Files

• OneDrive
• Recent Files
• Files Shared with Me

OneDrive

• Access Token Resource: https://graph.microsoft.com
• Required Scope: Files.Read, Files.ReadWrite, Files.Read.All, Files.ReadWrite.All, Sites.Read.All or Sites.ReadWrite.All

The OneDrive page can be used to browse through the files and directories on the user's OneDrive.

Folders can be opened by clicking on the respective folder icon, or by specifying the path manually.

Files can be downloaded directly using the download icon.

File upload functionality and the ability to search for files on OneDrive recursively will be added in the future.

Recent Files

• Access Token Resource: https://graph.microsoft.com
• Required Scope: Files.Read, Files.ReadWrite, Files.Read.All, Files.ReadWrite.All, Sites.Read.All or Sites.ReadWrite.All

As the name implies, the Recent Files page lists all recently accessed files by the current user. This can be useful to discover interesting files the user might be working on, or to identify possible candidates that can be backdoored (e.g. office documents in which malicious macros can be added.)

Files Shared with Me

• Access Token Resource: https://graph.microsoft.com
• Required Scope: Files.Read.All, Files.ReadWrite.All, Sites.Read.All or Sites.ReadWrite.All

Similarly, the Files Shared with Me page shows a list of files shared with the current user by other users. This allows you to download these files from the OneDrive of the users who choose to share these files.