What can an AI agent do with
Full access to your own files (Files.ReadWrite, delegated)?
It can open, add, change, and delete the files in your own OneDrive.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is Files.ReadWrite.
With it, an agent can
- Open and read your files
- Upload new files
- Edit or replace existing files
- Delete files
It cannot, on its own
- On a work account, reach files others share with you or files on company sites (that needs the broader Files.ReadWrite.All)
What a bad day looks like
An agent that misreads a request could overwrite an important spreadsheet or delete a folder of signed contracts.
Set it up safer
- If it only needs a workspace of its own, ask for Files.ReadWrite.AppFolder (a preview feature), which limits it to one folder made for that app.
- If it only reads, ask for Files.Read.
Ask the company selling the agent
- Which of my files does the agent actually need?
- Will it ever delete or overwrite a file without asking me?
- Do you keep copies of my files on your servers?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.