Overview

The Microsoft OneDrive data store for Gemini Enterprise lets you access your Microsoft OneDrive and interact with your files and folders.

Supported Microsoft OneDrive versions

The Microsoft OneDrive data store supports all hosted versions of Microsoft OneDrive through the Microsoft Graph API v1.0.

Supported actions

When the Microsoft OneDrive data store is enabled, end users can use natural language commands in Gemini Enterprise to perform the following actions.

Action Description
Create folder Creates a new folder at a specified path in Microsoft OneDrive.
Copy file Copies a file from a source to a destination in Microsoft OneDrive.

Required permissions

To enable Gemini Enterprise to perform search and data ingestion using the Microsoft OneDrive data store, you need the following permissions:

Microsoft Graph API permissions

The table below outlines the permissions required for each connection mode.

Note: The following table outlines the permissions required for each connection mode. If you enable Actions for either the Federated search or Data ingestion connection mode, also select the permissions listed in the Actions row.

Connection mode Scope Purpose
Federated search Files.Read.All (Delegated) Allows the data store to read all files that the user can access.
Sites.Read.All (Delegated) Allows the data store to read documents and list items in all site collections that the user can access.
Data ingestion GroupMember.Read.All (Federated credentials & OAuth 2.0 refresh token) Allows the data store to read memberships and basic group properties for all groups without a signed-in user.
User.Read (Federated credentials & OAuth 2.0 refresh token) Allows the data store to read the profile of signed-in users. It also allows the data store to read basic company information of signed-in users.
User.Read.All (OAuth 2.0 refresh token only) Allows the data store to read user profiles.
Sites.FullControl.All (Option 1)
Sites.Selected (Option 2)		 (Federated credentials & OAuth 2.0 refresh token) Option 1 allows the data store to have full control of all site collections. Option 2 allows the data store to access a subset of site collections. The specific site collections and the permissions granted can be configured in Microsoft OneDrive.
User.Read.All (Option 1)
User.ReadBasic.All (Option 2)		 (Federated credentials only) Option 1 allows the data store to read user profiles. Option 2 allows the data store to read a basic set of profile properties of other users in the organization.
Actions Files.ReadWrite.AppFolder (Delegated) Allows the data store to read, create, update and delete files in the Microsoft OneDrive folder.
Files.ReadWrite (Delegated) Allows the data store to read, create, update and delete the files that the user can access.

For information on how to add the permissions for Microsoft OneDrive, see Configure Microsoft OneDrive and set the necessary permissions.

Limitations

This section outlines known issues and limitations that may affect your use of the Microsoft OneDrive data store.

  • When creating a new application or adding a data store to an existing one, we recommend adding only one data store with actions belonging to a single connector type, regardless of the connection mode. For example, don't associate two Microsoft OneDrive data stores with enabled actions to the same application.
  • Enforcing a VPC Service Controls perimeter on existing Microsoft OneDrive data stores is not supported. To enforce VPC Service Controls, you must delete and recreate the data stores. For more information on VPC Service Controls and how to use actions after enabling VPC Service Controls, see Secure your app with VPC Service Controls.
  • The Microsoft OneDrive data store is supported only in Global, US, and EU locations.

The following are the limitations for the Microsoft OneDrive federated data store:

  • Search limitations: Search results may vary and are not always comprehensive for all file types. Content in archived or encrypted folders may not be accessible for search. Federated search does not support searching within attachments.
  • Delegated access: Access to shared Microsoft OneDrive files or folders may require specific permissions not covered by standard user authorization.

The following are the limitations for the Microsoft OneDrive ingestion data store:

  • Incremental sync does not detect folder-level actions like Copy, Move, or Rename.

What's next