ts storage-connection

Show, create, change, and delete storage connections, and choose who can use each. Use it to give people a file server folder they can reach from their workspaces, or to rename, restrict, or retire any connection.

Usage

ts storage-connections [--csv] [--no-trunc]
ts storage-connection <id>
ts storage-connection new <name> --provider=SLUG [--permission=PERMISSION] (--everyone | --group=GROUP...)
ts storage-connection set <id> <property> <value> [--everyone | --group=GROUP...]
ts storage-connection set <id> (--everyone | --group=GROUP...)
ts storage-connection delete <id> [--force]

Description

A storage connection is access to one storage provider: a file system provider's folder, or an account at an OAuth provider such as OneDrive. A storage scope then mounts a global connection into a workspace, naming it by the connection's ID. A global connection belongs to the deployment and reaches the people it is for; a connection a person made for themselves is theirs alone.

ts storage-connections lists the connections with their provider, permission, who can use them, and the ID every singular form takes. An administrator sees every connection; anyone else sees their own and the global ones they can use, without who else can. print, the default, also shows the account a connection signs in as (- for a file system connection), its status, and when it was made. A file system connection's status is OK; an OAuth connection's reports its sign-in, such as ReconnectRequired when someone has to sign in to the provider again. The same connections are on the Connections tab under Workspaces → Storage.

Who Can Use It

• --everyone — every user can see the connection and use its storage scopes.
• --group, once per group — only members of those groups. Name a group by its name or by its ID from ts groups; where two identity sources hold the name, put the source's login prefix and a backslash before it (CORP\Sales). A name no live group has is refused, and so is a name several groups share.

new needs one of the two, and no form takes both. On set, --group names the whole list and replaces the groups the connection had. Once every group a connection names is deleted, no one can use it. A connection a person made is theirs alone, so set refuses to give it an audience.

Creating and Changing a Connection

new creates a global connection to a file system provider, named by its slug from ts storage-providers. It is read-write unless --permission says read-only. It is refused for a provider that is not a file system provider, and for one whose folder holds working storage or sits inside it, which the connection would reach.

A connection to an OAuth provider (OneDrive, Dropbox, Google Drive, or Filr) is made by signing in to the provider, which ts cannot do. In the Administration site, under Workspaces → Storage, open the Connections tab, select New Connection, choose the provider, and select Authorize & Connect. Once it exists, ts storage-connection changes and deletes it like any other.

set changes the name (up to 256 characters) or the permission (read-write or read-only), who can use the connection, or both in one call. What it does not name is kept.

delete asks first, and --force answers yes. It ends the connection's grant: revoked at the provider where the provider allows it, with its tokens erased. An administrator can delete any connection; anyone else, only one they made.

Creating, changing, and deleting a connection are recorded in the audit log with who did it, and a creation or change also with who can use the connection.

Options

Flag	Description	Default/Values	Notes
--provider	The file system provider for new.	Slug from ts storage-providers	new only, and required there.
--permission	The permission for new.	read-write (default), read-only	new only. set takes permission as a property.
--everyone	Everyone can use the connection.		new and set. Not with --group.
--group	A group that can use the connection.	Name, PREFIX\name, or ID from ts groups	new and set; repeat for each group. On set, replaces the connection's groups.
--force, -f	Delete without confirming.		delete only. Required when there is no terminal.
--csv	Tab-separated output, nothing truncated.		ts storage-connections only.
--no-trunc	Do not truncate columns.		ts storage-connections only.

Examples

# Which connections are there, and who can use each?
ts storage-connections

# One connection in full
ts storage-connection 5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93

# Give Engineering a read-write connection to the corporate file server
ts storage-connection new "IT share" --provider=corp-fs --group=Engineering

# A read-only archive everyone can use
ts storage-connection new Archive --provider=corp-archive --permission=read-only --everyone

# Rename a connection
ts storage-connection set 5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93 name "Engineering share"

# Make it read-only and open it to Sales in the CORP directory as well
ts storage-connection set 5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93 permission read-only \
  --group=Engineering --group='CORP\Sales'

# Delete a connection without being asked
ts storage-connection delete 5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93 --force

# --group replaces the connection's groups rather than adding one: this leaves
# Sales as the only group. To add Sales beside Engineering, name both.
ts storage-connection set 5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93 --group=Sales

Output

NAME              PROVIDER               PERMISSION  USED BY                  ID
IT share          Corporate File Server  read-write  Engineering, CORP\Sales  5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93
Archive           Corporate Archive      read-only   (everyone)               0f6a2b91-c3d4-4e85-b7a6-19d2e3f4a5b6
Company OneDrive  OneDrive               read-write  Finance (deleted)        8b2e4f60-1a3c-4d5e-9f70-6c1b2a3d4e5f
OneDrive          OneDrive               read-write  (its owner)              c41f0d8a-2b77-4c19-9e0a-1d3b6f2e5a90

USED BY is (everyone), the groups, (no one) for a group-limited connection that names none, or (its owner) for a connection a person made. A deleted group is marked (deleted); a connection whose only group is deleted reaches no one. Anyone other than an administrator sees - here.

Name:        IT share
Provider:    Corporate File Server
Account:     -
Permission:  read-write
Used by:     Engineering
             CORP\Sales
Status:      OK
Created:     2026-10-07T14:03:12.4817352
ID:          5d0c3e8a-7b14-4f2e-9a61-2c8e0f4b7d93

Exit Codes

0 on success. -1 when the command or the server refuses the change: no name or ID, new without --provider or without --everyone or --group, both of those at once, a provider that is not a file system provider or whose folder reaches working storage, an empty name or one over 256 characters, a group name several groups share, an audience for a connection a person made, or a delete declined or run with no terminal and no --force. -2 when set names neither a property and value nor an audience, the property is not name or permission, or a permission is not read-write or read-only, on new too. -4 when no account is signed in. -5 when the account is not a Server Administrator: new and set need one, and so does deleting a global connection. -6 when no connection you can see has that ID, no provider has that slug, or no group has that name or ID.

Related Commands

• ts storage-provider — The providers connections are made to; --provider takes the slug it lists.
• ts storage-scope — Mounts a global connection into a workspace.
• ts group — The groups --group names.
• ts audit — Who created, changed, or deleted a connection, and when.