Safety & privacy
Updated August 12, 2026 · min read
What Does Read-Only OneDrive Access Mean?
Understand what read scope permits, what it blocks, and why metadata still needs protection.
“Read-only” is often interpreted as “cannot do anything harmful.” More precisely, it limits modification. An application may still learn a great deal from the data it can read, depending on the selected Microsoft Graph scope.
Read the full scope on Microsoft’s consent screen and compare it with the feature. A duplicate inventory needs file visibility; it should not need write permission to show groups, let you choose keepers, or export a plan.
A practical checklist
- 1Identify the exact scope and account shown by Microsoft.
- 2Confirm that the requested feature is inventory or review only.
- 3Check what metadata the app stores and for how long.
- 4Verify that no write action is available under the first token.
- 5Revoke access after use if ongoing connection is unnecessary.
Understand the situation
“Read-only” is often interpreted as “cannot do anything harmful.” More precisely, it limits modification. An application may still learn a great deal from the data it can read, depending on the selected Microsoft Graph scope.
A permission label describes technical access, not the provider’s entire security posture. Review the exact scope, token handling, retention, operator access, and purpose of every data field before connecting an account.
Use a controlled workflow
Read the full scope on Microsoft’s consent screen and compare it with the feature. A duplicate inventory needs file visibility; it should not need write permission to show groups, let you choose keepers, or export a plan.
Use least privilege in stages: read-only access for inventory and review, followed by separate write consent only if the user chooses an approved cleanup. A report-only workflow should remain possible.
- Confirm that the requested feature is inventory or review only.
- Check what metadata the app stores and for how long.
- Verify that no write action is available under the first token.
Make the final decision
Use read-only as the default stage, then require a new, explicit consent event if the user later asks the service to modify reviewed items. The backend must enforce that separation rather than relying on hidden UI state.
Metadata is not harmless just because it excludes file bodies. Names, paths, sizes, account IDs, and sharing state can reveal sensitive business or personal context and need deliberate protection.
Limits and risks to check
- — Read access can still expose sensitive metadata or file bodies if the app requests them.
- — Consent wording varies by account and scope.
- — Client-side token exposure can undermine an otherwise narrow scope.
- — A later write token needs separate protection and authorization.
Official references
Frequently asked questions
Can a read-only app delete my files?
The read-only permission itself does not authorize deletion. The implementation and backend should also enforce that no write token is present.
Can it see filenames?
Yes, if the granted file-read scope returns the drive items needed for the feature.
Why would write consent ever be needed?
Only for a later action that modifies approved files, and it should be requested separately after review.
Scan first. Decide with evidence.
ClearCopies reads supported cloud-drive metadata and groups exact copies by byte size plus a provider-supplied content fingerprint. Original file bodies are not downloaded for the scan. You review the result and export a plan before any separate write step.