Skip to main content
The OneDrive VFS talks to Microsoft OneDrive and SharePoint document libraries through the Microsoft Graph API. It authenticates with an OAuth2 bearer access token, optionally scoped to a specific drive.

​
Credentials

You need an access token and, for app-only auth or a drive other than the signed-in user’s default, one explicit drive selector. Pick whichever token path fits.

​
Option A: Quick token (Graph Explorer)

Fastest way to try it. The token lasts about an hour, which is plenty for a test run.
  1. Open Graph Explorer and Sign in.
  2. Run any query (for example GET /me/drive) and consent when prompted.
  3. Open the Access token tab and copy the token.
This is a delegated token, so it works against your own /me/drive and you do not need a drive ID.

​
Option B: Interactive device-code token

Use this to obtain a delegated token through your own app registration; the initial sign-in makes it a development bootstrap, not an unattended credential.
  1. In the Microsoft Entra admin center, go to Identity -> Applications -> App registrations -> New registration. For a personal account, choose Accounts in any organizational directory and personal Microsoft accounts.
  2. Under Authentication -> Advanced settings, set Allow public client flows to Yes.
  3. Under API permissions -> Microsoft Graph -> Delegated, add Files.Read for your own drive or Files.ReadWrite for writes. Other drives or SharePoint may require the corresponding Files.*.All or Sites.* scope.
  4. Run the device-code flow with your Application (client) ID. For writes, replace Files.Read with Files.ReadWrite in the request below:
The response includes access and refresh tokens. Mirage accepts an access token or provider callback but does not refresh Microsoft tokens itself, so a long-running application must refresh through that callback.

​
Save the token for the examples

For SDK configuration and the other drive selectors, see Python OneDrive or TypeScript OneDrive.

​
Get your drive ID (optional)

App-only tokens cannot use /me/drive; set one of drive_id, site_id, group_id, or user_id. Delegated tokens can use /me/drive directly.
Only needed when you use the drive_id selector. With your token exported as TOKEN:
The drive ID looks like b!a1B2c3....
Snapshots and version pinning rely on OneDrive/SharePoint version history, which is on by default. Older versions are only readable while the library retains them (the version cap is configurable, and an admin can disable versioning).