# Entra ID App Registration Governance Policy
# Cold Bore Ballistics LLC — Internal Reference
# Classification: Confidential
# Last Updated: 2026-06-08

---

## 1. Purpose and Scope

This policy governs the creation, scoping, maintenance, and retirement of all Entra ID app registrations in the Cold Bore Ballistics LLC tenant (`d553115d-3f7e-4bb8-8052-946b328cca87`, `coldboreballisticsllc.onmicrosoft.com`).

It applies to all app registrations created by or on behalf of CBB, regardless of whether they are used for internal automation, service-to-service integrations, or future production integrations.

---

## 2. Governing Principle

**One registration, one purpose.** No app registration may be used for more than one distinct purpose. If a new capability requires Microsoft Graph access or any other OAuth-protected resource, a new registration must be created — even if an existing registration already has some of the required permissions.

This principle exists to enforce least-privilege boundaries, make scope audits unambiguous, and ensure that a compromised registration cannot be used beyond its stated function.

---

## 3. Naming Convention

| Registration type | Pattern | Example |
|---|---|---|
| Internal automation (Claude Code, scripts) | `claude-code-<purpose>` | `claude-code-sharepoint` |
| Service accounts (unattended automation, client credentials flow) | `svc-<purpose>` | `svc-github-actions` |

Purposes must be specific and unambiguous. `claude-code-graph` is not acceptable; `claude-code-calendar` and `claude-code-sharepoint` are.

---

## 4. Scope Minimization

Each registration requests only the minimum permissions required for its single stated purpose.

**Adding permissions to an existing registration for a new, unrelated purpose is prohibited.** If a new purpose requires additional scopes, create a new registration.

**Example of a violation:** Adding `Sites.Manage.All` to the `claude-code-calendar` registration (scoped for `Calendars.ReadWrite`) in order to access SharePoint. These are separate purposes; they require separate registrations.

---

## 5. Admin Consent

All delegated permissions that require admin consent must be explicitly granted before first use. Implicit or user-level consent is not acceptable for admin-consent-required scopes. Grant consent via **Entra admin center → App registrations → [registration] → API permissions → Grant admin consent for coldboreballisticsllc.com**.

---

## 6. Authentication Type

| Flow type | Client type | Credential |
|---|---|---|
| Device-code / interactive (human-in-the-loop) | Public client (`Allow public client flows = Yes`) | No client secret; no certificate |
| Service-to-service / daemon (unattended) | Confidential client | Certificate preferred; client secret only when certificate is not supported by the target service |

Do not enable public client flows on a confidential client registration. Do not add a client secret to a public client registration.

---

## 7. App Registration Inventory

All active registrations must appear in this table. A registration not listed here is not authorized.

| App name | Client ID | Purpose | Scopes | Auth type | Owner | Created | Last reviewed |
|---|---|---|---|---|---|---|---|
| `claude-code-calendar` | `3ceeb937-3527-440a-8852-dd7575f3faa4` | Outlook calendar CRUD via Microsoft Graph | `Calendars.ReadWrite` | Public / device-code | jschwefel | 2026-05 | — |
| `claude-code-mail` | `d58f607b-6c2c-4a6f-a4c8-207b3a6f8441` | Read and send M365 mail via Microsoft Graph (m365mail Slack delivery) | `Mail.Read`, `Mail.Read.Shared`, `Mail.Send`, `User.Read`, `User.ReadBasic.All` | Public / device-code | jschwefel | 2026-06-07 | — |
| `claude-code-sharepoint` | `38fa190b-c15b-4590-99e1-9c949309b408` | SharePoint List schema and items via Microsoft Graph | `Sites.Manage.All` | Public / device-code | jschwefel | 2026-06-07 | — |
| `app-docuseal-sharepoint-prod` | `7392de62-40be-406c-86f6-e507f9d69caf` | Logic App unattended write of DocuSeal signed PDFs to SharePoint | `Sites.ReadWrite.All`, `Files.ReadWrite.All` (application) | Confidential / certificate (KV: `app-docuseal-sharepoint-cert-pfx`, exp 2027-06-08) | jschwefel | 2026-06-08 (Approved: self, 2026-06-08) | — |

---

## 8. Prohibited Actions

- Adding permissions to an existing registration for a new, unrelated purpose
- Storing client secrets in plaintext outside Azure Key Vault
- Sharing a client secret or certificate across registrations
- Creating a registration without adding it to the inventory table in this document
- Using a registration for any purpose not stated in its inventory row

---

## 9. Review Cadence

The inventory table must be reviewed in full:

- Every 12 months from the date of last full review, **and** immediately upon any of the following:
  - A security incident involving any app registration
  - An employee or contractor offboarding
  - A new registration being created
  - A scope change to an existing registration

Update the **Last reviewed** column for each row examined during a review.

---

## 10. Offboarding and Retirement

When a registration is no longer needed:

1. **Disable** the registration in Entra admin center: **App registrations → [registration] → Properties → Enabled for users to sign-in → No**. Do not delete immediately.
2. **Revoke all tokens**: **App registrations → [registration] → Overview → Revoke all tokens**.
3. Hold for **30 days** after disabling, monitoring for any breakage.
4. After the 30-day hold, delete the registration.
5. Update the inventory table: mark the row as `Retired — <YYYY-MM-DD>` and remove the row at the next full review cycle.

---

## 11. Approval

Any new app registration requires explicit approval from the **Global Administrator** (`jschwefel@coldboreballisticsllc.com`) before creation.

When no other qualified individual is employed by or contracted to CBB, the Global Administrator may self-approve. Self-approvals must be documented with a dated note in the inventory row (e.g., `Approved: self, 2026-06-07`).


Document the approval date in the inventory row before the registration is created.

---

## 12. Acquisition Relevance

A clean, fully documented app registration inventory with enforced least-privilege scopes is a material positive during technical due diligence. Undocumented registrations, over-scoped registrations, and registrations with client secrets stored outside Key Vault are red flags that reduce acquisition value and increase buyer risk.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/M365/Entra_App_Registration_Policy.md` |
| **Cross-references** | `M365_Architecture_Reference.md`; `CBB_Information_Security_Policy.md`; `Access_Control_Policy.md`; `Service_Account_Guide.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-07 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
