1. Overview
OneDrive uses the Microsoft 365 workspace connection. You choose each approved drive by its exact Microsoft ID.
Connecting OneDrive does not automatically make its files visible to Seedling members. Seedling verifies Microsoft access information before allowing a person to read synchronized content.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Microsoft 365 connection
- This Microsoft product uses the customer-managed, single-tenant Entra app configured for Microsoft 365. It does not need a separate credential.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. OneDrive data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Selected drives
- Exact drive identities and selected container bindings.
- Files
- Folders, files, authorized content, hierarchy, ownership, and lifecycle metadata.
- Access evidence
- Read-only file and inherited permission information used to determine who can access synchronized content.
4. Read-only permission contract
The app-only bundle uses Files.Read.All with directory context. Production should reduce authority with selected-container controls where Microsoft supports them; no file or sharing write role is requested.
- User.Read.All — required directory identity. GroupMember.Read.All is additional and conditional on enabling directory.groups.
- Files.Read.All — read selected OneDrive content; it does not grant Seedling members access.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
- If Microsoft permissions are incomplete, stale, or ambiguous, Seedling does not show the file to a user.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized OneDrive records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored OneDrive credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.