# OneDrive and SharePoint

> Connect OneDrive and SharePoint so reviews read the Word documents and PDFs a pull request links to or that you pin, read-only and cited.

When a pull request, or the issue it implements, contains a OneDrive or SharePoint sharing link, MergeHarbor reads the file and gives it to the review as the specification for the change. You can also pin files that every review of a repository should read.

## What it does in reviews

- **Reads only what is referenced.** MergeHarbor looks for sharing links (`*.sharepoint.com`, `onedrive.live.com`, `1drv.ms`) in the pull request title, description and branch, and in the descriptions of its linked Jira, Linear and Asana issues, plus the files pinned for the repository. It never lists or crawls your drives and sites.
- **Converts the file to text.** Word documents (`.docx`) are converted by MergeHarbor with a size-limited extractor, PDFs likewise, and other Office formats (PowerPoint, Excel, older Word files) are converted to PDF by Microsoft Graph first. Text files are read as they are. Each file is trimmed to about 8,000 characters, and at most two files are read per pull request and per issue by default.
- **Uses it as the specification.** Files linked from the pull request, and pinned files, are sent to the review as the documents describing the change; files linked from an issue are added to that issue. Text that looks like a secret is redacted before it reaches the model.
- **Costs no extra model call**, and **cites what it used** under **Docs read** and in "Source used:" links.

## Connect

1. In the console, open **Integrations** and choose **Connect** on **OneDrive / SharePoint** (under **Docs & knowledge**). You need the `settings.manage` permission.
2. Sign in with your work or school account and accept the permissions: sign you in and read your profile, read files you can access, and keep access (`offline_access`). Some organizations require an administrator to approve the app first.
3. Optionally, open **Settings** and paste sharing links of files to pin, choosing **Read for** all repositories or one repository.
4. Choose **Test connection**.

MergeHarbor reads a file only if the account that connected can open it. Use an account that can see your specs, or share them with it.

## What is read and stored

- File name, link, last modified time and text. Text is cached for a short time (10 minutes by default), deleted within 24 hours, and never written to logs. If an administrator turns on **Keep linked documents in the knowledge base**, text that [issue triage](https://mergeharbor.com/docs/issue-triage) reads is kept for the days they choose (1–365) after last use instead.
- The connection is named after your Microsoft 365 organization. Tokens are encrypted at rest and never shown again.
- In **Settings**, you can limit the integration to some repositories.

## Disconnect

Open the integration in **Integrations** and choose **Disconnect**. MergeHarbor deletes its tokens, pins and cached text. Microsoft has no way for MergeHarbor to revoke its access itself: remove the app at [myapps.microsoft.com](https://myapps.microsoft.com), or an administrator removes it under **Enterprise applications** in Microsoft Entra.

## Self-hosted installations

Register an app in Microsoft Entra (step by step in `docs/OAUTH_APPS.md`, "OneDrive and SharePoint connections"): platform **Web** with the redirect URI `{PUBLIC_URL}/integrations/connect/onedrive/callback`, a client secret, and the delegated Microsoft Graph permissions `offline_access`, `User.Read` and `Files.Read.All`. Set `ONEDRIVE_OAUTH_CLIENT_ID`, `ONEDRIVE_OAUTH_CLIENT_SECRET` and, for a single tenant, `ONEDRIVE_OAUTH_TENANT` (default `organizations`). `ONEDRIVE_SITES_READ_ALL=true` also requests `Sites.Read.All`, which needs admin consent. OneDrive / SharePoint stays hidden in the console until the client ID and secret are set.