Microsoft Word: Read and Edit Documents

Read and edit Word documents stored in OneDrive and SharePoint through the Microsoft Graph API. OAuth tokens injected automatically.

On self-hosted OneCLI, Microsoft Word needs your own Microsoft app first. See Self-hosted.

Overview

OneCLI connects AI agents to Microsoft Word through Microsoft’s OAuth flow. Agents can read, create, and edit Word documents stored in OneDrive and SharePoint. The gateway injects OAuth credentials into requests to the Microsoft Graph API automatically.

This is useful for agents working in Microsoft 365 environments that need to generate reports, draft documents, or process existing Word files.

Setup

1. Go to Connections

   Open the OneCLI dashboard and navigate to Connections > Microsoft Word.

2. Authorize

   Click Connect Microsoft Word. You’ll be redirected to Microsoft to sign in and authorize OneCLI. Review the permissions and click Accept.

   

   The Microsoft Word connect window on OneCLI Cloud.

Permissions

Permission	Access	Description
Files.ReadWrite	Read & write	View, create, update, and delete files in OneDrive and SharePoint
User.Read	Read	Your name and email address

Self-hosted: use your own Microsoft app

Skip this section on OneCLI Cloud. It’s only for self-hosted OneCLI without MICROSOFT_CLIENT_ID and MICROSOFT_CLIENT_SECRET set. One Microsoft app serves all four Microsoft apps in OneCLI, so you set it up once.

Set up your Microsoft app

Follow Self-hosted: use your own Microsoft app on the Outlook Mail page. If you already have one for another Microsoft app, it already works here. Then open Connections > Microsoft Word and select Connect Microsoft Word.

Custom credentials for Microsoft Word in OneCLI. The Microsoft app is shared, so the same client works here.

What agents can do

• Read the content of Word documents from OneDrive or SharePoint
• Create new Word documents
• Edit and update existing documents
• Search for documents across drives and SharePoint sites
• Access shared files and followed sites

Controlling access

Access is per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top, like rate limits and blanket blocks. Everything is checked before credential injection, so a blocked request never reaches Microsoft Graph.