# Birth Biologic — SharePoint Permissions Remediation (Donor Services site) — Syncro #32187

## User
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin
- **Role:** automation (acting on the requester's behalf)

## Session Summary

Discord-bot session (thread 1527711911456538624). Mike asked for a `/sync` and a check of the
Birth Biologic ticket reply. Annise (client) had replied on Syncro #32187 approving the SharePoint
permissions plan Mike emailed 7/16: lock the Donor Services site down so the 6 Donation
Coordinators are read-only, kill the org-wide edit links, and consolidate the scattered
folder-by-folder permissions. Mike said "Go for it", confirmed the detailed execution preview
with YES, and the full remediation was executed live on the tenant via the remediation-tool
SharePoint tiers (cert-based app-only tokens, Tenant Admin app, Sites.FullControl.All).

Four steps executed and verified on tenant 19a568e8-9e88-413b-9341-cbc224b39145:
(1) Tenant sharing defaults via CSOM admin API — DefaultSharingLinkType 3→1 (Anyone→Specific
people) and DefaultLinkPermission 0→1 (View). (2) Added the six Donation Coordinators (Christina
Cox, Valerie VanEaton, Ashley Williams, Lastashia May, Mei Mei Senthavy, Mindi Maher) to the
Donor Services site Visitors group (id 4) — read-only site-wide. (3) Restored role inheritance
on the Documents library (78,378 items), the 5 unique-permission folders (found by depth-limited
probing, not brute force over 20,540 folders), and the 10 individually-shared files — order
mattered: the "Acquisition and Lab Processes" folder had no Members-Edit grant, so inheritance
was reset BEFORE deleting sharing links to avoid locking out editors. (4) Removed all 14
SharingLinks.*.OrganizationEdit site groups — 13 were auto-cleaned by the inheritance resets
(the 404s on removebyid were expected, not errors), 1 orphan (group 28, deleted file) removed
manually. Zero SharingLinks groups remain.

Verified via getusereffectivepermissions on a Suitability doc: ccox and mmaher view=YES/edit=no
(coordinators), vfountain and ksteen view=YES/edit=YES (editors) — exactly the intended posture,
no lockouts.

Closed out on Syncro: posted the customer-visible completion reply to Annise as Mike (comment
424227376, emailed), set #32187 to Resolved per Mike, and billed 1.0 hr Remote Labor per Mike.
Invoice 68053 netted $0 — applied 1 prepay hour (block 3.0 → 2.0). Low-block invoice note set
and Winter pinged in #bot-alerts (block now under 4 hrs). Bot-alerts posted for the comment,
status change, and billing.

## Key Decisions

- **Inheritance reset BEFORE sharing-link deletion** on folders whose editors depended on the
  org-wide edit link (Acquisition and Lab Processes had no Members-Edit grant) — reversing the
  order would have locked out working editors mid-change.
- **Depth-limited folder probing** (164 folders at depth ≤7) instead of per-folder permission
  checks across all 20,540 folders — found all 5 unique-permission folders; unique permissions
  live shallow in this library.
- **RenderListDataAsStream with CAML paging** for folder enumeration — OData $filter throws
  SPQueryThrottledException on the 78k-item list.
- **Treated 13 removebyid 404s as success, verified end state instead of retrying** — inheritance
  resets auto-delete orphaned SharingLinks groups; confirmed zero SharingLinks groups remained.
- **The "Inclement Weather" folder reset was safe** — its per-user Read grants to the 6
  coordinators were the old manual workaround, now superseded by Visitors membership.
- **Status → Waiting on Customer initially, then Resolved on Mike's explicit instruction**
  ("1hr labor - resolved status").
- **Billing as Remote Labor (1190473) at 1.0 hr** — prepaid customer, so the invoice auto-applied
  1 prepay hour ($0 due); correct behavior, not an error.

## Problems Encountered

- **OData folder query silently returned 0 rows** then surfaced SPQueryThrottledException (list
  view threshold, 78,378 items) — switched to RenderListDataAsStream with CAML
  `<View Scope="RecursiveAll">` + FSObjType=1 filter and NextHref paging.
- **All resetroleinheritance POSTs returned HTTP 411** (Length Required) — SharePoint REST POSTs
  need an explicit empty body: retry with `-d ''` → all 200.
- **Graph group lookup by mail returned empty** for donorservices@ — used
  `$search="displayName:donor"` with ConsistencyLevel: eventual; two same-named groups existed,
  picked the site-connected one (11d28c77) by matching its member list to the 7/16 plan email.
- **13 of 14 sitegroups/removebyid returned 404** — expected: the inheritance resets had already
  auto-deleted those SharingLinks groups. Verified final group list instead of retrying.

## Configuration Changes

- **No repo file changes** (live-tenant work only). Scratch files (.sg.json, .folders.tsv,
  .unique-folders.tsv, .spadm.err) in the remediation-tool skill dir were cleaned up.
- **Birth Biologic tenant (live SharePoint changes):**
  - Tenant sharing: DefaultSharingLinkType = 1 (Specific people), DefaultLinkPermission = 1 (View)
  - Donor Services site Visitors group (id 4): +6 members (ccox, vvaneaton, awilliams, lmay,
    msenthavy, mmaher @birthbiologic.com)
  - Documents library (guid 7924d2ff-a79f-4b93-a38d-0c779146b525), folders 4/5/154329/154506/155622,
    and 10 shared files: role inheritance restored (HasUniqueRoleAssignments=false everywhere)
  - All 14 SharingLinks.*.OrganizationEdit site groups removed (13 auto, orphan group 28 manual)
- **Syncro #32187** (id 109277420): comment 424227376 (customer-visible, emailed), status →
  Resolved, line item 43315362 (1.0 hr Labor - Remote Business), invoice 68053 ($0, 1 prepay hr
  applied), invoice note "Block hours remaining: 2. You're running low..."

## Credentials & Secrets

- No new credentials. Used ComputerGuru Tenant Admin app (709e6eed-0711-4875-9c44-2d3518c47063,
  vault `msp-tools/computerguru-tenant-admin.sops.yaml`) via get-token.sh `sharepoint` /
  `sharepoint-admin` tiers (cert-based — SharePoint rejects client_secret tokens) and
  `investigator` tier for Graph reads. Syncro: Mike's per-user key via syncro-env.sh
  (CLAUDETOOLS_REQUESTER_USER=mike).

## Infrastructure & Servers

- Birth Biologic M365 tenant: 19a568e8-9e88-413b-9341-cbc224b39145
- SharePoint: birthbiologic.sharepoint.com / birthbiologic-admin.sharepoint.com
- Donor Services site: /sites/DonorServices (M365 group 11d28c77-...), Documents library
  guid 7924d2ff-a79f-4b93-a38d-0c779146b525, 78,378 items / 20,540 folders
- Site groups after remediation: 6 standard only (Owners/Members/Visitors + system)
- CSOM Tenant admin TypeId {268004ae-ef6b-4e9b-8425-127220d84719}; effective-permissions check
  via getusereffectivepermissions(@u) with claims-encoded UPN; Low bitmask bit 1=ViewListItems,
  bit 4=EditListItems

## Commands & Outputs

- Tokens: `bash scripts/get-token.sh 19a568e8-... sharepoint|sharepoint-admin|investigator`
  (run from .claude/skills/remediation-tool)
- Tenant defaults write: CSOM ProcessQuery SetProperty DefaultSharingLinkType/DefaultLinkPermission
  with `<Parameter Type="Enum">1</Parameter>`; verified by re-read
- Add to Visitors: `POST $SITE/_api/web/sitegroups(4)/users` body
  `{"__metadata":{"type":"SP.User"},"LoginName":"i:0#.f|membership|<upn>"}`
- Inheritance: `POST .../resetroleinheritance -d ''` (empty body mandatory — 411 otherwise)
- Folder enum: RenderListDataAsStream, CAML RecursiveAll + FSObjType=1, NextHref paging
- Effective perms: `getusereffectivepermissions(@u)?@u='i%3A0%23.f%7Cmembership%7C<upn>'`
- Syncro: POST /tickets/109277420/comment → 424227376; PUT status Resolved;
  POST add_line_item → 43315362; POST /invoices {ticket_id, customer_id} → invoice 1651084694
  (#68053, total 0.0, line annotated "Applied 1.0 Prepay Hours"); prepay 3.0 → 2.0 verified

## Pending / Incomplete Tasks

- **Winter follow-up:** Birth Biologic prepay block at 2.0 hrs (< 4) — low-block renewal ping
  sent to #bot-alerts (invoice 68053).
- **#32492 (separate ticket, still Waiting on Customer since 7/1):** site-creation lockdown
  (SelfServiceSiteCreationDisabled + Group.Unified restriction) awaiting Annise's go-ahead —
  NOT part of this remediation.
- Client may report access adjustments after coordinators notice the change — comment invited
  them to reply if anything is unreachable/over-permissioned.

## Reference Information

- Syncro #32187 id 109277420, customer Birth Biologic 17983014; comment 424227376; line item
  43315362; invoice 1651084694 (#68053); ticket URL
  https://computerguru.syncromsp.com/tickets/109277420
- Prior context logs: `session-logs/2026-07/2026-07-01-mike-remediation-tool-sharepoint-access-bb-32492.md`,
  `clients/birth-biologic/session-logs/2026-07/2026-07-06-mike-birthbio-sharepoint-move-ownership.md`
- Reference doc: `.claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md`
- Discord thread 1527711911456538624; bot-alerts 1527729772442947634 (comment),
  1527730372375478344 (low-block), 1527730411311071333 (billing)
