# OneDrive setup for PopMCP

You register an app in the Microsoft Entra admin center, copy its Application (client) ID and a client secret Value into PopMCP, then sign in with Microsoft and approve access to your OneDrive.

- Auth: OAuth authorization
- Setup time: 5 min
- API base URL: https://graph.microsoft.com/v1.0
- Credentials screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
- Provider docs: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

## Before you begin

- A Microsoft account with OneDrive: a personal Microsoft account (OneDrive, Outlook.com, Hotmail or Live), or a work or school account on Microsoft 365 with a license that includes OneDrive. A work account's OneDrive must have been opened once in a browser so Microsoft has set it up.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off, and the Application Developer role always can), or, with only a personal account, a tenant of your own such as the Default Directory of an Azure account.
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
- Only for Files shared with me (other people's files, a colleague's or a team's drive): in most organizations an administrator approves that permission once. Your own files never need an admin by Microsoft's rules.

## Get your credentials

### 1. Open App registrations

Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.

Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

### 2. Register the app

Enter a Name people will recognize, such as `PopMCP`: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant + Personal Microsoft accounts, so work, school and personal OneDrive accounts can all sign in, then select Register. Single tenant only works too for your organization's own accounts, but then the app's Directory (tenant) ID goes into PopMCP as well.

Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

### 3. Add PopMCP's Redirect URI

On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter `https://app.popmcp.com/api/providers/microsoft/callback` exactly as PopMCP shows it, and select Configure.

### 4. Create a client secret

Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as `PopMCP`, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.

### 5. Copy the Application (client) ID

Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.

### 6. Paste both into PopMCP and sign in

In PopMCP put the ID in Application (client) ID and the secret's Value in Client secret Value (the Directory (tenant) ID under More options only for a Single tenant only app). To also open files other people shared with you, tick Files shared with me under More options. Select Sign in with Microsoft, pick the account whose OneDrive you want, and select Accept.

## Fields PopMCP asks for

- Application (client) ID (clientId) [required]: Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant + Personal Microsoft accounts under Supported account types and select Register, then copy the Application (client) ID from Overview.
- Client secret Value (clientSecret) [required]: In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.
- Directory (tenant) ID (tenant): Only for an app registered as Single tenant only. Copy it from the app's Overview page.
- Extra access (extraAccess): 

## Callback URL to register

https://app.popmcp.com/api/providers/microsoft/callback

## Scopes requested

- User.Read
- Files.ReadWrite
- offline_access
- openid
- profile
- email

## Verify

PopMCP shows OneDrive as Connected under the account's address, and onedrive_get_drive returns the drive's type and how much of its storage is used.

## Troubleshooting

### "The app's redirect URI does not match"

Cause: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.

Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.

### "Microsoft did not accept the app's client secret"

Cause: The **Secret ID** was pasted instead of the secret's **Value** (AADSTS7000215), or the Value was cut short when copying.

Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and paste it into PopMCP.

### "The app's client secret has expired"

Cause: Client secrets last at most 24 months (AADSTS7000222).

Fix: Create a new client secret under **Certificates & secrets** and reconnect OneDrive with its Value.

### "This app does not accept the kind of Microsoft account you signed in with"

Cause: The app's **Supported account types** leaves out the account you signed in with, typically a personal Outlook.com account on an organization-only app.

Fix: Register the app with **Any Entra ID Tenant + Personal Microsoft accounts**, or sign in with an account from the app's own organization.

### "Your app is registered for one organization only"

Cause: A Single tenant only app was used without its tenant (AADSTS50194).

Fix: Copy the **Directory (tenant) ID** from the app's **Overview**, enter it under **More options** in PopMCP and connect again.

### "Your organization needs an administrator to approve this app"

Cause: Your organization lets only admins approve apps, or only apps from verified publishers (AADSTS65001 or AADSTS90094).

Fix: An admin opens the app in the Microsoft Entra admin center, **API permissions**, and selects **Grant admin consent** for the organization. Then connect again.

### "This Microsoft account has no OneDrive yet"

Cause: A work or school account's OneDrive is created the first time someone opens it, and needs a license that includes OneDrive.

Fix: Open OneDrive once in a browser (office.com, then OneDrive) so Microsoft sets it up, or ask your Microsoft 365 admin for a license that includes it. Then connect again.

### "This OneDrive connection can open only your own files"

Cause: A tool named another person's drive, or a link into their OneDrive, and the connection was made without Files shared with me.

Fix: Reconnect OneDrive with **Files shared with me** ticked under **More options** (an administrator may have to approve it once). A sharing link can still be opened with open_sharing_link or onedrive_read_file.

### Microsoft asks for an administrator only when Files shared with me is ticked

Cause: Since 2025 Microsoft's default consent settings let people approve an app's access to their own files, but not to every file they can open (Files.Read.All, Files.ReadWrite.All).

Fix: Connect without Files shared with me for your own files, or ask an admin to open the app under **Enterprise apps**, **Permissions** and select **Grant admin consent**.

### 429 with a Retry-After header

Cause: OneDrive allows about 3,000 requests per 5 minutes per user, and each app has a share of its organization's limit.

Fix: Wait the time Microsoft gives and try again. search_files, $select and onedrive_read_file do in one call what would otherwise take many.

---

Source: https://www.docs.popmcp.com/docs/integrations/onedrive/