25.26.2.Grant permissions for the OneDrive archive
In this section, we describe step by step how to grant permissions for the OneDrive archive, which enables contentACCESS to authenticate and connect to the Microsoft Dataverse environment using a modern and more secure way of authentication.
1) Navigate to your registered application (Azure Active Directory => App registration => Owned applications => registered application [Test_app in our example] => open the application by clicking on the title). On the application details page, click the API permissions button on the left menu. When the configured permissions page loads, click the + Add permission button and select the requested API.
2) On the Request API permissions => Microsoft APIs tab, you require permissions from Microsoft Graph for accessing the OneDrive archive, enabling the capability to read the OneDrive sites/accounts of users.
3) After selecting the option from the list, choose the Application permissions box, where the available permissions from this category will be shown.
4) Locate the:
- Files.ReadWrite.All (read and write files in all site collections) permission from Files option;
- Sites.Read.All and Sites.ReadWrite.All (read and write items in all site collections) options from the Sites option
then click the Add permissions button.
5) After the permissions have been assigned to the application, the administrator must grant consent for these permissions. Click on the Grant admin consent for “TENANTNAME” button.
6) When the permissions are assigned to the application and the admin consent is granted, the client access certificate needs to be assigned to the application. Click on the Certificates & secrets option in the left side menu. On the certificate management screen click on the Upload certificate (Certificates tab) button. Browse the client certificate you want to use and upload it. It can be a self-signed certificate or an already existing one. A PowerShell script for creating a self-signed certificate can be downloaded here.
7) Next, add a new client secret by clicking on the + Next client secret button. This is necessary for some plugins and client applications (Test_client secret in our example).
After the configuration is done, copy the client secret shown on the Get client secret dialog box to a secure location so that you can refer to it later. The client secret will be required when configuring certain contentACCESS models with modern authentication– like Email archive, SharePoint archive, Teams archive, GDPR Exchange, and Exchange connection.