Connect OneDrive

Connect your organisation’s OneDrive to agents running in your own environment. Your administrator registers the application in your Microsoft tenant and enters its credentials in Omnimatch. We can help with installation and configuration; your organisation retains ownership of the registration and secrets.

Before you start

• Install Omnimatch and activate a product key with OneDrive enabled.
• Use a stable HTTPS installation address that users’ browsers can reach during sign-in.
• Have an authorised Microsoft Entra administrator available to register the application and review consent.
• Allow outbound access to Microsoft sign-in, Microsoft Graph and your tenant’s OneDrive/SharePoint download services. This connection cannot operate air-gapped.

OneDrive and Google Drive are separate licence options. Agent creation shows only the licensed providers. A Microsoft-only company can leave Google Drive disabled. Enabling OneDrive does not require Omnimatch hosted data or Omnimatch models. Provider setup is still required before accounts can connect.

Use your organisation’s tenant

On-prem supports a single-tenant Microsoft Entra application. Register it in your organisation’s directory and enter that directory’s tenant ID in Omnimatch. Sign-in and token renewal use this specific tenant.

A single-tenant app is available to users and guest accounts in its home directory. A multitenant app can be consented to in other directories; even with such an app, this installation uses only its configured tenant. Tenant choice does not change where Omnimatch runs. See Microsoft’s tenancy guidance.

Use the commercial Microsoft cloud. Government and China cloud endpoints are not supported. Guest sign-in does not guarantee that the guest has a OneDrive in this tenant. Use an account with the required document access. Your installation’s sign-in, agent sharing and network access rules still apply separately.

1. Register your Microsoft application

1. Open the Microsoft Entra admin centre and select your organisation’s tenant.
2. Go to Entra ID → App registrations → New registration and give the application a recognisable name, such as “Omnimatch document access”.
3. Select Accounts in this organizational directory only (Single tenant).
4. Register the application and record its Application (client) ID and Directory (tenant) ID.

Follow Microsoft’s app registration instructions. This application registration belongs to your organisation; you do not need an Omnimatch-owned Azure application or a separate Azure-hosted connector server.

2. Register the callback address

In Omnimatch, open Admin → System administration → Drives → OneDrive. Copy the displayed Redirect URI. For an installation at https://agents.example.com, it is:

https://agents.example.com/api/source-connections/callback

In the Microsoft app registration, open Authentication → Add a platform → Web and add that exact URI. Use your installation address, including the callback path, rather than an Omnimatch website address. The browser returns to this address after sign-in; the installation can remain behind your corporate network boundary.

See Microsoft’s redirect URI instructions.

3. Configure delegated permissions

Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, configure:

Use delegated permissions, not application permissions or an unattended service account flow. Your organisation’s consent policies may require administrator approval. See Microsoft’s delegated-permission setup.

Files.Read.All is broader than the files selected for an individual agent: Microsoft grants access to files the connected user can read. Omnimatch applies the agent’s selected files and folders as an additional application restriction. Review this distinction before consenting. See the Microsoft permission definition.

4. Enter credentials in Omnimatch

1. In Microsoft, open Certificates & secrets → Client secrets → New client secret.
2. Choose an expiry your administrator will manage. Copy the secret’s Value, not its secret ID, before leaving the page.
3. In Omnimatch’s Drives → OneDrive settings, enter the Client ID, Directory (tenant) ID and Client secret, then choose Save configuration.

See Microsoft’s credential instructions. The current connector uses a client secret; certificate and workload-identity credentials are not supported. Enter the secret directly in your installation rather than sending it in a support email.

5. Connect and verify an agent

Open OneDrive in the agent’s Data step. Choose Connect account, sign in to the intended Microsoft account and complete the approved consent flow. Select the files or folders the agent should use, then add the source. Test a question against a known document and open its citation.

The connected account belongs to the source owner. People chatting with the agent can receive answers based on that owner’s selected documents; they do not each authenticate to Microsoft for every answer. Share the agent only with an appropriate audience. Opening an original document still requires the reader’s Microsoft access.

The picker browses the connected account’s files and folders. It does not offer discovery across all SharePoint sites. Scanned PDFs have no automatic OCR fallback. Validate the documents and access policies you intend to use before inviting the wider team.

Where your data goes

Run Omnimatch on your own servers or in your organisation’s provisioned cloud environment. Your installation connects directly to the document provider using your organisation’s application credentials. These connector requests do not pass through Omnimatch’s servers. The provider still operates its cloud storage service.

Client secrets and account tokens are encrypted in your installation’s database using its own encryption key. No shared Omnimatch document-provider secret is supplied in the image. Your server administrators control the installation and its keys.

Files are searched and read on demand without importing a document corpus into Omnimatch’s index. Retrieved excerpts can enter model requests and saved conversations. Choose an approved model connection and protect local conversation data and backups. A customer-owned external model API key still sends requests to that provider.

Troubleshooting and renewal

• OneDrive is missing: check the active licence includes OneDrive. Older keys without this permission need replacement; Google Drive and Omnimatch hosted data do not enable it.
• Drives settings are missing: sign in as an installation system administrator and open the Drives tab.
• Redirect mismatch: compare the Web redirect URI with the exact address displayed in Omnimatch.
• Tenant or account-audience error: check the Directory (tenant) ID matches the application’s directory and the connecting account can sign in there. Enter the tenant GUID, not a domain name or common. Older on-prem configurations without a tenant ID must be updated and their accounts reconnected.
• Approval required: ask your Microsoft administrator to review the requested delegated permissions and company consent policy.
• Access expires or is revoked: reconnect the account after resolving the Microsoft-side issue. Before the secret expires, open Drives → OneDrive, choose Change beside Client secret, enter the new value and confirm Replace configuration. All accounts connected to this provider must reconnect.

Use Microsoft’s sign-in error reference for an Entra error code. When requesting help, provide the error code and the step that failed, without tokens, secrets or full callback URLs.