Establishing a Connection

Configure a Connection Profile

From the CData ribbon, click Get Data and select From Microsoft OneDrive connection/s to launch the CData Query window. To setup a new connection, you will have to click the New Microsoft OneDrive Connection button. Here you can set the connection settings, test the connection, and save the connection profile.

Authenticating to Microsoft OneDrive

Microsoft OneDrive uses the OAuth authentication standard. To authenticate using OAuth, you will need to create an app to obtain the OAuthClientId, OAuthClientSecret, and CallbackURL connection properties.

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the add-in to access Microsoft OneDrive endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

You can authenticate from a desktop application using either the add-in's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered application, included with the add-in. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

AuthScheme: AzureAD.
InitiateOAuth:
- GETANDREFRESH: Use for the initial login. Launches the login page and saves tokens.
- REFRESH: Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the add-in opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the add-in retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

During the registration of your custom application, as described in Creating an Entra ID (Azure AD) Application, record the following values: client Id, client secret, and callback URL (redirect URI).

Then, set the following connection properties:

AuthScheme: AzureAD.
InitiateOAuth:
- GETANDREFRESH: Use for the initial login. Launches the login page and saves tokens.
- REFRESH: Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Azure Service Principal

Authentication as an Azure Service Principal is handled via the OAuth Client Credentials flow. It does not involve direct user authentication. Instead, credentials are created for just the application itself.

All tasks taken by the application are done without a default user context, but based on the assigned roles. The application access to the resources is controlled through the assigned roles' permissions.

For Azure Service Principal authentication, set AuthScheme to AzureServicePrincipal.

Creating an AzureAD App and an Azure Service Principal

If you will authenticate using an Azure Service Principal, you must first create and register an Azure AD application with an Azure AD tenant, as described in Creating an Entra ID (Azure AD) Application.

In the Azure portal, navigate to App registrations > API permissions. Select the Microsoft Graph permissions. There are two distinct sets of permissions: Delegated permissions and Application permissions. The permissions used during client credential authentication are under Application Permissions.

Assigning a role to the application

To access resources in your subscription, you must assign an appropriate role to the custom Azure AD application. Do the following:

Use the search bar to locate the Subscriptions service.
Open the Subscriptions page.
Select the subscription to which to assign the application.
Open Access control (IAM) and select Add > Add role assignment. The Add role assignment page opens.
Assign your custom Azure AD application the Owner role.

Setting the connection properties

The connection properties you set to connect with your custom Azure AD application will vary, depending on whether you want to authenticate using a Client Secret or a Certificate.

After you connect, authentication with client credentials takes place automatically like any other connection, except that no window opens to prompt the user. Because there is no user context, there is no need for a browser popup. Connections take place and are handled internally.

Client Secret Connection Properties

AuthScheme: AzureServicePrincipal.
InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.
AzureTenant: The tenant to which you want to connect.
OAuthClientId: The client Id in your custom Azure AD application settings.
OAuthClientSecret: The client secret in your custom Azure AD application settings.

Certificate Connection Properties

AuthScheme: AzureServicePrincipalCert.
InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.
AzureTenant: The tenant to which you want to connect.
OAuthJWTCert: The JWT Certificate store.
OAuthJWTCertType: The type of the certificate store specified by OAuthJWTCert.
OAuthJWTIssuer: The issuer of the Java Web Token.

Note: In most cases, OAuthJWTIssuer takes the value of the OAuthClientId property and does not need to be individually set.

Managed Service Identity (MSI)

If you are running Microsoft OneDrive on an Azure VM and want to automatically obtain Managed Service Identity (MSI) credentials to connect, set AuthScheme to AzureMSI.

User-Managed Identities

To obtain a token for a managed identity, use the OAuthClientId property to specify the managed identity's client_id.

If your VM has multiple user-assigned managed identities, you must also specify OAuthClientId.

Connection Properties

The Connection properties describe the various options that can be used to establish a connection.

Managing Connections

After successfully authenticating to Microsoft OneDrive you will be able to customize the data you are importing. To learn more about this, see Managing Connections.

Excel Add-In for Microsoft OneDrive