diff --git a/Azure-File-Picker-Request.md b/Azure-File-Picker-Request.md
new file mode 100644
index 0000000..212dd9b
--- /dev/null
+++ b/Azure-File-Picker-Request.md
@@ -0,0 +1,60 @@
+# Request: Entra (Azure AD) App Registration — WP Suite SharePoint File Picker
+
+**Requested by:** Nick Siegfried (n.siegfried@prime-controls.com)
+**Date:** 2026-06-15
+**Purpose:** Let users of the Work Package (WP) Suite pick files directly from the
+project's SharePoint folders (Drawings / Specs / Data Sheets) and attach them to a
+work package, instead of manually copying and pasting SharePoint links.
+
+To do this the tool needs to call Microsoft's **OneDrive/SharePoint File Picker
+(File Picker v8)** and **Microsoft Graph** on behalf of the signed-in Prime user.
+That requires an Entra app registration. None of this grants the app standalone
+access — every action runs **as the signed-in user**, so it can only see what that
+user already has permission to in SharePoint.
+
+---
+
+## What we need created
+
+A single **App registration** in the `prime-controls.com` (primecontrolsdallas) tenant.
+
+| Setting | Value |
+|---|---|
+| **Name** | `WP-Suite-File-Picker` |
+| **Supported account types** | Single tenant — *Accounts in this organizational directory only* |
+| **Platform** | **Single-page application (SPA)** |
+| **Redirect URI(s)** | The URL(s) the tool is hosted at — e.g. `https://<wp-suite-host>/wp-creation-index.html` (and `http://localhost:<port>/...` for testing). *Nick to confirm final host.* |
+
+### API permissions (Microsoft Graph — **Delegated**, not Application)
+| Permission | Why |
+|---|---|
+| `Files.Read.All` | Read files the user selects in the picker |
+| `Sites.Read.All` | Resolve the SharePoint site/folder the picker browses |
+| `User.Read` | Basic sign-in (usually present by default) |
+
+> Delegated = acts as the signed-in user. We are **not** requesting application
+> (app-only) permissions, so the app cannot read anything on its own.
+
+### Admin consent
+- Please **grant admin consent** for the delegated permissions above so pilot users
+  aren't each prompted to consent individually.
+
+---
+
+## What we DON'T need
+- No client secret / certificate (SPA uses PKCE, no secret).
+- No application (app-only) permissions.
+- No write/modify permissions — read-only is sufficient for attaching files.
+
+## What to send back to Nick
+1. **Application (client) ID**
+2. **Directory (tenant) ID**
+3. Confirmation that the **redirect URI** was registered and **admin consent** granted.
+
+---
+
+### Background / scope
+This is for an internal pilot of the WP Suite (Project SDE). Today users paste
+SharePoint "Copy Link" URLs by hand. The app registration enables a proper
+"Add files" picker scoped to the SOP's folders. Read-only, single-tenant,
+delegated — lowest-privilege configuration that makes the picker work.