How it works
The actors
Section titled “The actors”| Actor | What they touch | What they need |
|---|---|---|
| Builder | Claude (with the sprig plugin) | An Entra account. No Azure access, no tooling. |
| Viewer | Published app URLs | An Entra account and their existing data permissions. |
| Ops | Installer, onboarding, share approvals | Subscription Owner + Entra admin rights, once, at install. |
| Platform | Azure + Entra operations | A managed identity with narrowly scoped rights. |
The publish flow
Section titled “The publish flow”- Build. A builder describes an app in a Claude session. Claude writes a self-contained static app, testing it as it goes.
- “Share this solution.” The sprig publish skill activates. It authenticates the builder to the platform API with their Entra identity (device-code sign-in, first time only).
- Provision. The platform — not the builder — creates or updates:
- an Entra app registration dedicated to this app, with assignment required switched on and the owner assigned;
- an Azure Static Web App in the builder’s own resource group, tagged with owner, app and provenance metadata;
- a metadata record and audit events in the platform’s store.
- Upload. The app content is pushed with a scoped, single-app deployment token. The auth configuration is validated first — an app without Entra sign-in configured is refused.
- Live. The app runs on an Entra-gated URL. The builder opens it; anyone else is blocked at sign-in.
- Share. The builder asks to share with a team (an Entra group). The request waits in the Ops queue; on approval, the group is assigned to the app. Viewers still only see data their own permissions allow.
Data at view time
Section titled “Data at view time”Apps that show corporate data embed no data at all. The generated frontend acquires a token for the signed-in viewer and calls Microsoft Fabric’s API directly from the browser. Row-level security, sensitivity labels and revocation keep working, because every query runs as the person looking at the screen. Details: Data access.
What Ops installed, once
Section titled “What Ops installed, once”A platform resource group containing the publish API (Azure Functions), a metadata store, a managed identity with per-builder-scoped rights, monitoring, and a subscription budget. The install runs as a previewable, idempotent script — see Install.