sync: auto-sync from GURU-BEAST-ROG at 2026-07-17 10:36:19

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-17 10:36:19

clients/birth-biologic/session-logs/2026-07/2026-07-17-mike-sharepoint-permissions-remediation-32187.md

@@ -0,0 +1,141 @@
+# Birth Biologic — SharePoint Permissions Remediation (Donor Services site) — Syncro #32187
+
+## User
+- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
+- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin
+- **Role:** automation (acting on the requester's behalf)
+
+## Session Summary
+
+Discord-bot session (thread 1527711911456538624). Mike asked for a `/sync` and a check of the
+Birth Biologic ticket reply. Annise (client) had replied on Syncro #32187 approving the SharePoint
+permissions plan Mike emailed 7/16: lock the Donor Services site down so the 6 Donation
+Coordinators are read-only, kill the org-wide edit links, and consolidate the scattered
+folder-by-folder permissions. Mike said "Go for it", confirmed the detailed execution preview
+with YES, and the full remediation was executed live on the tenant via the remediation-tool
+SharePoint tiers (cert-based app-only tokens, Tenant Admin app, Sites.FullControl.All).
+
+Four steps executed and verified on tenant 19a568e8-9e88-413b-9341-cbc224b39145:
+(1) Tenant sharing defaults via CSOM admin API — DefaultSharingLinkType 3→1 (Anyone→Specific
+people) and DefaultLinkPermission 0→1 (View). (2) Added the six Donation Coordinators (Christina
+Cox, Valerie VanEaton, Ashley Williams, Lastashia May, Mei Mei Senthavy, Mindi Maher) to the
+Donor Services site Visitors group (id 4) — read-only site-wide. (3) Restored role inheritance
+on the Documents library (78,378 items), the 5 unique-permission folders (found by depth-limited
+probing, not brute force over 20,540 folders), and the 10 individually-shared files — order
+mattered: the "Acquisition and Lab Processes" folder had no Members-Edit grant, so inheritance
+was reset BEFORE deleting sharing links to avoid locking out editors. (4) Removed all 14
+SharingLinks.*.OrganizationEdit site groups — 13 were auto-cleaned by the inheritance resets
+(the 404s on removebyid were expected, not errors), 1 orphan (group 28, deleted file) removed
+manually. Zero SharingLinks groups remain.
+
+Verified via getusereffectivepermissions on a Suitability doc: ccox and mmaher view=YES/edit=no
+(coordinators), vfountain and ksteen view=YES/edit=YES (editors) — exactly the intended posture,
+no lockouts.
+
+Closed out on Syncro: posted the customer-visible completion reply to Annise as Mike (comment
+424227376, emailed), set #32187 to Resolved per Mike, and billed 1.0 hr Remote Labor per Mike.
+Invoice 68053 netted $0 — applied 1 prepay hour (block 3.0 → 2.0). Low-block invoice note set
+and Winter pinged in #bot-alerts (block now under 4 hrs). Bot-alerts posted for the comment,
+status change, and billing.
+
+## Key Decisions
+
+- **Inheritance reset BEFORE sharing-link deletion** on folders whose editors depended on the
+  org-wide edit link (Acquisition and Lab Processes had no Members-Edit grant) — reversing the
+  order would have locked out working editors mid-change.
+- **Depth-limited folder probing** (164 folders at depth ≤7) instead of per-folder permission
+  checks across all 20,540 folders — found all 5 unique-permission folders; unique permissions
+  live shallow in this library.
+- **RenderListDataAsStream with CAML paging** for folder enumeration — OData $filter throws
+  SPQueryThrottledException on the 78k-item list.
+- **Treated 13 removebyid 404s as success, verified end state instead of retrying** — inheritance
+  resets auto-delete orphaned SharingLinks groups; confirmed zero SharingLinks groups remained.
+- **The "Inclement Weather" folder reset was safe** — its per-user Read grants to the 6
+  coordinators were the old manual workaround, now superseded by Visitors membership.
+- **Status → Waiting on Customer initially, then Resolved on Mike's explicit instruction**
+  ("1hr labor - resolved status").
+- **Billing as Remote Labor (1190473) at 1.0 hr** — prepaid customer, so the invoice auto-applied
+  1 prepay hour ($0 due); correct behavior, not an error.
+
+## Problems Encountered
+
+- **OData folder query silently returned 0 rows** then surfaced SPQueryThrottledException (list
+  view threshold, 78,378 items) — switched to RenderListDataAsStream with CAML
+  `<View Scope="RecursiveAll">` + FSObjType=1 filter and NextHref paging.
+- **All resetroleinheritance POSTs returned HTTP 411** (Length Required) — SharePoint REST POSTs
+  need an explicit empty body: retry with `-d ''` → all 200.
+- **Graph group lookup by mail returned empty** for donorservices@ — used
+  `$search="displayName:donor"` with ConsistencyLevel: eventual; two same-named groups existed,
+  picked the site-connected one (11d28c77) by matching its member list to the 7/16 plan email.
+- **13 of 14 sitegroups/removebyid returned 404** — expected: the inheritance resets had already
+  auto-deleted those SharingLinks groups. Verified final group list instead of retrying.
+
+## Configuration Changes
+
+- **No repo file changes** (live-tenant work only). Scratch files (.sg.json, .folders.tsv,
+  .unique-folders.tsv, .spadm.err) in the remediation-tool skill dir were cleaned up.
+- **Birth Biologic tenant (live SharePoint changes):**
+  - Tenant sharing: DefaultSharingLinkType = 1 (Specific people), DefaultLinkPermission = 1 (View)
+  - Donor Services site Visitors group (id 4): +6 members (ccox, vvaneaton, awilliams, lmay,
+    msenthavy, mmaher @birthbiologic.com)
+  - Documents library (guid 7924d2ff-a79f-4b93-a38d-0c779146b525), folders 4/5/154329/154506/155622,
+    and 10 shared files: role inheritance restored (HasUniqueRoleAssignments=false everywhere)
+  - All 14 SharingLinks.*.OrganizationEdit site groups removed (13 auto, orphan group 28 manual)
+- **Syncro #32187** (id 109277420): comment 424227376 (customer-visible, emailed), status →
+  Resolved, line item 43315362 (1.0 hr Labor - Remote Business), invoice 68053 ($0, 1 prepay hr
+  applied), invoice note "Block hours remaining: 2. You're running low..."
+
+## Credentials & Secrets
+
+- No new credentials. Used ComputerGuru Tenant Admin app (709e6eed-0711-4875-9c44-2d3518c47063,
+  vault `msp-tools/computerguru-tenant-admin.sops.yaml`) via get-token.sh `sharepoint` /
+  `sharepoint-admin` tiers (cert-based — SharePoint rejects client_secret tokens) and
+  `investigator` tier for Graph reads. Syncro: Mike's per-user key via syncro-env.sh
+  (CLAUDETOOLS_REQUESTER_USER=mike).
+
+## Infrastructure & Servers
+
+- Birth Biologic M365 tenant: 19a568e8-9e88-413b-9341-cbc224b39145
+- SharePoint: birthbiologic.sharepoint.com / birthbiologic-admin.sharepoint.com
+- Donor Services site: /sites/DonorServices (M365 group 11d28c77-...), Documents library
+  guid 7924d2ff-a79f-4b93-a38d-0c779146b525, 78,378 items / 20,540 folders
+- Site groups after remediation: 6 standard only (Owners/Members/Visitors + system)
+- CSOM Tenant admin TypeId {268004ae-ef6b-4e9b-8425-127220d84719}; effective-permissions check
+  via getusereffectivepermissions(@u) with claims-encoded UPN; Low bitmask bit 1=ViewListItems,
+  bit 4=EditListItems
+
+## Commands & Outputs
+
+- Tokens: `bash scripts/get-token.sh 19a568e8-... sharepoint|sharepoint-admin|investigator`
+  (run from .claude/skills/remediation-tool)
+- Tenant defaults write: CSOM ProcessQuery SetProperty DefaultSharingLinkType/DefaultLinkPermission
+  with `<Parameter Type="Enum">1</Parameter>`; verified by re-read
+- Add to Visitors: `POST $SITE/_api/web/sitegroups(4)/users` body
+  `{"__metadata":{"type":"SP.User"},"LoginName":"i:0#.f|membership|<upn>"}`
+- Inheritance: `POST .../resetroleinheritance -d ''` (empty body mandatory — 411 otherwise)
+- Folder enum: RenderListDataAsStream, CAML RecursiveAll + FSObjType=1, NextHref paging
+- Effective perms: `getusereffectivepermissions(@u)?@u='i%3A0%23.f%7Cmembership%7C<upn>'`
+- Syncro: POST /tickets/109277420/comment → 424227376; PUT status Resolved;
+  POST add_line_item → 43315362; POST /invoices {ticket_id, customer_id} → invoice 1651084694
+  (#68053, total 0.0, line annotated "Applied 1.0 Prepay Hours"); prepay 3.0 → 2.0 verified
+
+## Pending / Incomplete Tasks
+
+- **Winter follow-up:** Birth Biologic prepay block at 2.0 hrs (< 4) — low-block renewal ping
+  sent to #bot-alerts (invoice 68053).
+- **#32492 (separate ticket, still Waiting on Customer since 7/1):** site-creation lockdown
+  (SelfServiceSiteCreationDisabled + Group.Unified restriction) awaiting Annise's go-ahead —
+  NOT part of this remediation.
+- Client may report access adjustments after coordinators notice the change — comment invited
+  them to reply if anything is unreachable/over-permissioned.
+
+## Reference Information
+
+- Syncro #32187 id 109277420, customer Birth Biologic 17983014; comment 424227376; line item
+  43315362; invoice 1651084694 (#68053); ticket URL
+  https://computerguru.syncromsp.com/tickets/109277420
+- Prior context logs: `session-logs/2026-07/2026-07-01-mike-remediation-tool-sharepoint-access-bb-32492.md`,
+  `clients/birth-biologic/session-logs/2026-07/2026-07-06-mike-birthbio-sharepoint-move-ownership.md`
+- Reference doc: `.claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md`
+- Discord thread 1527711911456538624; bot-alerts 1527729772442947634 (comment),
+  1527730372375478344 (low-block), 1527730411311071333 (billing)