To switch a connected Microsoft account to read-only access, you’ll need to remove the existing authorization and reconnect the account with restricted scopes. Follow these steps:
1. Remove the account inside the plugin
Open the main plugin options page and remove the account from the account list.
2. Revoke the current permissions
Unfortunately, the Graph API doesn’t provide a “self-revoke” endpoint which the application can use to revoke all existing permissions for the next time you reconnect your account with the plugin. So you will have to manually revoke the plugin’s access to your Microsoft account.
You can do this by following the steps explained in the FAQ “How can I revoke all Share-one-Drive permissions in Microsoft?”. This removes the existing authorization so the plugin can request new, read-only scopes.
3. Reconnect your Microsoft account in read-only mode
Click Add Account. In the modal, select Read-only. On the Microsoft scope screen that follows, verify that only “Read” scopes are selected.
Once the authorization is completed, your account will be connected in read-only mode.
What happens to my existing shortcodes or modules?
Shortcodes and modules store references such as the Microsoft account ID and the folder ID. What happens next depends on whether the same account is reconnected:
-
If you reconnect the same Microsoft account:
Existing shortcodes/modules will start working again automatically. They will temporarily stop working while the account is disconnected, but all configuration remains intact. -
If the account connection is removed permanently or changed to a different Microsoft account:
Any modules referencing the old account will stop working until you reconnect that exact account or reconfigure the modules.
Important note about the “primary account”
The plugin automatically designates the first Microsoft account you connect as the primary account.
This primary account is used whenever a shortcode or module does not explicitly specify which cloud account it should use.
This has a few important consequences:
If a module does not contain an account ID, it will always fall back to the primary account.
If you remove the primary account from the plugin, modules that depended on it may stop working until the same account is reconnected.
When you reconnect the account, it will not automatically become the primary account again.
In such cases, you may need to open those modules and manually select the correct account and folder.
This behaviour only affects setups where multiple Microsoft accounts are linked to the plugin. For single-account setups, you don’t need to worry about the primary account at all.