Skip to content
sprigsprigsprig

Onboarding builders

Terminal window
./sprig azure onboard <builder-upn>

For the named person, this:

  1. creates their sandbox resource group (rg-sprig-user-<alias>);
  2. grants the platform identity Contributor on that group only — the platform’s Azure rights grow one sandbox at a time, never subscription-wide;
  3. assigns an Allowed resource types policy pinning the group to Static Web Apps;
  4. registers the builder in the platform metadata store.

The builder needs nothing installed beyond Claude with the sprig plugin. Their one-time setup:

Terminal window
npm install --prefix <plugin-path>
node <plugin-path>/lib/init.mjs --file sprig-install.json

First publish triggers a device-code sign-in with their normal Entra account; tokens cache locally per user. No Azure CLI, no secrets, no RBAC.

Offboarding

Section titled “Offboarding”

Delete the builder’s resource group (removes their apps), remove their metadata row, and let the platform-owned app registrations be cleaned up with it. A scripted remove-user is on the roadmap; until then the runbook covers the manual sequence.