> ## Documentation Index > Fetch the complete documentation index at: https://docs.kepler.ai/llms.txt > Use this file to discover all available pages before exploring further. # OneDrive > Connect a Microsoft 365 OneDrive so everyone in your organization can search its files in Kepler. The OneDrive connector syncs files from one Microsoft 365 account's OneDrive, and the items shared with that account, into Kepler. A Kepler admin connects it once for the whole organization. Kepler reads files only. It never changes or deletes anything in OneDrive. This page has two parts: * [For Kepler admins](#connect-onedrive): connect OneDrive and choose what syncs. * [For Microsoft 365 admins](#for-microsoft-365-admins): approve Kepler's app when your tenant blocks the sign-in. ## Before you start * **A Kepler organization admin, signed in to Kepler in an *incognito window*.** Only admins can manage connectors. The Microsoft sign-in uses the Microsoft account your browser is already signed in to. An incognito window makes sure you connect the dedicated account, not your own. * **A dedicated Microsoft 365 account** with a OneDrive licence, for example `kepler-sync@yourcompany.com`. Don't use a person's own account: Kepler can read everything the account can open, and the selected content becomes visible to your whole organization. > [!NOTE] > > If **OneDrive** is not listed when you add a connector, it is not yet turned on for your organization. Email [desk@kepler.ai](mailto:desk@kepler.ai) to turn it on. ## Connect OneDrive **1. Open organization connectors** In Kepler, open the account menu in the sidebar and select **Settings**. Under **Organization**, select **Org connectors**. ![Kepler Organization connectors page with an Add connector button](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/org-connectors-page.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=0c273c43fe87f3d25fef4b51e805970d) The Org connectors page, before any connector is added. **2. Add OneDrive** Select **Add connector**, then select **OneDrive**. ![Add a connector dialog listing SharePoint, Egnyte, Box, Google Drive, OneDrive, and Outlook](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/add-connector-onedrive.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=aec20a239d4b9b5437a37373b123bd36) The OneDrive row opens and shows the three setup steps. ![OneDrive row showing three steps: prepare a dedicated Microsoft 365 account, connect the service account, and choose what syncs](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/onedrive-setup-steps.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=57c1119435aa52e3bce80c48e46dd430) **3. Connect the dedicated account** Under **Connect the service account**, select **Connect**. A dialog explains that you will sign in with Microsoft. Select **Connect** again, then sign in to Microsoft as the dedicated account. Microsoft asks you to accept the permissions Kepler needs. Select **Accept**. If Microsoft shows **Need admin approval** instead, a Microsoft 365 admin must approve Kepler first. Send them to [For Microsoft 365 admins](#for-microsoft-365-admins). When the connection works, the step shows **Connected as** with the dedicated account's name and email. Check that it is the dedicated account, not your own. ![OneDrive row after connecting, with the account connected and a Choose content button](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/onedrive-connected.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=cb731aeea5bac1f85cdc9186fa8abdee) **4. Choose what syncs** Under **Choose what syncs**, select **Choose content**. Nothing syncs until you make a selection. * **My files** is the dedicated account's own OneDrive. * **Shared with this account** lists the folders and files other people shared with it. Open it to select items inside. Select the folders and files to sync, then select **Review**. The button shows how many items you selected. ![OneDrive content picker with My files and Shared with this account](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/onedrive-picker.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=97a95c905f87cc788ff7347c63f81b9f) **5. Review and save** Check the list under **Review what syncs**, then select **Save selection**. To limit what syncs, open **Global Content Filters**. You can allow or block file extensions, skip hidden files, set a maximum file size, or sync only files modified after a date. ![Review what syncs dialog listing the selected folder, the Global Content Filters, and a Save selection button](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/onedrive-review.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=5ba7047dacb5416e7d4deeec805f8cc9) The OneDrive row now shows **Syncing**. New and changed files usually become searchable within minutes. ![OneDrive row with the status Syncing and an Edit selection button](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/onedrive-syncing.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=73908e95f20d98c0941b4d903b65f4cb) OneDrive is connected and syncing the selected content. > [!NOTE] > > Kepler manages access to a connection and access to its synced content separately. If your OneDrive content does not appear in the **Documents** library within 5 minutes, email [desk@kepler.ai](mailto:desk@kepler.ai). ## For Microsoft 365 admins Many Microsoft 365 tenants don't let regular users approve apps that read files. In that case the dedicated account sees **Need admin approval** when it signs in, and an admin must approve Kepler's app for the tenant once. ### What Kepler asks for Kepler asks for **read-only, delegated** access as the one account that signs in. It can't change or delete files, and it can't open anything that account can't open. ### Grant admin consent You need one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator. > [!NOTE] > > If the consent link shows **Need admin approval** after you sign in, your account doesn't have one of these roles. Many companies that use a managed service provider (MSP) for IT have no one in-house with these roles. Send the link to the person who has one, often at your MSP. They sign in with their admin account for your tenant. Keep your domain in the link, so that the consent goes to your tenant and not to theirs. **1. Open the consent link** Replace `` with your domain, for example `yourcompany.com`, and open the link: [https://login.microsoftonline.com/\/adminconsent?client\_id=f944a0f3-bf88-4c23-8efd-0069de871a68](https://login.microsoftonline.com/\/adminconsent?client_id=f944a0f3-bf88-4c23-8efd-0069de871a68) **2. Sign in and accept** Sign in with your admin account. Check that the screen shows **Kepler OneDrive** and the permissions above, then select **Accept**. The screen doesn't show `openid`, `email` or `profile` as separate lines. It includes them in **Sign in and read user profile**. Microsoft then opens a Kepler page that can show an error. You can close it: your consent was saved when you selected **Accept**. **3. Confirm** In the [Microsoft Entra admin center](https://entra.microsoft.com), open **Enterprise applications**, search for **Kepler OneDrive**, and open **Permissions**. The **Admin consent** tab lists the permissions under Microsoft Graph. Then tell your Kepler admin to connect again. The sign-in no longer asks for approval. ### App restrictions Skip this if your tenant does not limit which apps users can sign in to. Otherwise, in **Enterprise applications**, open **Kepler OneDrive** and check: * **Properties → Assignment required?** If this is **Yes**, open **Users and groups** and add the dedicated account. * **Conditional Access.** If a policy blocks third-party apps or requires a managed device, allow **Kepler OneDrive** for the dedicated account. Kepler syncs from the cloud, not from a device on your network. ### Remove access Either of these stops Kepler reading OneDrive: * **In Kepler:** a Kepler admin opens **Org connectors**, expands **OneDrive**, and selects **Delete OneDrive connection**. * **In Microsoft Entra:** open **Enterprise applications**, open **Kepler OneDrive**, then **Properties → Delete**. This removes the app and its consent from your tenant. ## Troubleshooting > [accordion] Microsoft says “Need admin approval” > > Your tenant requires an admin to approve Kepler's app. Follow [Grant admin consent](#grant-admin-consent), then connect again. If the consent link also shows this message, your account can't approve apps. Send the link to an admin who can, for example at your managed service provider (MSP). > [accordion] Error AADSTS50105: not assigned to a role for the application > > **Assignment required?** is on for Kepler's app. Add the dedicated account under **Users and groups**. See [App restrictions](#app-restrictions). > [accordion] Error AADSTS53003: blocked by Conditional Access > > A Conditional Access policy covers Kepler's app. Allow it for the dedicated account. See [App restrictions](#app-restrictions). > [accordion] The connection shows the wrong account > > The browser reused an existing Microsoft sign-in. Select **Disconnect**, then connect again from an incognito window. > [accordion] A shared folder is missing from the picker > > The picker shows only what is shared with the dedicated account. Share the folder with that account, then open **Shared with this account** again. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.