sync: auto-sync from GURU-5070 at 2026-06-10 16:02:59

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-10 16:02:59

.claude/skills/onboard365/references/customer-consent-instructions.md

@@ -0,0 +1,40 @@
+# Customer Consent Instructions (template)
+
+Use this when handing the single consent link to a customer's Global Administrator.
+Fill in `{{CUSTOMER}}`, `{{CONSENT_URL}}` (from `onboard365.sh link <domain>`), and your name.
+
+---
+
+**Subject:** Action needed: one-click approval to connect Arizona Computer Guru to your Microsoft 365
+
+Hi {{ADMIN_NAME}},
+
+To manage and protect your Microsoft 365 environment, we need a one-time approval from a
+Microsoft 365 **Global Administrator** at {{CUSTOMER}}. This is a single click — you won't need
+to approve anything else after this.
+
+1. Open this link while signed in as a Global Administrator:
+
+   {{CONSENT_URL}}
+
+2. Review the screen (it will show **"ComputerGuru Tenant Admin"**) and click **Accept**.
+
+That's it. Once you've accepted, reply to let us know and we'll finish the setup on our end.
+
+Thanks,
+{{TECH_NAME}}
+Arizona Computer Guru · 520.304.8300
+
+---
+
+## Notes for the tech (not for the customer)
+
+- The approver MUST be a **Global Administrator**. A User Admin / other role cannot grant
+  application admin consent — the Accept will fail or be greyed out.
+- The single grant is for **ComputerGuru Tenant Admin** only. After they accept, run
+  `onboard365.sh provision <domain>` — that creates the other app SPs and assigns roles with no
+  further customer interaction.
+- If they report an error like "Need admin approval" / "AADSTS650056" / "AADSTS7000229" on the
+  link, they almost always signed in with a non-GA account. Have them retry as a GA.
+- Don't send the per-app links. One link is the whole point. Per-app fallback URLs only come into
+  play if `onboard-tenant.sh` reports a specific app failed programmatic consent.