Add a OneDrive account

Every document CtrlShare checks out goes into one OneDrive account, and stays there until it is checked back in. This connects that account.

The same steps re-authorise an account whose consent has expired, which is the more common reason to be on this page. Nothing else in the configuration changes.

Use a service account, not a person

This one account holds the working copies for every CtrlShare user in the vault. Using an individual’s account means co-authoring stops the day they leave.

Before you start

• The Application (client) ID and client secret from the Entra ID registration, with http://localhost/ctrlshare registered as a Web redirect URI.
• The credentials of the service account whose OneDrive will hold the files.
• A browser you can sign in to that account with. Sign out of any other Microsoft account first — the consent is granted as whoever is signed in, and there is no confirmation afterwards saying which account that was.

Steps

1. Open the CtrlShare configuration.

   In M-Files Admin, connect to the server, open the vault, and select Configurations → Other Applications → CtrlShare → Configuration.

2. Fill in the OneDrive for Business section.

   Setting	Value
   Client ID	The Application (client) ID from the Entra registration
   Client Secret	The client secret from the Entra registration
   Redirect URI	Leave the default, http://localhost/ctrlshare

   The redirect URI has to match one registered on the Entra application exactly, trailing slash included.

3. Sign in to the service account.

   Open office.com in a browser and sign in as the service account. This is the account the consent in the next step is granted for.

4. Open the authorisation URL.

   Put the Application (client) ID in place of APPLICATIONID and open the result in the same browser:

   https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=APPLICATIONID&response_type=code&scope=Files.ReadWrite.All%20offline_access&redirect_uri=http://localhost/ctrlshare

   A consent page appears listing the permissions. Select Accept.

   

   The consent page. It lists the permissions named in the authorisation URL; this one comes from an older URL, which also asked to read users' basic profiles.

5. Copy the address from the address bar.

   The browser then reports that it cannot connect to localhost. That is expected: nothing runs at that address, and the page exists only to hold the result. The address bar keeps it:

   http://localhost/ctrlshare?code=0.AUgAvawd…deu&session_state=xxxxxxxx

   Copy the whole address.

6. Paste it into the configuration and save.

   Paste the address into Authorization Code and save. CtrlShare takes the code out of it, so the code alone works as well. Saving exchanges the code for a token CtrlShare can refresh, and a code can only be exchanged once.

Check

M-Files Admin does not show whether the exchange worked. A failed exchange is written to the vault application log, so look there first.

Then check a document out to OneDrive and back in. The connection can look right and still fail on first use, and a real check-out is the only thing that proves it.

When to come back here

The consent expires. When it does, check-outs fail with an authentication error and nothing warns you beforehand — repeat steps three to six to re-authorise. The client secret in the Entra registration expires separately, on its own schedule.

Connections made before CtrlShare 2.26.8.0

An existing connection keeps the redirect URI it was set up with, usually https://login.microsoftonline.com/common/oauth2/nativeclient. To re-authorise it without changing anything else, put that address in place of http://localhost/ctrlshare in step 4. To move it to the new default, register http://localhost/ctrlshare on the Entra application and change Redirect URI first. The old address still works, but it redirects away from the code after a moment, so copy quickly.

Related

• Register the Entra ID application — where the client ID and secret come from.
• Prevent users re-sharing a document — the setting on this same account that keeps the sharing record complete.