Connecting OneDrive and SharePoint – mxHero Help Center

This page explains how to connect Microsoft OneDrive and SharePoint Online to mxHERO so rules can save emails and attachments there and replace attachments with links. It also covers the SharePoint and Microsoft Entra sharing settings each link type needs.

Before you begin

You need a Microsoft 365 tenant with OneDrive or SharePoint Online.
For the organization connection, you need a Microsoft Global Administrator to grant admin consent, and an Owner or Administrator of your mxHERO organization.
Decide which link types your rules will use. Each needs a SharePoint sharing level (see Allow the sharing your links need below). You may need a SharePoint Administrator to change it.

Choose a connection type

	OneDrive for Organization	Individual OneDrive account
Who connects it	A Global Administrator, once, by granting admin consent	Each user, through their own Microsoft sign-in
Where files go	Each sender's or recipient's own OneDrive, one account you choose, or a SharePoint site	The connected user's OneDrive
SharePoint sites	Yes	No
Keeps working when a user changes their password	Yes	No. The user must re-authorize.
Recommended for	Production rules	Tests only

Note: When you pick an individual account in a rule, the dashboard shows an Important Note that individual tokens can expire without notice. Use OneDrive for Organization whenever you can.

Connect OneDrive for Organization

Sign in to the Admin Dashboard and open Settings › Integrations.
On the Applications tab, find OneDrive for Organization ("Verify your connection with OneDrive storage service"). Its status is Not installed.
Click Install.

A Microsoft sign-in window opens.
Sign in as a Global Administrator of your tenant.
Review the permissions Microsoft lists and click Accept to grant consent for your whole organization.

Microsoft lists the permissions mxHERO requests. They include read access to SharePoint sites and read and write access to files.

The card shows the connection as installed and offers Re-install. mxHERO saves your tenant and from now on uses an app-only token to act on users' OneDrive and on SharePoint sites.

Note: Office365 Mailbox on the same tab is a separate card, used for mailbox rules. Check its status separately if you also use mailbox rules. See Office 365 Directory and Mailbox Access.

Map users to OneDrive accounts (if needed)

When a rule uses OneDrive for Organizations with Automatically select the storage account based on sender/recipient, mxHERO uses the OneDrive of the user whose sign-in name matches the sender's or recipient's email. If a user's Microsoft sign-in name differs from their email address, open Settings › Accounts and Groups, click Edit on the account, enter it in OneDrive for Organizations Account, and click Save. You can also fill the onedriveAccount CSV column. See Managing Accounts.

Store files in a SharePoint site

With OneDrive for Organizations you can send a rule's files to a SharePoint site (document library) instead of each user's OneDrive.

In SharePoint, create the site (for example a private Team site). mxHERO's app can see every site in your tenant, so you don't add mxHERO as a member.
In the rule's Cloud Storage step, select OneDrive for Organizations in Cloud Storage Account.
Open Advanced Options and select the site from the list of SharePoint sites.

Once a site is selected, the folder picker in Storage Filepath is hidden and the path starts at the site's library root.
Finish the rule as usual.

The site list is not offered when the rule uses Send the same copy of the content and attachment links to all recipients. Copy Policies can also send files to a SharePoint site. See Copy Policies.

Note: Everyone with access to the site can see all files saved there. To keep each user's files apart, start the Subfolder path with {Storage User Id} and give each user access only to their own folder.

You no longer need SharePoint Site IDs or Web IDs. The site picker replaces the SITE_ID,WEB_ID field from the old dashboard.

Microsoft must allow each type of link your rules create. Settings are in the SharePoint admin center › Policies › Sharing (organization level) and SharePoint admin center › Sites › Active sites › site › Settings › More sharing settings (site level). A site can't be more permissive than the organization. See Microsoft's Manage sharing settings.

mxHERO link type	Minimum SharePoint/OneDrive external sharing level
Public access links (anyone with the link)	Anyone
Organization access links (Company)	Only people in your organization is enough
Recipients access links	New and existing guests
Folder collaborators (no shared link)	Any level

Set the level for SharePoint and for OneDrive (the OneDrive level can't be higher than SharePoint's), and for the specific site if you use one.

Recipients access links and Microsoft Entra B2B

For Recipients access links, mxHERO grants each recipient access to the file without sending a Microsoft invitation email. If the recipient is outside your tenant, mxHERO first creates a Microsoft Entra B2B guest account for them (no invitation email; redirect to My Apps). The recipient opens the file from the link in the email and must sign in to see it.

For this to work:

External sharing must be New and existing guests or Anyone (above).
Your tenant must allow guest invitations by the mxHERO app. In the Microsoft Entra admin center, open Entra ID › External Identities › External collaboration settings and check that Guest invite settings is not set to No one in the organization can invite guest users including admins (most restrictive), and that Collaboration restrictions don't block your recipients' domains.
If you connected OneDrive for Organization before August 2026 and recipient links fail with access errors, click Re-install on OneDrive for Organization to grant consent again.

New guests can take a moment to replicate in Microsoft Entra. mxHERO retries the message automatically (Email Flow Logs shows onedrive_guest_not_replicated).

Connect an individual OneDrive account

Open Settings › Integrations › Accounts.
Click Add Account, then select OneDrive.
Pick the Microsoft account to connect, sign in, and accept the permissions.

The account appears with provider OneDrive, type Storage Service and status Synced. If your tenant requires admin approval for user-consented apps, a Global Administrator must approve the request first.

Verify

On Settings › Integrations › Applications, OneDrive for Organization no longer shows Not installed.
In a rule's Cloud Storage step, OneDrive for Organizations is listed as Synced in Cloud Storage Account. If it shows Not synced with an Authorize button, the consent is missing.
Send a test message, then check that the file is in OneDrive or the SharePoint site and that the link opens for an external test recipient. See Testing Mail Flow.

Link and security options for OneDrive and SharePoint

Public, Company and recipient links are supported.
Expiration works for Public and Company links. With OneDrive for Organization, mxHERO also removes the permission when the link expires.
Passwords work for Public links only.
Prevent download is not available.
Recipient roles are fixed by mapping: Co-owner gives full control, Editor gives write, Viewer and Previewer give read.

Settings › Integrations › Storage settings has the switch OneDrive/Sharepoint direct download links UI dependent. When it is on, download links start the download directly instead of opening the file, but they depend on Microsoft's web interface and may break if Microsoft changes it. Microsoft doesn't support this kind of download link for password-protected links on SharePoint sites, so mxHERO leaves the download link out in that case.

See Link Security Options by Provider.

How OneDrive and SharePoint behave

Large files. Files smaller than 4,096,000 bytes (about 4 MB) are uploaded in one request. Larger files use a Microsoft Graph upload session (chunked upload), so large attachments are supported.
Existing files. By default a file with the same name is replaced. With Do not overwrite existing files on, Microsoft renames the new file.
Names and paths. mxHERO removes # and other characters SharePoint doesn't accept. See File and Folder Naming Rules. Microsoft limits the full path of a file, so keep folder patterns short.
Metadata. OneDrive and SharePoint don't receive mxHERO metadata or template metadata.
Throughput. Up to 8 uploads at a time per account. See Storage Load Balancing.

Troubleshooting

Symptom or code	Cause	Fix
Install ends with an "access denied" error (`ACCESS_DENIED`) or `FALSE_ADMIN_CONSENT`	Consent was cancelled, or the person signing in is not a Global Administrator.	Click Install again and sign in as a Global Administrator. Click Accept.
All OneDrive uploads fail with `access_token` or `organization_or_tenant_not_found`; all mxHERO users get "mxHero requires authentication to …"	The admin consent was removed in Microsoft Entra, or the tenant is no longer linked.	Click Re-install on OneDrive for Organization and grant consent again.
Recipient can't open a Recipients access link; Email Flow Logs show `onedrive_accessDenied` or a sharing error	Guest sharing is off for the tenant, OneDrive or the site, or guest invitations are blocked in Microsoft Entra.	Allow New and existing guests and check External collaboration settings (above). Then Re-install if needed.
Public link says the link doesn't work or requires sign-in	Anyone links are not allowed at the organization or site level.	Set the level to Anyone, or use Company or recipient links.
`onedrive_guest_not_replicated`	A new guest account is still replicating.	No action. mxHERO retries. If it persists for hours, check Entra guest settings.
`drive_resolution`	mxHERO could not find the OneDrive or library to write to.	Check that the user has a OneDrive (license assigned and OneDrive set up) or that the SharePoint site still exists, or map a different account.
`upload_conflict`	A file with the same name was being written at the same time.	No action. mxHERO retries.
Individual account shows Not synced	The user's token expired or was revoked.	Re-authorize the account. See Re-authorizing Storage Accounts.

For other upload errors, see Storage Upload Failures.