# Request: Entra (Azure AD) App Registration — WP Suite SharePoint File Picker

**Requested by:** Nick Siegfried (n.siegfried@prime-controls.com)
**Date:** 2026-06-15
**Purpose:** Let users of the Work Package (WP) Suite pick files directly from the
project's SharePoint folders (Drawings / Specs / Data Sheets) and attach them to a
work package, instead of manually copying and pasting SharePoint links.

To do this the tool needs to call Microsoft's **OneDrive/SharePoint File Picker
(File Picker v8)** and **Microsoft Graph** on behalf of the signed-in Prime user.
That requires an Entra app registration. None of this grants the app standalone
access — every action runs **as the signed-in user**, so it can only see what that
user already has permission to in SharePoint.

---

## What we need created

A single **App registration** in the `prime-controls.com` (primecontrolsdallas) tenant.

| Setting | Value |
|---|---|
| **Name** | `WP-Suite-File-Picker` |
| **Supported account types** | Single tenant — *Accounts in this organizational directory only* |
| **Platform** | **Single-page application (SPA)** |
| **Redirect URI(s)** | The URL(s) the tool is hosted at — e.g. `https://<wp-suite-host>/wp-creation-index.html` (and `http://localhost:<port>/...` for testing). *Nick to confirm final host.* |

### API permissions (Microsoft Graph — **Delegated**, not Application)
| Permission | Why |
|---|---|
| `Files.Read.All` | Read files the user selects in the picker |
| `Sites.Read.All` | Resolve the SharePoint site/folder the picker browses |
| `User.Read` | Basic sign-in (usually present by default) |

> Delegated = acts as the signed-in user. We are **not** requesting application
> (app-only) permissions, so the app cannot read anything on its own.

### Admin consent
- Please **grant admin consent** for the delegated permissions above so pilot users
  aren't each prompted to consent individually.

---

## What we DON'T need
- No client secret / certificate (SPA uses PKCE, no secret).
- No application (app-only) permissions.
- No write/modify permissions — read-only is sufficient for attaching files.

## What to send back to Nick
1. **Application (client) ID**
2. **Directory (tenant) ID**
3. Confirmation that the **redirect URI** was registered and **admin consent** granted.

---

### Background / scope
This is for an internal pilot of the WP Suite (Project SDE). Today users paste
SharePoint "Copy Link" URLs by hand. The app registration enables a proper
"Add files" picker scoped to the SOP's folders. Read-only, single-tenant,
delegated — lowest-privilege configuration that makes the picker work.