Google Cloud Storage vs OneDrive and SharePoint files (Microsoft Graph)

Google Cloud Storage 85

IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.

OneDrive and SharePoint files (Microsoft Graph) 71

OAuth 2.0 through Microsoft Entra ID with delegated and application permissions from Files.Read to Sites.ReadWrite.All, revocable consent, and Selected scopes that hold an app to chosen sites, lists, folders or files. Download and upload URLs are pre-authenticated and short-lived, which we read as designed capability links and not as a credential in a URL (30). Files.Read for reading, Selected scopes with read, write, owner and fullcontrol roles, DELETE to the recycle bin and anonymous links that an administrator can disable. Nothing asks for confirmation before permanentDelete or an anonymous link (17). File names and contents written by other people reach the caller, and no injection guidance was found in the files reference pages (0). Graph activity logs record app, user, request URI and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). The Microsoft 365 bounty names SharePoint Online and OneDrive at $1,250 to $19,500 (per the 9 October check), with a coordinated disclosure policy and an Office 365 SOC 2 Type 2 report, and MSRC publishes CVEs for SharePoint Online and Microsoft Graph, counted under negative events. microsoft.com's security.txt passed its Expires date on 23 September 2026 and still carries it on 2 November, and two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 14). 30+17+0+12+12 = 71.

Google Cloud Storage 88

Release notes on 4 November 2026 (30). Entries on 30 October, 13 October, 30 September, 10 September and 3 September (20). A closed service with dated release notes and paid support; issue trackers for the client libraries are public (15). Official client libraries in many languages (15). Libraries ship with end-to-end checksums by default since 30 September (8). 30 + 20 + 15 + 15 + 8 = 88.

OneDrive and SharePoint files (Microsoft Graph) 76

msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August, v1.62.0 on 2 September, v1.63.0 on 16 September, v1.64.0 on 6 October and v1.65.0), counted half, plus v1.0 Files entries in the changelog feed on 10 and 12 August and 15, 21 and 23 September 2026, and What's new entries for Files in September and October 2026 (20). A public changelog, now dated to 6 October 2026, a What's new page updated on 31 October 2026 and SDK issue trackers. Security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release, and an issue about drive content returning None on the Python SDK had no reply on 9 October (per the 9 October check, not re-read on 2 November) (10, was 9 when the feed stopped at 3 August). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.

Google Cloud Storage 30

No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.

OneDrive and SharePoint files (Microsoft Graph) 20

No x402, MPP or L402 (0). File calls aren't on Microsoft's metered API list, whose one entry is assignSensitivityLabel at $0.00185 a call, but storage comes from a OneDrive or Microsoft 365 plan and the plan price page refused our reader today (10). The reference pages list delegated permissions for personal Microsoft accounts, so no Microsoft 365 licence is needed to call the API, but we couldn't read the size of the free personal allowance, and the free E5 developer sandbox is limited to Visual Studio subscribers and other qualifying members (10). A person registers an app in Entra and signs in to consent (0).

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

OneDrive and SharePoint files (Microsoft Graph) 76

Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDKs (15). Microsoft's data handling page for Microsoft 365 gives at most 30 days after active deletion and 180 days after a subscription ends for customer content, the SharePoint deletion page gives 93 days in the recycle bin and 14 further days of backups, and the privacy statement was updated in September 2026. We didn't read the data protection addendum (22). The Graph policy is at least 24 months' notice before a generally available API or version is removed, while the API terms reserve the right to change or discontinue any API with or without notice (18). Data residency for Microsoft 365 is documented by tenant geography. The sub-processor list sits on the Service Trust Portal, which we didn't read (10).

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

OneDrive and SharePoint files (Microsoft Graph) 89

OpenAPI 3.0.4 for all of Graph v1.0 in microsoftgraph/msgraph-metadata, with 1,516 paths under /drives, 172 of them outside the workbook API (25). learn.microsoft.com answers 404 for llms.txt, but every page we asked for with Accept: text/markdown came back as Markdown (10). Reference pages state the purpose of each call, list permissions from least to most privileged and say which options work only on personal OneDrive. The upload session page gives Sites.ReadWrite.All as the least privileged application permission where the small-upload page gives Files.ReadWrite.All, and the overview page is dated March 2024 (16). createLink declares type and scope as plain strings with no enumeration, conflictBehavior is an annotation outside the schema, path addressing is absent from the OpenAPI, and retainInheritedPermissions defaults to false there and to true on the reference page (9). An HTTP example and SDK snippets on each page, a status code table, and upload-specific handling for 404, 409 and 416 (14). v1.0 and beta, a dated changelog and a monthly What's new page (15).

Google Cloud Storage 80

Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

OneDrive and SharePoint files (Microsoft Graph) 74

Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20), per the 9 October check. Its robots.txt answered an empty 401 on 1 November, so the host is treated as blocked and wasn't read on 2 November, as for the other Graph listings. No readable components or incident history (5). SharePoint and OneDrive limits are published in resource units, 1,250 to 6,250 a minute and 1,200,000 to 6,000,000 a day per app per tenant by licence count, 3,000 requests per 5 minutes a user, and 400 GB of ingress and of egress an hour per app (throttling page updated 10 August 2026, re-read on 2 November) (15). 429 and 503 responses carry Retry-After, upload sessions resume from nextExpectedRanges with backoff advice for 5xx errors, and If-Match and conflictBehavior guard overwrites. There is no idempotency key on invite or folder creation (14 of 15). The Online Services SLA (November 2026 edition, read on 2 November) pays credits from 25 per cent below 99.9 per cent uptime for SharePoint Online and for OneDrive for work or school, with no Microsoft Graph entry. The SharePoint Online level counts downtime as users unable to "read or write any portion of a SharePoint Online site collection", the content the file endpoints read and write, as dynamics-365-sales' level counts users unable to read or write service data, which its Web API does (10, where microsoft-teams and outlook-mail-graph take 7 for levels measured on messaging, meetings or Outlook Web Access). The file endpoints are generally available on v1.0 (10). 20+5+15+14+10+10 = 74.