diff --git a/clients/birth-biologic/session-logs/2026-07/2026-07-17-mike-sharepoint-permissions-remediation-32187.md b/clients/birth-biologic/session-logs/2026-07/2026-07-17-mike-sharepoint-permissions-remediation-32187.md new file mode 100644 index 00000000..823e5943 --- /dev/null +++ b/clients/birth-biologic/session-logs/2026-07/2026-07-17-mike-sharepoint-permissions-remediation-32187.md @@ -0,0 +1,141 @@ +# Birth Biologic — SharePoint Permissions Remediation (Donor Services site) — Syncro #32187 + +## User +- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG) +- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin +- **Role:** automation (acting on the requester's behalf) + +## Session Summary + +Discord-bot session (thread 1527711911456538624). Mike asked for a `/sync` and a check of the +Birth Biologic ticket reply. Annise (client) had replied on Syncro #32187 approving the SharePoint +permissions plan Mike emailed 7/16: lock the Donor Services site down so the 6 Donation +Coordinators are read-only, kill the org-wide edit links, and consolidate the scattered +folder-by-folder permissions. Mike said "Go for it", confirmed the detailed execution preview +with YES, and the full remediation was executed live on the tenant via the remediation-tool +SharePoint tiers (cert-based app-only tokens, Tenant Admin app, Sites.FullControl.All). + +Four steps executed and verified on tenant 19a568e8-9e88-413b-9341-cbc224b39145: +(1) Tenant sharing defaults via CSOM admin API — DefaultSharingLinkType 3→1 (Anyone→Specific +people) and DefaultLinkPermission 0→1 (View). (2) Added the six Donation Coordinators (Christina +Cox, Valerie VanEaton, Ashley Williams, Lastashia May, Mei Mei Senthavy, Mindi Maher) to the +Donor Services site Visitors group (id 4) — read-only site-wide. (3) Restored role inheritance +on the Documents library (78,378 items), the 5 unique-permission folders (found by depth-limited +probing, not brute force over 20,540 folders), and the 10 individually-shared files — order +mattered: the "Acquisition and Lab Processes" folder had no Members-Edit grant, so inheritance +was reset BEFORE deleting sharing links to avoid locking out editors. (4) Removed all 14 +SharingLinks.*.OrganizationEdit site groups — 13 were auto-cleaned by the inheritance resets +(the 404s on removebyid were expected, not errors), 1 orphan (group 28, deleted file) removed +manually. Zero SharingLinks groups remain. + +Verified via getusereffectivepermissions on a Suitability doc: ccox and mmaher view=YES/edit=no +(coordinators), vfountain and ksteen view=YES/edit=YES (editors) — exactly the intended posture, +no lockouts. + +Closed out on Syncro: posted the customer-visible completion reply to Annise as Mike (comment +424227376, emailed), set #32187 to Resolved per Mike, and billed 1.0 hr Remote Labor per Mike. +Invoice 68053 netted $0 — applied 1 prepay hour (block 3.0 → 2.0). Low-block invoice note set +and Winter pinged in #bot-alerts (block now under 4 hrs). Bot-alerts posted for the comment, +status change, and billing. + +## Key Decisions + +- **Inheritance reset BEFORE sharing-link deletion** on folders whose editors depended on the + org-wide edit link (Acquisition and Lab Processes had no Members-Edit grant) — reversing the + order would have locked out working editors mid-change. +- **Depth-limited folder probing** (164 folders at depth ≤7) instead of per-folder permission + checks across all 20,540 folders — found all 5 unique-permission folders; unique permissions + live shallow in this library. +- **RenderListDataAsStream with CAML paging** for folder enumeration — OData $filter throws + SPQueryThrottledException on the 78k-item list. +- **Treated 13 removebyid 404s as success, verified end state instead of retrying** — inheritance + resets auto-delete orphaned SharingLinks groups; confirmed zero SharingLinks groups remained. +- **The "Inclement Weather" folder reset was safe** — its per-user Read grants to the 6 + coordinators were the old manual workaround, now superseded by Visitors membership. +- **Status → Waiting on Customer initially, then Resolved on Mike's explicit instruction** + ("1hr labor - resolved status"). +- **Billing as Remote Labor (1190473) at 1.0 hr** — prepaid customer, so the invoice auto-applied + 1 prepay hour ($0 due); correct behavior, not an error. + +## Problems Encountered + +- **OData folder query silently returned 0 rows** then surfaced SPQueryThrottledException (list + view threshold, 78,378 items) — switched to RenderListDataAsStream with CAML + `` + FSObjType=1 filter and NextHref paging. +- **All resetroleinheritance POSTs returned HTTP 411** (Length Required) — SharePoint REST POSTs + need an explicit empty body: retry with `-d ''` → all 200. +- **Graph group lookup by mail returned empty** for donorservices@ — used + `$search="displayName:donor"` with ConsistencyLevel: eventual; two same-named groups existed, + picked the site-connected one (11d28c77) by matching its member list to the 7/16 plan email. +- **13 of 14 sitegroups/removebyid returned 404** — expected: the inheritance resets had already + auto-deleted those SharingLinks groups. Verified final group list instead of retrying. + +## Configuration Changes + +- **No repo file changes** (live-tenant work only). Scratch files (.sg.json, .folders.tsv, + .unique-folders.tsv, .spadm.err) in the remediation-tool skill dir were cleaned up. +- **Birth Biologic tenant (live SharePoint changes):** + - Tenant sharing: DefaultSharingLinkType = 1 (Specific people), DefaultLinkPermission = 1 (View) + - Donor Services site Visitors group (id 4): +6 members (ccox, vvaneaton, awilliams, lmay, + msenthavy, mmaher @birthbiologic.com) + - Documents library (guid 7924d2ff-a79f-4b93-a38d-0c779146b525), folders 4/5/154329/154506/155622, + and 10 shared files: role inheritance restored (HasUniqueRoleAssignments=false everywhere) + - All 14 SharingLinks.*.OrganizationEdit site groups removed (13 auto, orphan group 28 manual) +- **Syncro #32187** (id 109277420): comment 424227376 (customer-visible, emailed), status → + Resolved, line item 43315362 (1.0 hr Labor - Remote Business), invoice 68053 ($0, 1 prepay hr + applied), invoice note "Block hours remaining: 2. You're running low..." + +## Credentials & Secrets + +- No new credentials. Used ComputerGuru Tenant Admin app (709e6eed-0711-4875-9c44-2d3518c47063, + vault `msp-tools/computerguru-tenant-admin.sops.yaml`) via get-token.sh `sharepoint` / + `sharepoint-admin` tiers (cert-based — SharePoint rejects client_secret tokens) and + `investigator` tier for Graph reads. Syncro: Mike's per-user key via syncro-env.sh + (CLAUDETOOLS_REQUESTER_USER=mike). + +## Infrastructure & Servers + +- Birth Biologic M365 tenant: 19a568e8-9e88-413b-9341-cbc224b39145 +- SharePoint: birthbiologic.sharepoint.com / birthbiologic-admin.sharepoint.com +- Donor Services site: /sites/DonorServices (M365 group 11d28c77-...), Documents library + guid 7924d2ff-a79f-4b93-a38d-0c779146b525, 78,378 items / 20,540 folders +- Site groups after remediation: 6 standard only (Owners/Members/Visitors + system) +- CSOM Tenant admin TypeId {268004ae-ef6b-4e9b-8425-127220d84719}; effective-permissions check + via getusereffectivepermissions(@u) with claims-encoded UPN; Low bitmask bit 1=ViewListItems, + bit 4=EditListItems + +## Commands & Outputs + +- Tokens: `bash scripts/get-token.sh 19a568e8-... sharepoint|sharepoint-admin|investigator` + (run from .claude/skills/remediation-tool) +- Tenant defaults write: CSOM ProcessQuery SetProperty DefaultSharingLinkType/DefaultLinkPermission + with `1`; verified by re-read +- Add to Visitors: `POST $SITE/_api/web/sitegroups(4)/users` body + `{"__metadata":{"type":"SP.User"},"LoginName":"i:0#.f|membership|"}` +- Inheritance: `POST .../resetroleinheritance -d ''` (empty body mandatory — 411 otherwise) +- Folder enum: RenderListDataAsStream, CAML RecursiveAll + FSObjType=1, NextHref paging +- Effective perms: `getusereffectivepermissions(@u)?@u='i%3A0%23.f%7Cmembership%7C'` +- Syncro: POST /tickets/109277420/comment → 424227376; PUT status Resolved; + POST add_line_item → 43315362; POST /invoices {ticket_id, customer_id} → invoice 1651084694 + (#68053, total 0.0, line annotated "Applied 1.0 Prepay Hours"); prepay 3.0 → 2.0 verified + +## Pending / Incomplete Tasks + +- **Winter follow-up:** Birth Biologic prepay block at 2.0 hrs (< 4) — low-block renewal ping + sent to #bot-alerts (invoice 68053). +- **#32492 (separate ticket, still Waiting on Customer since 7/1):** site-creation lockdown + (SelfServiceSiteCreationDisabled + Group.Unified restriction) awaiting Annise's go-ahead — + NOT part of this remediation. +- Client may report access adjustments after coordinators notice the change — comment invited + them to reply if anything is unreachable/over-permissioned. + +## Reference Information + +- Syncro #32187 id 109277420, customer Birth Biologic 17983014; comment 424227376; line item + 43315362; invoice 1651084694 (#68053); ticket URL + https://computerguru.syncromsp.com/tickets/109277420 +- Prior context logs: `session-logs/2026-07/2026-07-01-mike-remediation-tool-sharepoint-access-bb-32492.md`, + `clients/birth-biologic/session-logs/2026-07/2026-07-06-mike-birthbio-sharepoint-move-ownership.md` +- Reference doc: `.claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md` +- Discord thread 1527711911456538624; bot-alerts 1527729772442947634 (comment), + 1527730372375478344 (low-block), 1527730411311071333 (billing)