OneDrive & SharePoint

This guide walks you through connecting Microsoft OneDrive and SharePoint to Vince Platform. Once connected, users can select files from OneDrive manually when running workflows, and you can also set up automated scheduled access to SharePoint folders.

---

Prerequisites

• Access to Vince Platform
• A Microsoft M365 administrator account with permission to create Azure app registrations
• Basic familiarity with Azure and OneDrive services

Your M365 account must have at least one of the following roles:

• Cloud Application Administrator
• Application Developer
• Application Administrator
• Global Administrator

---

Part 1 — Enable the OneDrive File Picker

When a user opens the OneDrive File Picker for the first time from Vince Platform, the app VL POC FilePicker Multitenant will request Admin Consent for the following delegated permissions:

Profile · User.Read · Files.Read · Files.Read.All · Files.ReadWrite.All · Sites.Read.All · openid · Team.ReadBasic.All

Once admin consent is granted, users can manually select files from OneDrive or SharePoint when running a workflow. This is sufficient if you only need manual file selection.

To automate or schedule workflows that read from a SharePoint folder, continue with Part 2 below.

---

Part 2 — Set up automated SharePoint access

note

This part involves Azure app registrations and PowerShell scripts against Microsoft Graph. It's typically IT/Azure-admin work — if that's not you, hand this section to your IT team and skip to Step 4 once they've completed Steps 1–3.

Step 1 — Register a new app in Azure

1. Log in to the Azure portal and go to Azure Active Directory (also called Microsoft Entra ID).
2. Select App registrations and click New registration.
3. Enter a name for the application and choose the appropriate account type.
4. Click Register.

Step 2 — Create client credentials

1. Go to Certificates & secrets for your registered app.
2. Under Client secrets, click New client secret.
3. Enter a description and set an expiration period, then click Add.
4. Copy the generated client secret immediately — you will need it later and it will not be shown again.

Step 3a — Configure app permissions

1. Go to API permissions for your registered app and click Add a permission.
2. Select Microsoft Graph, then choose Application as the permission type.
3. Add the permission Sites.Selected for SharePoint file access.
4. Click Add permissions.
5. If required, click Grant admin consent to apply the permissions immediately.

Step 3b — Assign SharePoint site permissions

The Sites.Selected permission alone does not grant access to any specific site — you must explicitly grant the app access to each SharePoint site using PowerShell.

Prerequisites for this step:

• A user account with at least the SharePoint Administrator role
• PowerShell 5.1+ with the Microsoft Graph PowerShell SDK installed
• An existing App Registration with the Sites.Selected application permission

# Install the Microsoft Graph SDK if needed
Install-PSResource -Name Microsoft.Graph -Scope CurrentUser

# Sign in with a SharePoint Administrator account
Connect-MgGraph -Scopes "Sites.FullControl.All","Application.Read.All"

Find the SharePoint Site ID:

# Option 1 — search by display name
$siteName = "Your Site Name"
$site = Get-MgSite -Search $siteName | Where-Object { $_.DisplayName -eq $siteName }
$siteId = $site.Id

# Option 2 — search by URL
$domain = "yourcompanydomain"
$site = Get-MgSite -SiteId "$domain.sharepoint.com:/sites/YourSiteName:"
$siteId = $site.Id

Find the Service Principal:

$appDisplayName = "Your App Name"
$sp = Get-MgServicePrincipal -Filter "displayName eq '$appDisplayName'"
$spId = $sp.Id

Grant the app access:

# Accepted roles: "read" or "write"
$role = "write"

$body = @{
    roles = @($role)
    grantedToIdentities = @(
        @{
            application = @{
                id          = $spId
                displayName = $appDisplayName
            }
        }
    )
}
New-MgSitePermission -SiteId $siteId -BodyParameter $body

View, edit, or remove permissions:

# List existing assignments
Get-MgSitePermission -SiteId $siteId | Select-Object Id,Roles,GrantedToIdentities

# Remove an assignment (permissions cannot be updated in-place — remove and recreate instead)
$permissionId = "paste-permission-id-here"
Remove-MgSitePermission -SiteId $siteId -PermissionId $permissionId

Step 4 — Configure the connection in Vince Platform

1. In Vince Platform, go to Administration → Integrations → Connections and click New Connection.
2. Enter a name and description for the connection.
3. Select Azure as the System.
4. Set Authentication Type to Auth, Protocol to HTTPS, and select the Vince Platform Environment.
5. Fill in the following fields:

Field	Value
Client ID	Application (Client) ID from the Azure portal
Client Secret	The client secret generated in Step 2
Token URI	The OAuth 2.0 token endpoint (v2) from the Azure App registrations Endpoints page
Base URI	https://graph.microsoft.com/v1.0/
Grant Type	client_credentials
Scope	https://graph.microsoft.com/.default

6. Click Save.

Step 5 — Verify the connection (recommended)

1. In the Connections list, find your new OneDrive connection.
2. Click the ⋮ actions menu and select Validate Connection.
3. This tests authentication and confirms communication with Microsoft OneDrive is working correctly.

tip

Always validate the connection before using it in a workflow to catch any configuration issues early.