n.siegfried/Project-SDE-WP-Suite
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add the Entra app-registration request for the SharePoint file picker

Browse Source 
The written request for a `WP-Suite-File-Picker` app registration in the
prime-controls.com tenant: SPA platform, delegated Files.Read.All / Sites.Read.All
/ User.Read, admin consent, no secret and no app-only permissions. Keeping it in
the repo means the lowest-privilege configuration we asked IT for is on the record
next to the code that will use it, and whoever wires up the picker can see what
was actually granted rather than reconstructing it from memory.

Dated 2026-06-15, authored by Nick Siegfried. Committed on its own branch off main
because it has nothing to do with the user-directory work that was in flight.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Nick Siegfried
2026-08-14 15:41:03 -05:00
parent 3cccdf1c4b
commit 0a298b2f6e
1 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
Azure-File-Picker-Request.md Normal file
View File

@@ -0,0 +1,60 @@
# Request: Entra (Azure AD) App Registration — WP Suite SharePoint File Picker
**Requested by:** Nick Siegfried (n.siegfried@prime-controls.com)
**Date:** 2026-06-15
**Purpose:** Let users of the Work Package (WP) Suite pick files directly from the
project's SharePoint folders (Drawings / Specs / Data Sheets) and attach them to a
work package, instead of manually copying and pasting SharePoint links.
To do this the tool needs to call Microsoft's **OneDrive/SharePoint File Picker
(File Picker v8)** and **Microsoft Graph** on behalf of the signed-in Prime user.
That requires an Entra app registration. None of this grants the app standalone
access — every action runs **as the signed-in user**, so it can only see what that
user already has permission to in SharePoint.
---
## What we need created
A single **App registration** in the `prime-controls.com` (primecontrolsdallas) tenant.
| Setting | Value |
|---|---|
| **Name** | `WP-Suite-File-Picker` |
| **Supported account types** | Single tenant — *Accounts in this organizational directory only* |
| **Platform** | **Single-page application (SPA)** |
| **Redirect URI(s)** | The URL(s) the tool is hosted at — e.g. `https://<wp-suite-host>/wp-creation-index.html` (and `http://localhost:<port>/...` for testing). *Nick to confirm final host.* |
### API permissions (Microsoft Graph — **Delegated**, not Application)
| Permission | Why |
|---|---|
| `Files.Read.All` | Read files the user selects in the picker |
| `Sites.Read.All` | Resolve the SharePoint site/folder the picker browses |
| `User.Read` | Basic sign-in (usually present by default) |
> Delegated = acts as the signed-in user. We are **not** requesting application
> (app-only) permissions, so the app cannot read anything on its own.
### Admin consent
- Please **grant admin consent** for the delegated permissions above so pilot users
aren't each prompted to consent individually.
---
## What we DON'T need
- No client secret / certificate (SPA uses PKCE, no secret).
- No application (app-only) permissions.
- No write/modify permissions — read-only is sufficient for attaching files.
## What to send back to Nick
1. **Application (client) ID**
2. **Directory (tenant) ID**
3. Confirmation that the **redirect URI** was registered and **admin consent** granted.
---
### Background / scope
This is for an internal pilot of the WP Suite (Project SDE). Today users paste
SharePoint "Copy Link" URLs by hand. The app registration enables a proper
"Add files" picker scoped to the SOP's folders. Read-only, single-tenant,
delegated — lowest-privilege configuration that makes the picker work.