What it asks for
- Asks Microsoft for
- Files.ReadWrite.AppFolder
offline_access - It can reach
- Its own app folder in your OneDrive
- The albums and photos you put there
- A refresh token, stored encrypted on your site
- It can never reach
- The rest of your OneDrive
- Your mail, calendar or contacts
- Anything belonging to other people in your organisation
- Any server of mine, because there isn't one
Refused by Microsoft's API, not by the plugin's own code.