app and assign it permissions for client credentials-based connections.

1

Register the Workato App in the Azure Portal

Complete the following steps to register the Workato app in the Azure portal:

1

Sign in to the Azure portal (opens new window).

2

Select App registrations > + New registration.

3

Enter a unique name for the application.

4

Use the Supported account types drop-down menu to select an account type.

5

Select Web from the Select a platform drop-down menu.

6

Use the following URI for the Redirect URI:

https://www.workato.com/oauth/callback

7

Select Register.

2

Assign permissions to your app

1

Select Manage > API permissions in the navigation sidebar.

2

Click + Add a permission and select Microsoft Graph APIs.

3

Add the required permissions as outlined in the Permissions required to connect section. Depending on your connection type, you must assign Application or Delegated permissions.

Add permissions

4

Click Add permissions. If specific permissions require admin consent, refer to the Granting admin consent (opens new window) section for guidance.

3

Generate a client secret

Complete the following steps to generate a client secret:

1

Go to Manage > Certificates & Secrets > Client secrets.

2

Click + New client secret.

3

Provide a Description for the client secret and specify an Expires date.

4

Click Add.

5

Copy and save the client secret Value—not the Secret ID—for use in Workato.

Copy and save the client secret value

4

Obtain the Application (client) ID, Object ID, and Directory (tenant) ID from the Azure Portal

Complete the following steps to obtain the Application ID, Object ID, and Directory (tenant) ID from the Azure portal:

1

Go to the Overview > Essentials section.

App details

2

Copy and save the Application (client) ID, Object ID, and Directory (tenant) ID for use in Workato.

5

Obtain the User ID from the Azure Portal

Complete the following steps to obtain the User ID from the Azure portal:

1

Go to Home > Users to obtain the User ID.

Select users

2

Search for and select the default user you plan to use to perform operations. This user doesn't establish the connection but is required for performing certain operations that an app can't perform. It's also required in picklists to pull user data. For example, the folder picklist populates folders belonging to the default user.

3

Copy and save the User principal name. Use this value as the User ID in Workato.

Complete setup in Workato

1

Click Create > Connection.

2

Search for OneDrive and select it as your app on the New connection page.

3

Provide a name for your connection in the Connection name field.

4

Use the Location drop-down menu to select the project where you plan to store the connection.

5

Select Tenant specific as the Connection account type. This option supports accounts tied to a specific organization (tenant).

Tenant specific account connection type

6

Provide your Tenant ID/Domain. This is the Directory (tenant) ID for your app. Refer to the Register an app in Azure section to learn how to obtain this value.

7

Select Client credentials as the Authentication type.

8

Provide the User ID, Client ID, and Client secret for your app. Refer to the Register an app in Azure section to learn how to obtain these values.

9

Optional. Use the Custom OAuth profile drop-down menu to select a custom OAuth profile for your connection.

10

Click Sign in with Microsoft.

Permissions required to connect

Permissions control access to OneDrive resources. This section outlines the default and minimum scopes for each authentication type.

Default scopes for authorization code grant connections

The OneDrive connector requests the following scopes by default. These scopes support all triggers and actions. You must assign these as Delegated permissions in the Azure portal:

• Files.ReadWrite
• Group.Read.All
• Files.Read
• offline_access

Minimum scopes for authorization code grant connections

The following minimum scopes are required to establish a connection to OneDrive using authorization code grant authentication:

• Files.Read
• offline_access

Default scopes for client credential connections

We recommend the following scopes for client credentials connections. These scopes support all triggers and actions. You must assign these permissions as Application permissions in the Azure portal:

• Files.Read.All
• Files.ReadWrite.All
• Group.Read.All
• Sites.ReadWrite.All

Minimum scopes for client credential connections

The following minimum scopes are required to establish a connection to OneDrive using client credentials-based authentication:

• Files.Read.All

Connect Microsoft Entra ID to the OneDrive connector

To connect to the OneDrive connector using a Microsoft Entra ID account, ensure that all the consent requests are granted by admins.

Complete the following steps to grant admin consent using an admin account:

1

Sign in to your Azure portal and navigate to Enterprise Applications > Activity > Admin consent requests.

2

Approve the necessary consent requests.