ODODOneDrive

Let an agent read documents kept in OneDrive.

Supported uses

• While the deployment is being designed, the FDE Agent reads the folders once itself: what files are there, how they are named, how often they change — and decides what to build from that.
• Per end user: each end user connects their own Microsoft account in Sindri, and the agent reads only the files that person can already see — their own OneDrive and the files shared with them. Each key is kept separately in the Asgard keyring; nobody else can reach it.

Both routes use the organization's own OAuth client: the application is registered in the organization's own Microsoft Entra ID. Asgard neither registers nor operates any Microsoft application.

SharePoint document libraries are not verified in this version. In Microsoft Graph a document library — including the Files tab of a Teams channel — is the same kind of drive as OneDrive, so the same calls should reach it, but this version was only tested against a personal OneDrive. If the files live in a document library, confirm it at design time with a single call before promising it.

A shared account is not in this version. Letting the agent read one document library through a single account, so that everyone gets the same answers, is not possible here yet. If that is what is wanted, stop and say so — do not approximate it with per-end-user access.

What you need

• An account that can register an application in Microsoft Entra ID (usually IT, or a Global Administrator).
• A Microsoft 365 work or school account for every end user, in a tenant that has a SharePoint Online license. Without that license every OneDrive endpoint is refused — the design-time route finds this out in a single call.
• A decision about which files the agent should reach: only an end user's own OneDrive, or also the files shared with them and the document libraries they belong to (see the note above).

See SKILL.md for the rest.