How to create an OAuth app for OneDrive

OneDrive is reached through Microsoft Graph, so the app you register lives in Microsoft Entra ID (formerly Azure Active Directory). Registering it is self-service and takes a handful of screens: a multitenant app registration, three delegated Graph permissions, a client secret, and the two values you paste into the Apideck Dashboard.

Before you start, you will need:

• A Microsoft account that can create app registrations. Use a work or school account if you intend to complete publisher verification later (Microsoft does not accept a personal account for that step).
• A custom domain you control, if you plan to open the integration to consumers outside your own tenant. Step 5 explains why.

You can register the app, connect your own OneDrive and build the whole integration before any of the verification steps below. Publisher verification and admin consent only become relevant when you open the integration to organisations other than your own.

1. Register the application

1. Sign in to the Microsoft Entra admin center and go to App registrations (direct link: aka.ms/AppRegistrations).
2. Select New registration.
3. Fill in the registration form:

Field	Value
Name	The name your consumers will see on the Microsoft consent screen. Most of the time this is your company or product name.
Supported account types	Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts. This is the broadest option and the one that supports both personal OneDrive and OneDrive for Business. A single-tenant registration only ever works for your own organisation.
Redirect URI	Platform Web, URI https://unify.apideck.com/vault/callback

4. Select Register.

The redirect URI above is the Apideck Vault callback and is the same for every Apideck connector. Do not register a localhost or vendor URL here: Microsoft rejects the authorization request if the redirect URI does not match exactly.

Microsoft's own walkthrough of this screen: Register an application with the Microsoft identity platform.

2. Add the delegated Graph permissions

From your new app registration, open API permissions and select Add a permission > Microsoft Graph > Delegated permissions.

Add the three permissions Apideck requests by default:

Permission	Why it is needed
Files.ReadWrite.All	Read and write the files and folders in the signed-in consumer's OneDrive, including items shared with them.
offline_access	Issues the refresh token Apideck uses to keep the connection alive without asking the consumer to sign in again.
openid	Sign-in and basic profile, used to identify the connecting account.

Read-only integrations: if your integration never writes, select Files.Read.All instead of Files.ReadWrite.All. The connector also declares Files.Read and Files.ReadWrite for narrower setups. Keep this selection and the scopes you set on the connector in the Apideck Dashboard (step 4) in sync, so consumers are asked for exactly the permissions your app registration declares.

These are delegated permissions, which act on behalf of the signed-in consumer. The connector does not use application (app-only) permissions, so there is nothing to configure under that tab.

If you want to test in your own tenant straight away and your organisation requires consent, select Grant admin consent for your organisation on this screen.

3. Create a client secret: copy the Value, not the Secret ID

1. Open Certificates & secrets > Client secrets > New client secret.
2. Enter a description and choose an expiry period. Note the date down: when the secret expires, every connection that uses your credentials stops working until you add a new secret in Entra and update it in the Apideck Dashboard.
3. Select Add.

Microsoft now shows two columns, and this is where the setup most easily goes wrong:

Column	What it is	Where it goes
Value	The actual secret. Shown once, only on this screen.	Apideck Client Secret
Secret ID	An internal identifier for the secret row.	Nowhere. Apideck never asks for it.

Copy the Value now and store it somewhere safe. Once you navigate away from this page Microsoft will not show it again and you have to generate a new secret.

Your Client ID is a third, separate value: it is the Application (client) ID on the app registration's Overview page. It is not the Secret ID.

4. Configure the connector in the Apideck Dashboard

Open the Apideck OneDrive connector settings, select Use your own client credentials, and fill in:

Apideck field	Value from Microsoft Entra
Client ID	Application (client) ID, from the app registration's Overview page
Client Secret	The client secret Value from step 3
Scopes	The same permissions you granted in step 2 (by default files.readwrite.all, offline_access, openid)

Save the settings, then authorize a test connection in Vault before you point consumers at it. Apideck handles the OAuth exchange, stores the credentials and refreshes access tokens from then on. Your only recurring task is rotating the client secret before the expiry you chose in step 3.

5. Publisher verification: what opens your app to other tenants

Since 8 November 2020 Microsoft applies risk-based step-up consent: users in other tenants are blocked from consenting to a newly registered multitenant app that is not publisher verified. Your own organisation is unaffected, so the app works for you while unverified. Verification is what makes it usable by your customers.

Microsoft charges no fee for it, but it has real prerequisites:

• A Microsoft AI Cloud Partner Program account (formerly MPN) that has completed the verification process, with its Partner Global Account associated with the tenant holding the app registration.
• The app registered with a work or school account, not a personal Microsoft account.
• A publisher domain set on the app under Branding & properties. It must be a custom domain you have DNS-verified in Entra: a *.onmicrosoft.com domain is not accepted.
• The person doing the verification signed in with multifactor authentication, holding the Application Administrator or Cloud Application Administrator role in Entra, and the Microsoft AI Cloud Partner Program Admin or Accounts Admin role in Partner Center.

With those in place, open the app's Branding & properties page, select Add Partner ID to verify publisher near the bottom, enter your Partner One ID and select Verify and save. A blue verified badge then appears next to your publisher display name, and consumers start seeing it on the Microsoft consent screen. If your organisation is not yet in the partner programme, ask whoever owns that relationship at your company to start it and to give you an expected timeline.

Microsoft's references: Publisher verification overview and Mark an app as publisher verified.

6. Plan for admin consent in your consumers' tenants

Publisher verification removes Microsoft's own block. A second, independent gate sits on top of it: each work or school tenant sets its own user consent policy, and many organisations switch user consent off entirely. In those tenants nobody can connect until a tenant administrator approves your app, whichever credentials you use.

What this means for your onboarding:

• Expect some consumers to hit a "Need admin approval" screen instead of the normal consent screen. Usually that is the consumer's own tenant consent policy rather than an error in your setup. If consumers outside your own tenant cannot connect at all, check publisher verification (step 5) first: that block is yours to remove.
• Give those consumers something to forward to their IT administrator: your app name, your publisher name, and the permissions from step 2 (read and write access to the files the signing-in user can already reach).
• An administrator can approve the app once for the whole organisation, after which individual users connect normally.
• Personal Microsoft accounts have no tenant administrator, so this gate does not apply to them.

Background reading for an administrator: Configure how users consent to applications.

7. Finish the app's branding (recommended)

Back in Branding & properties, add your logo, a home page URL, terms of service and privacy statement links. These appear on the Microsoft consent screen your consumers see, so a complete, recognisable screen makes the authorization step easier for them to trust. The publisher domain from step 5 is set on this same page.

FAQ and troubleshooting

Error: OAuthCodeExchangeError when using your own client credentials

This means Microsoft rejected the code exchange because the credentials configured on the OneDrive connector do not match your app registration. In practice it is almost always one of:

• The Secret ID was pasted into the Client ID or the Client Secret field. The Client ID is the Application (client) ID from the Overview page; the Client Secret is the secret Value. See step 3.
• The secret Value was truncated when copied, or a new secret was generated in Entra without updating the Apideck Dashboard.
• The client secret has passed its expiry date.
• The redirect URI registered in Entra is not exactly https://unify.apideck.com/vault/callback.

Re-copy the values from Microsoft, save them again in the connector settings, and retry the connection.

Error: OAuthCodeExchangeError when the consumer's account has no OneDrive

This happens with your own credentials as well as with Apideck's temporary shared test credentials: the account being used to authenticate does not have OneDrive enabled. Confirm that the account can reach OneDrive by signing in to OneDrive on the web with it first; Microsoft's guidance on adding an account in OneDrive covers the desktop and mobile apps.

A consumer sees "Need admin approval" or cannot consent at all

Two different causes, and they can occur together:

1. The consumer's tenant requires administrator consent (step 6). Their IT administrator approves the app once for the organisation.
2. The app is multitenant but not yet publisher verified, so Microsoft blocks cross-tenant consent (step 5).

If consumers in your own tenant can connect but nobody outside it can, cause 2 is the likely one.

Consumers connect, but see the wrong files

A OneDrive connection is pinned to a single drive, which the consumer selects after authorizing. Someone with several drives or shared libraries needs one connection per drive. The consumer-facing connection guide covers how to pick the drive.

Which permissions should I request?

Request the narrowest set your integration actually needs: Files.Read.All for read-only, Files.ReadWrite.All when you create, update or delete files. Consumers and their administrators read the permission list on the consent screen, and a narrower request is easier for an administrator to approve. Keep the Entra app registration and the Apideck scopes in step 4 in sync whenever you change it.

More information

• Register an application with the Microsoft identity platform
• Quickstart: Register an application
• Publisher verification overview
• Configure how users consent to applications
• Still stuck? Contact Apideck Support.