# Cascades Tucson — Intune / MDM Prerequisites Gap Check

- **Date:** 2026-04-19 (UTC)
- **Tenant:** `cascadestucson.com` (`207fa277-e9d8-4eb7-ada1-1064d2221498`)
- **Intune account ID:** `15b6c28c-47fa-40b0-a6af-b9e03ab959c3`
- **Method:** Read-only Graph API via Claude-MSP-Access app (no changes made)
- **Goal:** establish what's configured vs. what needs setup before enrolling 25 shared Android phones (AESDM) + 9 kitchen iPads (Intune DEM)

---

## Findings

| # | Prereq | Status | Notes |
|---|---|---|---|
| 1 | **MDM authority = Intune** | Not set (`null`) | `intuneAccountId` is populated so Intune is provisioned. Just the authority flag hasn't been toggled. One-click in the admin center. One-time irreversible choice. |
| 2 | **Apple MDM push certificate** | Not configured (`ResourceNotFound`) | Blocks ALL iPad/iOS management. Must generate at `identity.apple.com/pushcert` and upload. Annual renewal. |
| 3 | **Apple Business Manager / DEP token** | 0 tokens | Optional for 9 iPads — manual enrollment works without it, but lose management on factory reset. Recommended. |
| 3b | **Apple VPP token** | 0 tokens | Not required unless paid iPad apps need to be pushed. Skip for kitchen POS scenario. |
| 4 | **Managed Google Play enterprise** | `bindStatus: notBound` / `enrollmentTarget: none` | Blocks ALL Android Enterprise management (AESDM, dedicated, work profile). One-click bind in the admin center, sign in with a Cascades Google account. |

## Existing Intune objects

| Object | Count | Notes |
|---|---|---|
| Compliance policies | 0 | Clean slate |
| Device configuration profiles | 0 | Clean slate |
| Enrollment configurations | 5 | All are Microsoft built-in defaults (device limit, platform restrictions, WHfB, Windows 10 ESP, Windows Restore). None custom. |
| Android Device Owner enrollment profiles | 0 | None (need for AESDM / dedicated device mode) |
| Managed devices | 0 | None enrolled |

---

## Gap list — what Howard needs to do before enrolling devices

### Must-do (blocking)

1. **Set MDM authority to Intune.**
   Admin center → *Tenant administration → Mobile Device Management authority* → pick **Microsoft Intune**. Takes 5 seconds. Cannot be undone. Is a hard prerequisite for every step below.

2. **Upload Apple MDM push certificate.**
   Required for any iPad management. Process:
   - Intune admin center → *Devices → iOS/iPadOS → Enrollment → Apple MDM Push Certificate*
   - Download CSR from Intune
   - Upload CSR at `identity.apple.com/pushcert` using a *dedicated* Apple ID (recommend `mdm-push@cascadestucson.com` so turnover doesn't break it — not Meredith's personal, not kitchenipads@)
   - Download the `.pem` cert from Apple, upload back into Intune
   - **Annual renewal** on the same Apple ID — if the Apple ID is lost, ALL enrolled iPads must be wiped and re-enrolled

3. **Bind Managed Google Play account.**
   Required for AESDM and any Android Enterprise policies.
   - Intune admin center → *Devices → Android → Android Enterprise → Managed Google Play*
   - Click *Launch Google* → sign in with a dedicated Google account (recommend `managedplay@cascadestucson.com`, NOT a personal Google account)
   - Accept terms, link → bindStatus becomes `bound`

### Should-do (strong recommendation)

4. **Create Apple Business Manager account and link to Intune.**
   - Sign up at `business.apple.com` (free, takes ~15 min + an Apple ID verification phone call for the D-U-N-S number)
   - Create an MDM server entry in ABM named "Intune — Cascades"
   - Download ABM token, upload to Intune at *Enrollment → Apple → Enrollment program tokens*
   - For existing iPads: add their serial numbers to ABM manually (one-time)
   - For future iPads: buy them through Apple or an ABM-linked reseller and they auto-appear

### Not needed for current scope

5. **Apple VPP token** — only needed if pushing paid apps. Kitchen POS app is probably free or sideloaded.
6. **Windows Autopilot** — 89 Entra-registered Windows PCs exist, but Windows management is out of scope for this pass.

---

## Dependencies (do in this order)

```
Step 1 (MDM authority)
  │
  ├── Step 3 (Google Play bind) ──► can enroll Android phones
  │
  ├── Step 2 (Apple push cert) ──► can manually enroll iPads
  │        │
  │        └── Step 4 (ABM + token) ──► iPads auto-enroll + survive reset
```

Steps 1 and 3 together unlock the 25 Android phones. Steps 1 + 2 together unlock the 9 iPads (with ABM as the recommended polish).

---

## Policy scaffold (to be built after prereqs)

For the Android phones (AESDM):
- Enrollment profile: Android Enterprise *Corporate-owned, dedicated device*, mode = *AOSP multi-user* (this is AESDM) — generates a token/QR code for device enrollment
- Compliance policy: encryption on, screen lock 4+ digits, 2-min timeout, no developer options, no debugging, Android 11+
- Configuration profile: Wi-Fi (CSCNet), restrictions (no factory reset, no USB transfer, no unknown sources)
- Apps: Company Portal (system), Authenticator, Edge, ALIS (as web app), Teams — required, auto-install

For the kitchen iPads (Intune DEM):
- Create `dem-ipads@cascadestucson.com` user with Business Premium license assigned, mark as Device Enrollment Manager
- Enrollment profile: iOS/iPadOS, device-without-user-affinity, kiosk mode
- Compliance policy: passcode required, encryption on, no jailbreak
- Configuration profile: Wi-Fi (CSCNet VLAN 20), Single App Mode locked to the kitchen POS app, disable App Store, disable Settings
- Apps: kitchen POS app (required)

---

## Data sources

Raw Graph responses cached at `/tmp/remediation-tool/207fa277-e9d8-4eb7-ada1-1064d2221498/intune-prereqs/`:
- `org.json` — organization object (MDM authority field)
- `devicemgmt-beta.json` — deviceManagement root
- `apple-push.json` — Apple push cert
- `dep.json` — DEP tokens
- `vpp.json` — VPP tokens
- `gplay.json` — Managed Google Play binding
- `compliance.json`, `configs.json`, `enrollment.json` — existing policies
- `android-doe.json` — Android Device Owner enrollment profiles
- `managed-devices.json` — enrolled device inventory