Skip to main content

Setting Up OneDrive, SharePoint and Teams

Delegated permissions

Each user must log in and consent to the permissions listed below. The consent dialog clearly describes each scope. Admin consent (Step 3) pre-approves all scopes so individual users cannot modify them.

1. Add Delegated Permissions — Read​

The table below lists every required read scope for ingestion and search, which service it applies to, and what access it grants.

PermissionSharePoint / OneDriveTeamsWhat it grants
offline_access✅—Keeps tokens refreshed without re-authentication
User.Read✅✅Read the signed-in user's profile
User.Read.All✅✅Read all users' profiles in the directory
Files.Read.All✅—Read all files accessible to the user across drives
Sites.Read.All✅—Read items in all SharePoint site collections
Group.Read.All✅✅Read all groups and their properties
ChannelMessage.Read.All—✅Read messages across all Teams channels
GroupMember.Read.All—✅Read group membership lists
TeamMember.Read.All—✅Read team members and their roles
Chat.Read—✅Read user and group chat messages
ChannelMember.Read.All—✅Read the members of all channels
OnlineMeetings.Read—✅Read online meeting details
OnlineMeetingTranscript.Read.All—✅Read transcripts of online meetings

Use the tabs below to copy the exact scope list for each service into Azure.

offline_access
User.Read
User.Read.All
Files.Read.All
Sites.Read.All
Group.Read.All

2. Add Delegated Permissions — Write Actions (Optional)​

By default, the read scopes above are enough for your Twin to search and answer questions from Microsoft 365 content. To let users take action from chat — send Teams messages, update files, schedule meetings, and more — add the additional scopes below.

Every write action still requires the user to review and approve the exact change before anything is sent or modified.

Example use cases​

  • Send a Teams DM: "Send Rikin a DM outlining the rollout plan for DT agents"
  • Post to a channel: "Share today's standup summary in #engineering"
  • Schedule a meeting: "Book a 30-minute sync with the product team next Tuesday afternoon"
  • Update a document: "Add this week's metrics to the Q3 roadmap doc on SharePoint"

Additional scopes for write actions​

These scopes are separate from the read scopes in Step 1. Add only the ones that match the write actions you want to enable.

ServiceWhat it enablesAccessPermission
TeamsSend messages in chatsWriteChatMessage.Send
TeamsSend messages in channelsWriteChannelMessage.Send
OneDriveModify files & permissionsWriteFiles.ReadWrite.All
SharePointModify files & permissionsWriteSites.ReadWrite.All

Use the tabs below to copy the write scope list for each service into Azure.

ChatMessage.Send
ChannelMessage.Send

Once all required scopes are added (read scopes from Step 1, plus any optional write scopes from Step 2), click Grant admin consent for [your tenant] in the Azure Portal.

Why this matters

Pre-approving scopes means users only need to sign in — they cannot modify or decline individual permissions. This resolves the common issue of tenants that have disabled user-level consent.

4. Set Up Redirect URIs​

a. On your app registration page, open the Authentication tab and click Add a platform → Web.

b. Add the following redirect URIs:

info

Replace <instanceID> with your customer domain for BYOC deployments, or viven.ai for Viven-hosted.

https://stage-digitaltwin.<instanceID>/oauth/microsoft/callback
https://digitaltwin.<instanceID>/oauth/microsoft/callback
https://stage-digitaltwin.<instanceID>/oauth/microsoft/data_source/callback
https://digitaltwin.<instanceID>/oauth/microsoft/data_source/callback

c. In the Advanced settings section of the same tab, enable Access tokens (used for implicit flows).

d. Click Save. SharePoint, OneDrive, and Teams are now ready for integration.