Skip to main content
The OneDrive connector syncs files from one Microsoft 365 account’s OneDrive, and the items shared with that account, into Kepler. A Kepler admin connects it once for the whole organization. Kepler reads files only. It never changes or deletes anything in OneDrive. This page has two parts:

​
Before you start

  • A Kepler organization admin, signed in to Kepler in an incognito window. Only admins can manage connectors. The Microsoft sign-in uses the Microsoft account your browser is already signed in to. An incognito window makes sure you connect the dedicated account, not your own.
  • A dedicated Microsoft 365 account with a OneDrive licence, for example kepler-sync@yourcompany.com. Don’t use a person’s own account: Kepler can read everything the account can open, and the selected content becomes visible to your whole organization.
If OneDrive is not listed when you add a connector, it is not yet turned on for your organization. Email desk@kepler.ai to turn it on.

​
Connect OneDrive

1

Open organization connectors

In Kepler, open the account menu in the sidebar and select Settings. Under Organization, select Org connectors.
Kepler Organization connectors page with an Add connector button

The Org connectors page, before any connector is added.

2

Add OneDrive

Select Add connector, then select OneDrive.
Add a connector dialog listing SharePoint, Egnyte, Box, Google Drive, OneDrive, and Outlook
The OneDrive row opens and shows the three setup steps.
OneDrive row showing three steps: prepare a dedicated Microsoft 365 account, connect the service account, and choose what syncs
3

Connect the dedicated account

Under Connect the service account, select Connect. A dialog explains that you will sign in with Microsoft. Select Connect again, then sign in to Microsoft as the dedicated account.Microsoft asks you to accept the permissions Kepler needs. Select Accept. If Microsoft shows Need admin approval instead, a Microsoft 365 admin must approve Kepler first. Send them to For Microsoft 365 admins.When the connection works, the step shows Connected as with the dedicated account’s name and email. Check that it is the dedicated account, not your own.
OneDrive row after connecting, with the account connected and a Choose content button
4

Choose what syncs

Under Choose what syncs, select Choose content. Nothing syncs until you make a selection.
  • My files is the dedicated account’s own OneDrive.
  • Shared with this account lists the folders and files other people shared with it. Open it to select items inside.
Select the folders and files to sync, then select Review. The button shows how many items you selected.
OneDrive content picker with My files and Shared with this account
5

Review and save

Check the list under Review what syncs, then select Save selection.To limit what syncs, open Global Content Filters. You can allow or block file extensions, skip hidden files, set a maximum file size, or sync only files modified after a date.
Review what syncs dialog listing the selected folder, the Global Content Filters, and a Save selection button
The OneDrive row now shows Syncing. New and changed files usually become searchable within minutes.
OneDrive row with the status Syncing and an Edit selection button

OneDrive is connected and syncing the selected content.

Kepler manages access to a connection and access to its synced content separately. If your OneDrive content does not appear in the Documents library within 5 minutes, email desk@kepler.ai.

​
For Microsoft 365 admins

Many Microsoft 365 tenants don’t let regular users approve apps that read files. In that case the dedicated account sees Need admin approval when it signs in, and an admin must approve Kepler’s app for the tenant once.

​
What Kepler asks for

Kepler asks for read-only, delegated access as the one account that signs in. It can’t change or delete files, and it can’t open anything that account can’t open. You need one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.
If the consent link shows Need admin approval after you sign in, your account doesn’t have one of these roles. Many companies that use a managed service provider (MSP) for IT have no one in-house with these roles. Send the link to the person who has one, often at your MSP. They sign in with their admin account for your tenant. Keep your domain in the link, so that the consent goes to your tenant and not to theirs.
1

Open the consent link

Replace <your-tenant-domain> with your domain, for example yourcompany.com, and open the link:
2

Sign in and accept

Sign in with your admin account. Check that the screen shows Kepler OneDrive and the permissions above, then select Accept. The screen doesn’t show openid, email or profile as separate lines. It includes them in Sign in and read user profile.Microsoft then opens a Kepler page that can show an error. You can close it: your consent was saved when you selected Accept.
3

Confirm

In the Microsoft Entra admin center, open Enterprise applications, search for Kepler OneDrive, and open Permissions. The Admin consent tab lists the permissions under Microsoft Graph.
Then tell your Kepler admin to connect again. The sign-in no longer asks for approval.

​
App restrictions

Skip this if your tenant does not limit which apps users can sign in to. Otherwise, in Enterprise applications, open Kepler OneDrive and check:
  • Properties → Assignment required? If this is Yes, open Users and groups and add the dedicated account.
  • Conditional Access. If a policy blocks third-party apps or requires a managed device, allow Kepler OneDrive for the dedicated account. Kepler syncs from the cloud, not from a device on your network.

​
Remove access

Either of these stops Kepler reading OneDrive:
  • In Kepler: a Kepler admin opens Org connectors, expands OneDrive, and selects Delete OneDrive connection.
  • In Microsoft Entra: open Enterprise applications, open Kepler OneDrive, then Properties → Delete. This removes the app and its consent from your tenant.

​
Troubleshooting

Your tenant requires an admin to approve Kepler’s app. Follow Grant admin consent, then connect again. If the consent link also shows this message, your account can’t approve apps. Send the link to an admin who can, for example at your managed service provider (MSP).
Assignment required? is on for Kepler’s app. Add the dedicated account under Users and groups. See App restrictions.
A Conditional Access policy covers Kepler’s app. Allow it for the dedicated account. See App restrictions.
The browser reused an existing Microsoft sign-in. Select Disconnect, then connect again from an incognito window.
The picker shows only what is shared with the dedicated account. Share the folder with that account, then open Shared with this account again.