n.siegfried
0a298b2f6e
The written request for a `WP-Suite-File-Picker` app registration in the prime-controls.com tenant: SPA platform, delegated Files.Read.All / Sites.Read.All / User.Read, admin consent, no secret and no app-only permissions. Keeping it in the repo means the lowest-privilege configuration we asked IT for is on the record next to the code that will use it, and whoever wires up the picker can see what was actually granted rather than reconstructing it from memory. Dated 2026-06-15, authored by Nick Siegfried. Committed on its own branch off main because it has nothing to do with the user-directory work that was in flight. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.6 KiB
Request: Entra (Azure AD) App Registration — WP Suite SharePoint File Picker
Requested by: Nick Siegfried (n.siegfried@prime-controls.com) Date: 2026-06-15 Purpose: Let users of the Work Package (WP) Suite pick files directly from the project's SharePoint folders (Drawings / Specs / Data Sheets) and attach them to a work package, instead of manually copying and pasting SharePoint links.
To do this the tool needs to call Microsoft's OneDrive/SharePoint File Picker (File Picker v8) and Microsoft Graph on behalf of the signed-in Prime user. That requires an Entra app registration. None of this grants the app standalone access — every action runs as the signed-in user, so it can only see what that user already has permission to in SharePoint.
What we need created
A single App registration in the prime-controls.com (primecontrolsdallas) tenant.
| Setting | Value |
|---|---|
| Name | WP-Suite-File-Picker |
| Supported account types | Single tenant — Accounts in this organizational directory only |
| Platform | Single-page application (SPA) |
| Redirect URI(s) | The URL(s) the tool is hosted at — e.g. https://<wp-suite-host>/wp-creation-index.html (and http://localhost:<port>/... for testing). Nick to confirm final host. |
API permissions (Microsoft Graph — Delegated, not Application)
| Permission | Why |
|---|---|
Files.Read.All |
Read files the user selects in the picker |
Sites.Read.All |
Resolve the SharePoint site/folder the picker browses |
User.Read |
Basic sign-in (usually present by default) |
Delegated = acts as the signed-in user. We are not requesting application (app-only) permissions, so the app cannot read anything on its own.
Admin consent
- Please grant admin consent for the delegated permissions above so pilot users aren't each prompted to consent individually.
What we DON'T need
- No client secret / certificate (SPA uses PKCE, no secret).
- No application (app-only) permissions.
- No write/modify permissions — read-only is sufficient for attaching files.
What to send back to Nick
- Application (client) ID
- Directory (tenant) ID
- Confirmation that the redirect URI was registered and admin consent granted.
Background / scope
This is for an internal pilot of the WP Suite (Project SDE). Today users paste SharePoint "Copy Link" URLs by hand. The app registration enables a proper "Add files" picker scoped to the SOP's folders. Read-only, single-tenant, delegated — lowest-privilege configuration that makes the picker work.