> For the complete documentation index, see [llms.txt](https://help.datadefender.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.datadefender.io/getting-started/linking-onedrive-and-sharepoint.md). # Linking OneDrive and Sharepoint Use this guide to connect your Microsoft OneDrive and SharePoint environments to DataDefender. Connecting Microsoft 365 allows DataDefender to safely inventory personal and shared drives, run continuous security posture checks, and classify sensitive content across your organization. {% hint style="warning" %} **Azure Scanning Dependency**\ To scan and classify file content inside OneDrive and SharePoint, you must also connect an Azure Subscription within the same tenant that has **OneDrive/SharePoint Scanning** enabled. That Azure connection provisions the private compute environment that reads and classifies the data. Go here for more details: [Linking Azure Subscriptions](/getting-started/linking-azure-subscriptions.md) {% endhint %} #### Before You Begin (Prerequisites) Connecting OneDrive and SharePoint requires administrative access across your Microsoft 365 tenant and a local deployment environment. Before starting the setup inside DataDefender, ensure you have: * **Tenant Administrative Access:** A Microsoft Entra ID (formerly Azure AD) account with `Global Administrator` or `Privileged Role Administrator` privileges to grant tenant-wide admin consent for Graph API permissions. * **Terraform CLI:** Terraform (`v1.3.0` or higher) installed and configured on your local machine or CI/CD runner. * **Azure CLI:** Azure CLI (`az`) installed and authenticated to your target tenant via `az login --tenant `. * **Microsoft Entra Tenant ID:** Your unique directory identifier. If you need help finding this, refer to [Microsoft's Tenant ID Guide](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). #### Connection Instructions **Step 1: Navigate to Cloud Connectivity**
* Log in to DataDefender. * In the left navigation menu, go to **Settings -> Cloud Connectivity**. * Click **Add New Connection**. * Select **OneDrive / SharePoint** from the provider options to open the connection wizard. **Step 2: Download the Terraform Module**
* In the setup wizard, click **Download Terraform Package** to download the dedicated M365 deployment files. * Unpack the downloaded `.zip` file into your local working directory. **Step 3: Deploy the Terraform Module** Deploy the module to register the required enterprise application and configure Federated Identity Credentials (FIC) in your Entra tenant. **1. Authenticate to Azure CLI** Open your terminal and ensure your CLI session targets the correct Microsoft 365 tenant: ```bash az login --tenant YOUR_ENTRA_TENANT_ID ``` **2. Initialize Terraform** Navigate to your unzipped directory and initialize the provider plugins: ```bash terraform init ``` **3. Execute the Deployment** Copy the pre-populated `apply` command directly from the DataDefender setup page and execute it: ```bash terraform apply -var 'entra_tenant_id=YOUR_ENTRA_TENANT_ID' -var 'organization_id=ORGANIZATION_ID' -var 'fic_subject=datadefender.orgEntra.ORGANIZATION_ID' -var 'fic_issuer=[https://auth.datadefender.io/realms/datadefender](https://auth.datadefender.io/realms/datadefender)' ``` **4. Confirm Execution** Review the proposed resources in your terminal and type `yes` to perform the deployment and consent registration. **Step 4: Configure Connection Details** Once Terraform finishes applying, populate the setup form fields in the DataDefender console using your deployment outputs: * **Account Name (Optional):** Enter a friendly display label for this environment (e.g., `Corporate M365 Production`). * **Tenant ID:** Enter your Microsoft Entra Tenant ID. * **Backend Application Client ID:** Enter the `backend_app_client_id` string printed in your terminal output: ``` Outputs: backend_app_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" ``` **Step 5: Connect and Verify** * Review your entered values for accuracy. * Click **Connect & Verify**. DataDefender will perform an immediate automated handshake via Federated Identity Credentials (FIC) to confirm API connectivity and verify Microsoft Graph permissions across your OneDrive and SharePoint drives. #### Troubleshooting & Common Issues | Issue | Likely Cause | Resolution | | --------------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Consent Missing | Non-admin deployment session | Ensure the user running the Terraform script or approving the app registration holds Global Administrator permissions to grant Microsoft Graph application scopes. | | Authentication Failed (FIC Error) | Mismatched Subject or Issuer URL | Confirm that the fic\_subject and fic\_issuer values used in your terraform apply command match the exact strings shown in your DataDefender portal without trailing spaces. | | Content Scanning Inactive | Missing Azure scanning compute | Verify that you have linked at least one Azure subscription within the same tenant with the OneDrive / SharePoint Scanning toggle enabled. | | Tenant ID Not Found | Multi-directory account mismatch | Confirm your CLI is pointed to the directory containing your OneDrive/SharePoint instances by running az account show and inspecting the tenantId value. |