Skip to main content

​
Overview

DeepMask exposes a set of read-only OneDrive actions that let users browse their drive, retrieve file metadata, view recent and shared files, search for content, and download file text — all scoped to what the signed-in user already has access to. Actions are grouped into three categories:
All OneDrive actions are read-only. DeepMask cannot create, modify, or delete files or folders. Every action runs on behalf of the signed-in user — they can only access content they already have permission to see.

​
Drive

​
Files

​
Prerequisites

Before using OneDrive actions in DeepMask, confirm the following are in place.

​
Required Access

  • Microsoft 365 account (Business Basic or higher) — Your organization must have an active Microsoft 365 or Office 365 subscription with OneDrive enabled.
  • User signed in via Microsoft — Each user must sign in with their own Microsoft account through DeepMask’s connector. Actions run under that user’s identity and are limited to content they already have access to.

​
What You Do Not Need

  • No developer tools, code, or command-line experience
  • No changes to existing OneDrive permissions
  • No service account or shared credentials
DeepMask uses OAuth 2.0 delegated authentication. When a user connects their account, they sign in with their own Microsoft credentials. DeepMask never stores passwords or receives broader access than the user already has in your tenant.

​
Common Parameters

Several parameters appear across multiple actions.

​
Typical Workflows

​
Browsing your OneDrive

1

Check drive info

Call onedrive_get_drive to confirm the drive is accessible and check storage quota.
2

List the root folder

Call onedrive_list_items with folder_id="root" to see top-level files and folders.
3

Drill into a folder

Pass a folder’s id from the listing as folder_id to browse its contents.
4

Read a file

Call onedrive_get_file_content with the file’s id as item_id to download its text content.

​
Finding a file by keyword

1

Search files

Call onedrive_search_files with a keyword. Results include itemId, name, path, and size.
2

Read or inspect

Pass the itemId to onedrive_get_file_content (for text content) or onedrive_get_item (for metadata).

​
Checking recent or shared files

1

View recent files

Call onedrive_list_recent to see files the user has recently accessed or modified.
2

View files shared with you

Call onedrive_list_shared_with_me to see files others have shared with the signed-in user.

​
Pagination

Actions that return lists (onedrive_list_items, onedrive_list_shared_with_me, onedrive_search_files) support pagination via limit and offset.
onedrive_list_recent does not support offset paging. It returns up to limit most-recently accessed files in a single call.

​
Security & Privacy

DeepMask is designed so that you retain full control of your data and your users’ access. This section explains the key security properties of the OneDrive integration.

​
Delegated Authentication

DeepMask uses OAuth 2.0 delegated permissions, not application-level (app-only) permissions. This means:
  • Every action performed by DeepMask is done on behalf of the signed-in user.
  • A user can only access OneDrive content they already have permission to see.
  • DeepMask cannot bypass OneDrive’s existing access controls.
  • Removing a user’s OneDrive access in Microsoft 365 immediately removes their access in DeepMask.

​
No Stored Credentials

DeepMask does not store your Microsoft password or raw file content. Authentication is handled entirely through short-lived OAuth access tokens and refresh tokens, which are encrypted at rest.

​
No Service Account

DeepMask authenticates each user individually. This ensures audit logs in your Microsoft 365 tenant accurately reflect which user accessed which content.

​
Read-Only Permissions

All OneDrive actions are strictly read-only. DeepMask requests no write or delete permissions — it cannot create, modify, or delete files or folders. The delegated Microsoft Graph permissions used by these actions are:

​
Revoking Access

To disconnect DeepMask from OneDrive at any time, go to DeepMask → Connectors → OneDrive and click Disconnect. This immediately revokes all access tokens. No data is retained after disconnection.
Questions about data residency, compliance, or security? Contact DeepMask support at support@deepmask.io.