OneDrive and CodeWords: automating inside Microsoft 365

The first thing to understand about automating OneDrive is that OneDrive is not really a separate product. A personal OneDrive, a SharePoint document library, and the Files tab of a Teams channel are all drives in Microsoft Graph, reached through the same endpoints with different identifiers.

Once that clicks, a lot of confusion resolves — particularly the common experience of an automation working perfectly against somebody's own OneDrive and finding nothing at all when pointed at the folder the team actually uses.

What we'll cover

• One system, three names
• What Microsoft Graph reaches
• Permissions, which are the hard part
• Connecting it to CodeWords
• Seven automations worth building
• Delta queries instead of listing everything
• Reading what is inside the documents
• Building it so it survives
• Limits worth knowing about
• What to build first
• Frequently asked questions

One system, three names

A personal OneDrive is the drive belonging to a user, reached through that user's identity.

A SharePoint document library is a drive belonging to a site. Most shared team content lives here, not in anybody's OneDrive, and this is where automation usually needs to point.

A Teams channel's Files tab is a folder in the document library of the site backing that team. There is no separate Teams file store.

Shared with me is a view rather than a location. The files are in somebody else's drive, and an automation reaching them needs permission on the original.

The practical consequence: an automation described as "watch our shared folder" nearly always means a SharePoint document library, which needs the site and drive identifiers rather than a user's drive. Resolving those once and recording them saves a great deal of confusion later.

What Microsoft Graph reaches

Files and folders can be listed, read, created, moved, copied, and deleted across any drive the credentials reach.

Delta queries return what has changed since a previous token, which is the right way to detect changes and is covered below.

Metadata and custom columns — SharePoint document libraries can carry columns beyond the file itself, which is where useful classification often lives and which is invisible if you only look at files.

Versions can be listed and restored, which supports auditing and recovery.

Sharing links can be created with defined scope and expiry, though whether particular link types are permitted depends on tenant policy.

Search covers drives the credentials can reach.

Webhooks notify on changes to a drive, which pairs with a delta query to find out what actually changed.

Large file uploads use an upload session, chunked, rather than a single request.

Permissions, which are the hard part

Most of the difficulty in Microsoft 365 automation is here rather than in the file operations.

Delegated versus application permissions. Delegated acts as a signed-in user and sees what that user sees. Application acts as itself with no user context — and by default that means access to every drive in the tenant, which is usually far more than intended.

Narrow application access where you can. Microsoft supports restricting an application's file access to specific sites, and a tenant administrator can apply it. Ask for that rather than tenant-wide access; the request is much easier to get approved and the blast radius is much smaller.

Admin consent is required for application permissions. Plan for the conversation rather than discovering it mid-build.

Sensitivity labels and retention policies can prevent operations that would otherwise succeed, and the resulting errors are not always obvious about the cause.

Conditional access policies can block a connection based on location or device, which is worth checking when authentication fails for no apparent reason.

Connecting it to CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: which drive or library, which folder, and what to do with files arriving there.
3. Authorize the connection, using application permissions restricted to the specific sites where possible.
4. Describe the exceptions: a file still uploading, a duplicate name, a document that is locked or labelled.
5. Test against a copy of the library before pointing anything at the real one.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Seven automations worth building

Intake processing. A document arrives in a watched folder, its content is read, the relevant fields are extracted, and a record is created in the system that should hold it. The commonest useful case, and the reason most people start.

Filing by content. Move or rename based on what the document is rather than what it was called when somebody saved it, and populate the library's columns while you are there.

Column population. SharePoint libraries have metadata columns that nobody fills in. An automation reading the document and setting them makes the library's own views and filters work, which changes the library from a folder tree into something searchable.

Retention and cleanup reporting. Files untouched beyond a threshold, oversized libraries, and duplicates, reported rather than deleted.

External sharing audit. Which files have sharing links, to whom, and which of those links have no expiry. Most tenants discover something here they would rather not have.

Cross-system copying. Contracts into the CRM record, invoices into the accounting system, so the document is attached where people look for it rather than only where it was saved.

Permission drift reporting. Where permissions on a folder differ from its parent, which is how private material ends up visible without anybody intending it.

Delta queries instead of listing everything

Listing a whole library to find what changed is the approach people reach for first and it scales badly.

A delta query returns changes since a token, including additions, modifications, moves, and deletions. The first call establishes a baseline and every subsequent call is small.

Store the token durably after processing rather than before, so a failure mid-run does not skip changes permanently.

Deletions appear in the delta, which simple listing cannot tell you at all.

Pair it with a webhook if you need promptness: the notification tells you something happened, and the delta query tells you what.

Expect an expired token occasionally. The response indicates it, and the recovery is a fresh baseline rather than an error — handle it deliberately rather than crashing.

Reading what is inside the documents

Most useful file automation is not about moving files. It is about knowing what they say.

Office formats are structured, so extracting text and tables from a Word document or a spreadsheet is reliable rather than approximate.

Graph can convert files to PDF, which is a convenient route to a consistent rendering when a downstream system wants one format.

Scanned PDFs are images. A PDF that came from a scanner or a phone has no text layer, and anything reading it needs optical character recognition. Deciding what happens to those is a design decision, not an edge case.

Password-protected files cannot be read and should be reported rather than retried.

Extract to fields, not to a blob. The value is a structured record — supplier, amount, date, reference — that another system can use, not a wall of text attached to a record.

Report low confidence rather than guessing. A document the automation could not read properly should surface for a person, because a confidently wrong field is worse than an empty one.

Building it so it survives

Wait for uploads to finish. A file appearing does not mean it is complete, and a large document synced from a desktop client can be readable and partial. Check that the size has stopped changing before processing.

Make it safe to run twice. Record the item identifier and version of anything processed, since webhooks deliver more than once and a re-sync can resurface a file.

Handle name conflicts deliberately. Decide whether to replace, rename, or fail, and say so, because the default may not be what you want.

Use upload sessions for large files rather than expecting a single request to carry them.

Report the outcome. Files processed, skipped, and failed, with the reason. Silence from a file automation is indistinguishable from an empty folder.

Limits worth knowing about

Throttling is real and it is dynamic. Graph returns a retry hint and an automation ignoring it will be throttled harder. Respect the hint rather than retrying immediately.

Path length limits apply in SharePoint, and deeply nested folders with long names hit them, which produces a failure that looks inexplicable until you count the characters.

Some characters are not permitted in names, and a file named from an email subject will eventually contain one.

Library view thresholds affect very large libraries, where some operations degrade or fail past a size limit.

Checked-out documents cannot be modified, and somebody leaves documents checked out permanently in every organisation.

What to build first

The external sharing audit: which files have sharing links, who can use them, and which have no expiry. It is read-only, it needs only read permission, and in most tenants the first run finds links created years ago for a purpose long since finished.

Two habits make the difference. Report it as a list for review rather than revoking anything automatically, since some of those links are load-bearing. And run it against a SharePoint library rather than a personal OneDrive, because that is where the shared material lives and where the surprises are.

Frequently asked questions

Why can my automation not see our team's shared folder?

Because it is almost certainly a SharePoint document library rather than a OneDrive, and it needs the site and drive identifiers. Teams channel files are the same thing — a folder in the document library of the site backing the team.

Should I use delegated or application permissions?

Application permissions for anything unattended, restricted to specific sites where your administrator can apply that. Delegated permissions make sense when the automation should see exactly what one person sees, and they require that person's sign-in.

How do I detect changes without listing everything?

Delta queries. They return what changed since a stored token, including deletions, and they stay cheap as the library grows. Add a webhook if you need the change noticed promptly rather than on a schedule.

Why does processing sometimes get a partial file?

Because the file appeared before the upload finished, which is common with desktop sync and large documents. Check that the size is stable before reading, or process on a short delay.

Can an automation write SharePoint metadata columns?

Yes, and it is the most underrated thing here. Columns populated from the document's own content make the library's views and filters genuinely useful, which is the difference between a searchable library and a folder tree nobody navigates.

What causes intermittent throttling errors?

Graph throttles dynamically based on tenant load as well as your own volume. Honour the retry hint in the response rather than retrying immediately, spread work out, and use delta queries so you are making far fewer requests in the first place.

Does this work with files stored in Teams?

Yes, because those files are in SharePoint. Point the automation at the document library of the site backing the team, into the folder named after the channel.

Can an automation read the contents of documents in OneDrive?

Yes — Office formats are structured and extract reliably, and Graph can convert files to PDF where a consistent rendering helps. Scanned PDFs have no text layer and need optical character recognition, which is worth planning for rather than discovering.

What should happen to a document the automation cannot read?

Report it for a person to handle, with the reason. Password protection, a scan of poor quality, and an unexpected format are all common, and a confidently wrong extraction is more damaging than an obvious gap.

Related reading

• Dropbox and CodeWords
• Box and CodeWords
• CodeWords integrations and templates