---
title: "How to Search OneDrive for Business"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-to-search-onedrive-for-business"
language: "en"
last_updated: "2026-10-12T22:23:30.890Z"
---

# How to Search OneDrive for Business

Follow this guide to set up Spirion Sensitive Data Platform to search OneDrive for Business

> **NOTE**: Spirion searches “OneDrive for Business” accounts and not regular “OneDrive” accounts.

Searching Microsoft OneDrive for Business with Spirion Sensitive Data Platform has never been easier.

Follow this guide to set up a successful search of OneDrive for Business using Spirion Sensitive Data Platform:

## Before You Search OneDrive

-   Spirion searches “OneDrive for Business” accounts and not standard “OneDrive” accounts
-   If you are searching OneDrive with an on-premises agent, Spirion requires an Azure enterprise application registered within the O365 tenant.  
-   -   The app is called “Spirion Azure App”
    -   Required Spirion Azure App **Roles** and **Permissions** are listed below
-   Spirion recommends you complete a test search using minimal accounts (one) to ensure that connectivity and settings are working properly
-   Spirion **does not recommend** scanning OneDrive as a locally logged-in user.  
-   -   If OneDrive is searched directly through the workstation or as a local, logged-in user, Spirion downloads the file and scans it locally
-   If you're scanning a **local OneDrive** and encounter shortcuts, Spirion will **download and scan** the actual file.

## Known Limitations

-   Spirion Sensitive Data Platform cannot scan **shared user folders** in Microsoft OneDrive. 
-   This is due to limitations of the **Microsoft Graph API**.

## Required User Account and Admin Roles

-   Searching OneDrive requires a service account with Admin privileges.
-   Permissions for the account are configured in the SharePoint Admin Center.
-   If you don’t have access to the Azure Admin Center, you can use a PowerShell script or else contact your SharePoint administrator.
-   Depending on your environment, the service account may need to be one of the following [administrator roles](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide): 
-   -   Global Administrator
    -   [SharePoint Administrator](https://learn.microsoft.com/en-us/sharepoint/sharepoint-admin-role)
    -   Site Collection Administrator
    -   (Rarely) Domain Administrator

### SharePoint Integration

**OneDrive for Business** is managed through the SharePoint Admin Center, requiring SharePoint Administrator permissions for administrative tasks like [accessing user profiles](https://learn.microsoft.com/en-us/answers/questions/5829142/onedrive-access-for-sharepoint#:~:text=Granting%20or%20revoking%20access%20to,also%20requires%20SharePoint%20admin%20permissions.), managing site collection owners, or setting data retention.

-   While users don't need a SharePoint admin for daily file saving, IT tasks require this role.

#### Key Administrative Requirements

-   **Access Management**: To add a manager to an employee's OneDrive, a SharePoint Admin must manage user profiles via the SharePoint Admin Center.
-   **Pre-provisioning**: Setting up OneDrive accounts for users requires a SharePoint Administrator.
-   **Site Management**: Because OneDrive operates on top of SharePoint, managing site collection administrators for a user's personal drive requires SharePoint admin privileges.
-   **Alternative Support**: For minor tasks (not full management), Help Desk staff can sometimes use the [Microsoft 365 Admin Center](https://learn.microsoft.com/en-us/answers/questions/5829142/onedrive-access-for-sharepoint) to provide access to files.

Ultimately, Microsoft has consolidated OneDrive administration into the SharePoint Online ecosystem.

## Roles and Permissions Required for the Spirion Azure App

Note that the Spirion Azure app is used to connect to the following applications:

-   **Exchange Online**
-   **OneDrive for Business**
-   Spirion **Microsoft Purview** integration

Roles and permissions required by the **Spirion Azure App** are listed below.

### OneDrive for Business API Permissions

Ensure the following API (Microsoft Graph) permissions are granted for your Spirion Azure App:

-   **Directory.ReadWrite.All** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read and write data in the organization directory accessible to the service account. Does not permit user or group deletion.
-   **Files.ReadWrite.All** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read, create, update, and delete all files the service account user can access.
-   **Sites.ReadWrite.All** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to edit or delete documents and list items in all site collections accessible to the service account.
-   **Sites.Selected** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables app-only access to specific SharePoint Online sites, rather than the entire tenant.
-   **User.Read** 
-   -   Type: Delegated
    -   Admin consent required: No
    -   Description: Enables the app to read basic company information of users.
-   **User.ReadWrite.All** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read and write all properties of user profiles.
-   **User.ReadWrite.CrossCloud** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read and update external cloud user profiles without a signed in user.
-   **UserAuthenticationMethod.ReadWrite.All** 
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables an app to read and write authentication methods like phone numbers and Authenticator settings, but not passwords or sign-in.

## Roles and Permissions Required to Authenticate Cloud Scans

To authenticate Cloud Storage scans for OneDrive for Business, Spirion recommends you create the following accounts and roles:

-   A **service account with the SharePoint Admin role**
-   The **Global Admin** role (temporarily)\*

\*The reason for temporary Global Admin role is the initial authorization process creates a “Spirion Azure App” our system uses to connect to the tenant. Once this App is created, the **Global Admin role can be removed**.

![Manage_admin_roles_window](https://cdn-assets.productfruits.com/238ef3d3-4428-4e40-b6ba-ee4df617b493)

## How to Create a Service Account

Use the following steps to create a new O365 service account:

1.  Create a new Office 365 user account.
2.  Assign **Global Admin** rights to it. 
3.  -   To add another admin see [How to add another admin](https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d)
    -   **Optional**: Assign the **eDiscovery Manager** role (if needed). [Assign eDiscovery permissions](https://docs.microsoft.com/en-us/exchange/security-and-compliance/in-place-ediscovery/assign-ediscovery-permissions)

## How to Assign Permissions to the Service Account

### Option 1: Use the SharePoint Admin Center (Recommended)

Use this method if you have access to the Microsoft Admin Center.

1.  Go to: [Manage Site Collection Admins](https://docs.microsoft.com/en-us/sharepoint/manage-site-collection-administrators)
2.  Add your service account as a **Site Collection Admin** for each OneDrive account that you want to scan.

### Option 2: Use a PowerShell Script (Alternative)

If you cannot use the Microsoft Admin Center the following steps guide your through using a PowerShell script:

1.  Install the SharePoint Online Management Shell using [Microsoft documentation](https://docs.microsoft.com/en-us/powershell/sharepoint/sharepoint-online/connect-sharepoint-online?view=sharepoint-ps)
2.  Download the script named **AdminRights.ps1** script
3.  Open the script in Notepad.
4.  Edit the following four variables and enter your information: 
5.  -   **$o365login** – Your service account username
    -   $**o365pw** – Your service account password
    -   $**spAdminURL** – SharePoint admin URL 
    -   -   **Example**: https://yourdomain-admin.sharepoint.com
    -   $**spMyURL** – OneDrive URL 
    -   -   **Example**: https://yourdomain-my.sharepoint.com
6.  Save and close the file.
7.  Run the script using the following steps: 
8.  1.  Right-click on **SharePoint Online Management Shell** and click "Run as Administrator"
    2.  Change your directory to the directory which contains the **AdminRights.ps1** script
    3.  Run the following command: 
    4.  1.  `Set-ExecutionPolicy Unrestricted`
    5.  Next, run the following command: 
    6.  1.  `.\AdminRights.ps1`
9.  Press **Enter** to exit once complete.

## How to Create a OneDrive Target in Spirion Sensitive Data Platform

Use the following procedure to create a OneDrive Target in Spirion Sensitive Data Platform. During this process you perform the following high-level steps:

-   Create a new Target
-   Authenticate with OneDrive
-   Login to O365
-   Authorize claims to create the Spirion Azure app

> **Note**: For OneDrive Targets that authenticate using the user-configured Azure app, this requires Spirion Agents version 13.5 or later. If you attempt to use this method with Agent versions earlier than version 13.5, an EPS failure occurs which requires the machine to be rebooted or other manual intervention.

Procedure:

1.  Login to Spirion Sensitive Data Platform
2.  Select “Data Asset Inventory” from the left side navigation menu.
3.  Select “Data Assets and Targets”
4.  Select the “TARGETS” tab at the top of the screen
5.  Select the blue **Actions** button in the top right corner and select “Add Target” from the sub-menu.
6.  Name your target in the “Target Name” field and select the “Cloud Sources” tile.  
    ![](https://cdn-assets.productfruits.com/39115341-e35e-4f11-a76d-eeeae12fbe0f)
7.  Select “OneDrive for Business” from the section "Cloud Source Type."  
    ![](https://cdn-assets.productfruits.com/1a13510b-33b6-4203-abd6-1d07ea1034f2)

## How to Configure OneDrive Targets to Use Spirion-Hosted Authentication

(For self-hosted authentication, see the topic "Self-Hosted Authentication" below)

1.  Enter the OneDrive **Admin user account name** and select **Use Spirion Hosted Authentication**  
    ![](https://cdn-assets.productfruits.com/4e080e04-cdd9-45ee-b254-5fdf33eb4ef8)
2.  Click **Authenticate**. 
3.  -   **NOTE**: Depending on how your tenant is configured in Azure Active Directory it’s possible this step needs either: 
    -   -   A higher-level permissioned user (Global Admin, Cloud Application Admin)
        -   Consent requests which may need to be approved by a specified user within the tenant
4.  This takes you to the Microsoft (Office 365) login page where you enter the same Admin user account from the previous step and complete the login process.  
    ![](https://cdn-assets.productfruits.com/48509098-a56f-43ec-b581-c2c4b0a46ca9)
5.  You are asked to authorize claims to create the “Spirion Azure App”.   
      
    **Note**: The **Spirion Azure App** is used for both **Exchange Online** and **OneDrive for Business** connectivity, as well as the Spirion **Microsoft Purview** integration. You are prompted to grant access to Spirion using the permissions described in the topic "Roles and Permissions for Spirion Azure App" above.
6.  Accept the claims. The Spirion Azure App is created. The browser page is redirected to a loopback page “127.0.0.1/code=xxxx”.
7.  Select and copy the entire URL.
8.  Within the Spirion Sensitive Data Platform Console browser window, paste the URL into the **Authentication Code** box.
9.  Click the **Save** button to create the Target.  
      
    ![](https://cdn-assets.productfruits.com/320d8d3e-6993-4949-99b5-f885d1fb3e65)
10.  Click **Save** at the bottom of the screen. 
11.  This completes the authentication process.

## How to Configure OneDrive Targets to Use Self-Hosted Authentication

Use the following steps to configure your OneDrive Target in Spirion Sensitive Data Platform to use self-hosted authentication:

1.  (This step is a continuation after step 7) – Select the **Self Hosted Authentication** radio button.  
    ![](https://cdn-assets.productfruits.com/0d389c02-3c5c-4dab-bedd-f0db8f15a27b)
2.  Enter the following information from your Azure App. (If you do not have an Azure App, see "Create an Azure App (Optional)" below): 
3.  -   **NOTE** - Your Microsoft Client ID, Microsoft Client Secret, Microsoft Tenant ID are found in your Microsoft Azure dashboard.  See the “Additional Information” section at the bottom of this document for instructions.
    -   **Client ID** – Enter your Microsoft Client ID
    -   **Client Secret** – Enter your Microsoft Client Secret
    -   **Tenant ID** – Enter your Microsoft Tenant ID
4.  Click **Save** to create the Target.
5.  Click **Save** at the bottom of the screen. 
6.  This completes the authentication process.

## Adjust the Service Account

-   The Spirion Azure App is now created (if you selected Spirion Hosted Authentication).
-   Remove the **Global Admin role** from the service account

### How to Create an Azure App (Optional)

If you do not have an Azure App, use the following instructions to create the app and record the information you need to create your OneDrive for Business Target.

**App Registration** procedure:

1.  Log in to the [Azure Portal](https://portal.azure.com/).
2.  Under "Azure services" search for and select **Microsoft Entra ID**.  
      
    ![](https://cdn-assets.productfruits.com/1160986d-fe34-43fd-9dde-dee0fa933d56)
3.  Select **App Registrations** under "Manage" on the left side menu. (Alternatively, click "Add application registration" under Quick Actions at the bottom of the page to jump to step 5.)
4.  Click **New registration**.
5.  Select one of the first two radio buttons based on your needs:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1754427131794.png)
6.  **Note**: Redirect URI is not required.
7.  Click **Register** at the bottom of the page.

**Note the IDs** Record the following information:

-   **Application (client) ID**
-   **Directory (tenant) ID**

**Certificates and Secrets** 

Procedure:

1.  From the left side menu, expand the "Manage" section and click **Certificates & secrets.**
2.  Click the "Client secrets" tab and click the + **New client secret** link above Description.   
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1754427614830.png)
3.  Enter an appropriate name.
4.  Record your Client Secret **Value** and **Secret ID**.  
    **NOTE**: You will not have access to your client secret again.

**How to Add API Permissions to Your Azure App** 

Use the following procedure to add the required API permissions to your Azure App (see "OneDrive for Business API Permissions" at the top of this page):

1.  One the left side menu, under Manage, select **API Permissions**.
2.  Click the **Add a permission** button.
3.  Select **Microsoft Graph** at the top of the collection of APIs.
4.  Select the **Application Permissions** box.
5.  In the **Select permissions** search field type the name of each permission to find it in the list and then select it. For example "Directory" will bring up Directory permissions. See below.
6.  Click the **Add permissions** button at the bottom of the pane.
7.  Repeat this process for each required permission.
8.  Grant **Admin consent** to the permission, if necessary.  
      
    ![Request API permissions](https://media.userguiding.com/files/knowledge-base/95602/file-1754427552496.png)

## How to Create a Scan in Spirion Sensitive Data Platform to Search OneDrive

Use the following steps to create a scan in Spirion Sensitive Data Platform to search OneDrive:

1.  Log in to Spirion Sensitive Data Platform.
2.  Select “**Scans**” from the left-side blue navigation menu.
3.  The **Scans** page opens.
4.  Select the blue “+**Add Scan**” button in the top right-hand corner:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751058640980.png)
5.  Provide a **Title** to the scan (for example: OneDrive Scan) and click the “Next” button.
6.  Select “Sensitive Data Scan”
7.  Select a **Playbook** to apply to the scan:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059663954.png)
8.  On the page "Select the target type to scan," select the “Cloud” target type:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059681495.png)
9.  On the screen "Select which cloud service to scan" select "OneDrive for Business” as the cloud service to scan:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059706154.png)
10.  **NOTE**: This step uses On-Premise agents to conduct searches.   
     For steps using a Cloud Agent go to step 13:  
       
     ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059826418.png)
11.  On the screen "Select the target(s) to scan" select the **OneDrive** target that was previously created:  
       
     ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059905917.png)
12.  Enter the **user accounts** that you would like to search.   
       
     ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751059972723.png)
13.  1.  **NOTE**: leaving this blank will search all OneDrive user accounts. 
     2.  The ability to import a list of OneDrive accounts is available by choosing “Upload Account List.” 
     3.  The .csv file to upload contains a simple one column table with OneDrive user accounts on separate lines as shown below. The table contains no title or header rows, and no formatting. If necessary, see your Professional Services or Support Consultant for an updated .csv template to upload accounts. 

| mark@test.com |
| --- |
| bob@test.com |
| jeff@test.com |
| bill@test.com |
| will@test.com |
| drew@test.com |
| draw@test.com |
| andy@test.com |
| kim@test.com |

1.  On the screen "Select the file type scan options" select the **file type scan options**. Use the blue tooltips for descriptions of each setting.  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751060208133.png)
2.  On the screen "Select advanced options" check the checkbox "Scan Only Changed Files" under **Search History** if it is not selected. This is the Differential Scanning feature and it is enabled, by default.  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751060319920.png)
3.  On the screen "Discovery Team Settings" select the level of logs to capture under Scan Logging and select the Discovery Agent to use to scan your configured targets for sensitive data locations (files which contain sensitive data) in the drop-down menu.  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751060400781.png)
4.  On the screen "Select the **Scan Schedule**" enter the date and time to run the scan as well as the recurrence schedule, if desired.  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751060467572.png)
5.  Select the users to receive notification when the scan completes (if any).  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751060555835.png)
6.  Review your scan **Summary**.   
      
    ![](https://cdn-assets.productfruits.com/bb22eb51-ae2c-4dc7-b268-f0e319efcde8)
7.  When done select “Finish and Save” to save and initiate the OneDrive scan.

## OneDrive Scan Results: 404 Errors

Be aware that the logs of OneDrive scans commonly display `404` errors, even when the scan completes successfully.

Unless you select only active, specific user accounts to scan, on the scan wizard page "Select which user accounts to scan," shown below, Spirion Sensitive Data Platform will scan all the user accounts on the OneDrive Target you specified in the scan wizard.  
  
![](https://cdn-assets.productfruits.com/ef69872b-ee1d-4ac7-b1dc-1b034c045804)

-   The `404` errors reflect OneDrive user accounts which are inactive. These user acounts are no longer active for reasons such as the user is no longer an employee of the organization.

Example error:

```
[2026-10-12 11:39:20] ERROR The OneDrive For Business cloud provider returned error after processing request (_404_,_Not Found_): /users/9d5ba74e-5ec5-4c3e-b7a0-fe7a0039d3c3/drive/items/root/children?$top=100 [2026-10-12 11:39:20] ERROR Unable to get folder contents for Microsoft OneDrive folder (Comm Error: Not Found. Auth Error: No Error:
```

-   Your Spirion Sensitive Data Platform OneDrive scan **is not adversely affected by these errors**. See the example IDF log (from the *\\Identity Finder\\Logs\\SystemSearch* folder), below.

![](https://cdn-assets.productfruits.com/b7320d03-009e-4712-a437-0bb5c02a532a)

-   To view errors in your log files, open a log file in a program such as Notepad++ and search for the term "ERROR." See the example below.  
      
    ![](https://cdn-assets.productfruits.com/5d79b242-52e4-4640-a206-91d14887936f)

## Additional Information

### How to Locate your Azure IDs

To create a new cloud Target for Microsoft OneDrive for Business or Office 365 you need the following information from Azure:

-   **Client ID** \- Also known as Application ID. See steps below.
-   **Client Secret** \- See the steps below in the topic "How to Create a New Client Secret or View an Existing Client Secret."
-   **Tenant ID** \- Also known as Directory ID. See steps below. Alternatively, use: [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)

They are all located in your **Microsoft Azure** dashboard.

### How to View Your Tenant ID

Use the following steps to view your Tenant ID:

1.  Sign in to the [Azure portal](https://portal.azure.com/).
2.  Browse to **Microsoft Entra ID** > **Properties**.
3.  Scroll down to the **Tenant ID** section. You can find your tenant ID in the Tenant ID field.
4.  Record your Tenant ID by clicking the copy icon to the right of the Tenant ID. Store the ID in a secure location.  
      
    ![](https://cdn-assets.productfruits.com/3e4e6a09-df0f-4c50-a9e4-4899fa9155d2)

### How to Create a New Client Secret or View an Existing Client Secret

Use the following steps to create a new client secret or view an existing client secret:

1.  Log in to your [Microsoft Azure account dashboard](https://portal.azure.com/).
2.  In the left panel, select **Azure Active Directory**.
3.  Under Manage in the left side menu, select **App Registrations**
4.  From the **App Registrations** panel, select your application. For example: OneDrive for Business.  
      
    **Note**: If you do not have an application in your Azure dashboard, your Azure administrator must create one. The application must have full permissions to function with Spirion Sensitive Data Platform. Consult with your Azure administrator for further information.
5.  **Access Certificates & secrets:** In the application's left-hand menu, click on Certificates & secrets.
6.  **View or create a new secret:** 
7.  -   If a client secret already exists and you have its value, it will be displayed in the "Value" column.
    -   If you need a new secret, click New client secret.
    -   Provide a description for the new secret and choose an expiration time.
    -   Click Add. The new secret's value will be displayed.
8.  **Important:** Copy the secret value immediately after creation. The value is only displayed once and cannot be retrieved later. If you navigate away from the page without saving the value, you will need to generate a new one. 

### How to Create a Client ID

Use the following steps to create a client ID:

1.  Log in to your [Microsoft Azure account dashboard](https://portal.azure.com/).
2.  In the left panel, select **Azure Active Directory**.
3.  Under Manage in the left side menu, select **App Registrations**
4.  From the **App Registrations** panel, select your application. For example: OneDrive for Business.
5.  On the application's Overview page, you'll find the **Client ID** (also referred to as Application ID) listed. You can also copy it to your clipboard from there.