# [RECOVERED] Use Intune with Apple devices

> **[RECOVERED -- UNVERIFIED]** Auto-reconstructed from transcript eca77c0f-b935-4fb5-8d8a-da3a5c230afe (2026-05-23T23:58:47.026Z .. 2026-05-24T00:21:10.410Z) on 2026-06-01. Prose sections are Ollama-drafted from the transcript and may be imprecise; the Commands/Config/Reference sections are extracted verbatim. Review and correct, then remove this banner.

## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

The session focused on setting up Apple Business Manager (ABM) for integration with Microsoft Intune to manage Apple devices. The team verified the existence of an Apple ABM verification email sent to the admin@azcomputerguru.com mailbox, which was found to be non-existent. The verification email was located in the mike@azcomputerguru.com mailbox. The team then proceeded to add an alias, apple@azcomputerguru.com, to the admin@azcomputerguru.com distribution group to facilitate future communication. Despite initial issues with adding the alias, the team successfully configured the alias using the Exchange Admin API, ensuring it was recognized and functional.

## Key Decisions

- Adding `apple@azcomputerguru.com` as an alias to the `admin@azcomputerguru.com` distribution group to streamline ABM communication.
- Using the Exchange Admin API to ensure the alias was added correctly, given the initial failure with the REST endpoint.

## Problems Encountered

- The `admin@azcomputerguru.com` mailbox did not exist, requiring the team to search for alternative mailboxes.
- Initial attempts to add the alias to the distribution group failed, necessitating a switch to the Exchange Admin API for proper configuration.
- The alias was not recognized initially, prompting a re-evaluation of the request format to align with the API's expected input.

## Configuration Changes

_Machine-extracted verbatim from the transcript (file targets of Write/Edit/NotebookEdit)._

- none detected

## Credentials & Secrets

_Machine-extracted; review carefully -- secrets are not auto-harvested from transcripts._

- none detected (verify against the Commands & Outputs section)

## Infrastructure & Servers

_Machine-extracted verbatim (IP / hostname regex hits across the whole transcript)._

- **Hosts:** `business.apple.com`, `identity.apple.com`, `yourdomain.com`, `azcomputerguru.com`, `vault.sh`, `get-token.sh`, `onboard-tenant.sh`, `patch-tenant-admin-manifest.sh`, `resolve-tenant.sh`, `tenant-sweep.sh`, `user-breach-check.sh`, `schemas.xmlsoap.org`, `schemas.microsoft.com`, `graph.microsoft.com`, `azcomputerguru.onmicrosoft.com`, `outlook.office365.com`, `microsoft.exchange.admin.odata.core.odataserviceexception`, `microsoft.exchange.data.proxyaddresscollection`, `newtonsoft.json.linq.jproperty`, `microsoft.exchange.data.proxyaddress`, `microsoft.exchange.adminapi.commandinvocation.parametertransformationexception`, `adminapi.warnings`, `odata.type`, `odata.context`, `exchange.generichashtable`

## Commands & Outputs

_Machine-extracted verbatim: mutating Bash/PowerShell commands with truncated output._

```
test -f D:/vault/scripts/vault.sh && echo "vault ok" || echo "vault missing"
```
Output: vault ok

```
TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

# EWS FindItem - search for emails from Apple in admin mailbox
curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
  xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
  <soap:Header>
    <t:RequestServerVersion Version="Exchange2016"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>admin@azcomputerguru.com</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal="Shallow">
      <m:ItemShape>
        <t:BaseShape>AllProperties</t:BaseShape>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned="20" Offset="0" BasePoint="Beginning"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="message:From"/>
            <t:Constant Value="apple.com"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="Apple Business Manager"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="ABM"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="business.apple.com"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="verify"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id="inbox"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>'
```
Output: <?xml version="1.0" encoding="utf-8"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><s:Fault><faultcode xmlns:a="http://schemas.microsoft.com/exchange/services/2006/types">a:ErrorNonExistentMailbox</faultcode><faultstring xml:lang="en-US">The SMTP address has no mailbox ass ... [truncated]

```
TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

search_mailbox() {
  local MAILBOX=$1
  echo "=== Searching $MAILBOX ==="
  curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -d "<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"
  xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\"
  xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\">
  <soap:Header>
    <t:RequestServerVersion Version=\"Exchange2016\"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>$MAILBOX</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal=\"Shallow\">
      <m:ItemShape>
        <t:BaseShape>IdOnly</t:BaseShape>
        <t:AdditionalProperties>
          <t:FieldURI FieldURI=\"item:Subject\"/>
          <t:FieldURI FieldURI=\"message:From\"/>
          <t:FieldURI FieldURI=\"item:DateTimeReceived\"/>
        </t:AdditionalProperties>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned=\"10\" Offset=\"0\" BasePoint=\"Beginning\"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"message:From\"/>
            <t:Constant Value=\"apple.com\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"Apple Business Manager\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"appleid\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"verify your\"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id=\"inbox\"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>" | grep -oP '(?<=<t:Subject>)[^<]+|(?<=<t:From>)[^<]+|(?<=<t:DateTimeReceived>)[^<]+|ErrorNonExistentMailbox|TotalItemsInView="\K[0-9]+'
}

search_mailbox "mike@azcomputerguru.com"
search_mailbox "support@azcomputerguru.com"
```
Output: Exit code 2
=== Searching mike@azcomputerguru.com ===
grep: -P supports only unibyte and UTF-8 locales
=== Searching support@azcomputerguru.com ===
grep: -P supports only unibyte and UTF-8 locales

```
TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

ews_search() {
  local MAILBOX=$1
  echo "=== $MAILBOX ==="
  curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -d "<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"
  xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\"
  xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\">
  <soap:Header>
    <t:RequestServerVersion Version=\"Exchange2016\"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>$MAILBOX</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal=\"Shallow\">
      <m:ItemShape>
        <t:BaseShape>IdOnly</t:BaseShape>
        <t:AdditionalProperties>
          <t:FieldURI FieldURI=\"item:Subject\"/>
          <t:FieldURI FieldURI=\"message:From\"/>
          <t:FieldURI FieldURI=\"item:DateTimeReceived\"/>
        </t:AdditionalProperties>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned=\"10\" Offset=\"0\" BasePoint=\"Beginning\"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"message:From\"/>
            <t:Constant Value=\"apple.com\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"Apple Business Manager\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"verify your\"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id=\"inbox\"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>" | grep -oE '<t:Subject>[^<]+</t:Subject>|<t:From>[^<]+</t:From>|<t:DateTimeReceived>[^<]+</t:DateTimeReceived>|TotalItemsInView="[0-9]+"'
}

ews_search "mike@azcomputerguru.com"
ews_search "support@azcomputerguru.com"
```
Output: === mike@azcomputerguru.com ===
TotalItemsInView="1"
<t:Subject>Verify your Apple Account email address.</t:Subject>
<t:DateTimeReceived>2026-05-24T00:09:56Z</t:DateTimeReceived>
=== support@azcomputerguru.com ===
TotalItemsInView="0"

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# First, look up the distribution group via EXO InvokeCommand
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '{Name: .value[0].Name, PrimarySmtpAddress: .value[0].PrimarySmtpAddress, EmailAddresses: .value[0].EmailAddresses}'
```
Output: {

  "Name": "admin@azcomputerguru.com",

  "PrimarySmtpAddress": "admin@azcomputerguru.com",

  "EmailAddresses": [

    "smtp:developer@azcomputerguru.com",

    "SMTP:admin@azcomputerguru.com",

    "smtp:Sifo-Office@azcomputerguru.com",

    "smtp:sifoidak@azcomputerguru.com",

    "smtp:admin_a ... [truncated]

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": {
          "Add": ["smtp:apple@azcomputerguru.com"]
        }
      }
    }
  }' | jq '.'
```
Output: {

  "error": {

    "code": "BadRequest",

    "message": "Invalid Operation",

    "innererror": {

      "message": "Invalid Operation",

      "type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",

      "stacktrace": "",

      "internalexception": {

        "message": "Cannot p ... [truncated]

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# Pass the full EmailAddresses array with apple@ appended
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": [
          "smtp:developer@azcomputerguru.com",
          "SMTP:admin@azcomputerguru.com",
          "smtp:Sifo-Office@azcomputerguru.com",
          "smtp:sifoidak@azcomputerguru.com",
          "smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",
          "smtp:apple@azcomputerguru.com"
        ]
      }
    }
  }' | jq '.'
```
Output: {

  "@odata.context": "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable)",

  "adminapi.warnings@odata.type": "#Collection(String)",

  "@adminapi.warnings": [],

  "value": []

}

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# Verify the alias was added
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '.value[0].EmailAddresses'
```
Output: [

  "smtp:developer@azcomputerguru.com",

  "SMTP:admin@azcomputerguru.com",

  "smtp:Sifo-Office@azcomputerguru.com",

  "smtp:sifoidak@azcomputerguru.com",

  "smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",

  "X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF2 ... [truncated]

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"CmdletInput\": {
      \"CmdletName\": \"Set-DistributionGroup\",
      \"Parameters\": {
        \"Identity\": \"admin@azcomputerguru.com\",
        \"EmailAddresses\": \"@{Add='smtp:apple@azcomputerguru.com'}\"
      }
    }
  }" | jq '.'
```
Output: {

  "error": {

    "code": "BadRequest",

    "message": "Invalid Operation",

    "innererror": {

      "message": "Invalid Operation",

      "type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",

      "stacktrace": "",

      "internalexception": {

        "message": "Cannot p ... [truncated]

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": [
          "smtp:developer@azcomputerguru.com",
          "SMTP:admin@azcomputerguru.com",
          "smtp:Sifo-Office@azcomputerguru.com",
          "smtp:sifoidak@azcomputerguru.com",
          "smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",
          "X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=3ba6a831669c4577a3badb895e16a0a8-ACG A",
          "smtp:apple@azcomputerguru.com"
        ]
      }
    }
  }' | jq '.'
```
Output: {

  "@odata.context": "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable)",

  "adminapi.warnings@odata.type": "#Collection(String)",

  "@adminapi.warnings": [],

  "value": []

}

```
EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '.value[0].EmailAddresses'
```
Output: [

  "X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=3ba6a831669c4577a3badb895e16a0a8-ACG A",

  "smtp:apple@azcomputerguru.com",

  "smtp:developer@azcomputerguru.com",

  "SMTP:admin@azcomputerguru.com",

  "smtp:Sifo-Office@azcomputerguru.com",

  " ... [truncated]

## Pending / Incomplete Tasks

- None.

## Reference Information

_Machine-extracted verbatim from the whole transcript via regex. Treat as leads, not gospel; deduped._

- **URLs:** http://schemas.xmlsoap.org/soap/envelope/, http://schemas.microsoft.com/exchange/services/2006/types, http://schemas.microsoft.com/exchange/services/2006/errors, https://graph.microsoft.com/v1.0/users?$, https://outlook.office365.com/admin, https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable