OneDrive Setup

This guide walks through creating an Azure AD app registration to connect Microsoft OneDrive as a storage backend for BAP.

Prerequisites

• A Microsoft account (personal or work/school)
• Access to the Azure Portal

Step 1: Register an Application

1. Go to Azure App Registrations
2. Click "New registration"
3. Fill in:

Setting	Value
Name	BAP Storage (or any name)
Supported account types	Accounts in any organizational directory and personal Microsoft accounts
Redirect URI (Web)	Your BAP OAuth callback (see below)

4. Click "Register"

Redirect URI

Environment	Redirect URI
Development	http://localhost:8080/api/storages/oauth/callback
Production	https://yourdomain.com/api/storages/oauth/callback

Step 2: Get Application (Client) ID

1. After registration, you'll land on the Overview page
2. Copy the Application (client) ID — this is your Client ID
3. Save it — you'll need it for BAP

Step 3: Create a Client Secret

1. In the left sidebar, click "Certificates & secrets"
2. Under "Client secrets", click "New client secret"
3. Add a description (e.g. BAP) and choose an expiry (recommended: 24 months)
4. Click "Add"
5. Immediately copy the Value — it's only shown once
6. Save it — this is your Client Secret

Step 4: Configure API Permissions

1. In the left sidebar, click "API permissions"
2. Click "Add a permission"
3. Select "Microsoft Graph"
4. Select "Delegated permissions"
5. Search for and enable:

Permission	Description
Files.ReadWrite.All	Read and write all files the user can access
offline_access	Maintain access to data (for refresh tokens)

6. Click "Add permissions"
7. If you see a "Grant admin consent" button and have admin access, click it (optional for personal accounts)

Step 5: Verify Settings

Your app should now have:

Setting	Value
Application (client) ID	xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Client secret	The value you copied in Step 3
Redirect URI	Your BAP callback URL
API permissions	Files.ReadWrite.All, offline_access

Important Values for BAP

Value	Where to Find
Application (Client) ID	Overview page
Client Secret	Certificates & secrets → Client secrets → Value
Redirect URI	Authentication → Redirect URIs

Troubleshooting

"AADSTS50011: The redirect URI does not match"

• The redirect URI in BAP must exactly match what's registered in Azure
• Check protocol (http vs https), domain, port, and path
• Trailing slashes matter

"AADSTS7000215: Invalid client secret"

• Client secrets expire — check the expiry date in Azure Portal
• Make sure you copied the Value, not the Secret ID
• Create a new secret if the old one expired

"Insufficient privileges"

• Verify Files.ReadWrite.All is listed under API permissions
• For work/school accounts, an admin may need to grant consent
• For personal accounts, consent is granted during the OAuth flow

"AADSTS700016: Application not found"

• Double-check the Application (Client) ID
• Ensure the app registration is in the correct Azure AD tenant
• If using "Accounts in any organizational directory", the app must be multi-tenant

Security Notes

• Keep your Client Secret secret — never commit it to version control
• Rotate secrets before they expire (Azure shows expiry dates)
• Use delegated permissions (not application permissions) — BAP acts on behalf of the user
• Limit scope — Files.ReadWrite.All is the minimum needed; don't add unnecessary permissions

Personal vs Work/School Accounts

Account Type	Notes
Personal (Outlook.com, Hotmail)	Works immediately; consent granted during sign-in
Work/School (Microsoft 365)	May require admin consent for Files.ReadWrite.All

For BAP, personal accounts are simpler. Work/school accounts may require IT admin approval.

Next Steps

• Return to Connecting Storage to complete the setup
• Add your Application ID and Client Secret in the BAP dashboard