# OneDrive OAuth Tenant Consolidation (March 31, 2026)

> **Retirement notice:** This document preserves the March 2026 tenant state.
> Shared-development registration details remain only as cleanup evidence for
> the approval-gated retirement runbook.

## Status

**Completed:** March 31, 2026

This document records the Azure-side consolidation of the OneDrive OAuth app registrations into the `stratofusion.onmicrosoft.com` tenant.

## Outcome

- OneDrive app registration ownership now lives in **one** Azure tenant: `stratofusion.onmicrosoft.com`.
- Environment isolation is preserved with **three** separate app registrations.
  - `Stratofusion Local`.
  - `Stratofusion Dev`.
  - `Stratofusion Prod`.
- The duplicate `Stratofusion Dev` registration created during rollout was removed so only the canonical local/dev/prod registrations remain.
- Tenant-wide admin consent was granted for the required delegated Microsoft Graph scopes in `stratofusion.onmicrosoft.com`.

## Supported Account Type

All three OneDrive app registrations should stay on:

- `Accounts in any organizational directory and personal Microsoft accounts`.

Reason:

- StratoFusion needs to support Microsoft 365 work/school accounts.
- StratoFusion also needs to support personal Microsoft accounts such as Outlook/Hotmail-backed OneDrive.
- A single-tenant app would block personal Microsoft accounts and external Microsoft 365 tenants.

## Required Microsoft Graph Permissions

The canonical delegated permissions for all three OneDrive app registrations are:

- `Files.ReadWrite.All`.
- `Sites.Read.All`.
- `User.Read`.
- `offline_access`.

If consent prompts reappear for the dev or prod enterprise application, first verify that the enterprise application's granted scopes still match this list.

## Redirect URI Matrix

| Environment | App Registration | Primary Redirect URI | Clerk Callback URI |
| --- | --- | --- | --- |
| Local | `Stratofusion Local` | `http://localhost:3000/api/onedrive` | `https://glorious-hawk-41.clerk.accounts.dev/v1/oauth_callback` |
| Development | `Stratofusion Dev` | `https://dev.stratofusion.io/api/onedrive` | `https://glorious-hawk-41.clerk.accounts.dev/v1/oauth_callback` |
| Production | `Stratofusion Prod` | `https://stratofusion.io/api/onedrive` | `https://clerk.stratofusion.io/v1/oauth_callback` |

## Environment Mapping

The repo keeps separate OneDrive registrations for `local`, `dev`, and `prod`, but the runtime source differs by environment:

- Local development uses `.env.local`.
- `stratofusion-dev` Vercel production uses the **Dev** OneDrive registration.
- `stratofusion-prod` Vercel production uses the **Prod** OneDrive registration.

Important deployment note:

- `dev.stratofusion.io` is served by the `stratofusion-dev` Vercel project.
- It is **not** a preview deployment hanging off `stratofusion-prod`.

Expected Vercel mapping:

| Vercel Project | Development Env | Preview Env | Production Env |
| --- | --- | --- | --- |
| `stratofusion-dev` | Local | Dev | Dev |
| `stratofusion-prod` | Local | Dev | Prod |

## Operational Rules

- Treat `stratofusion.onmicrosoft.com` as the only owning Azure tenant for StratoFusion OneDrive OAuth apps.
- Keep local/dev/prod as separate Azure app registrations so redirect URIs, secrets, and consent remain isolated by environment.
- Do not commit client secrets into the repo; update `.env.local` and Vercel environment variables out-of-band.
- If a Microsoft user can connect on prod but gets `Need admin approval` on dev, compare the dev enterprise app's granted scopes against the canonical delegated permission list above.

## Follow-Up

- Keep the runtime source of truth in sync with [DEPLOYMENT.md](./DEPLOYMENT.md).
- If the auth flow is refactored, prefer explicit environment-aware OneDrive configuration over hidden `common` authority assumptions.