claudetools/clients/birth-biologic/session-logs/2026-06/2026-06-26-mike-birthbio-mail-migration-and-datto-vm.md

## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

Worked two BirthBiologic migrations in parallel: the Datto Workplace → SharePoint migration and a
new Google Workspace → M365 mail migration. The Datto/SharePoint thread started as a "verify current
state" task but Mike clarified the migration host is a Jupiter VM, not BB-SERVER. Located it as the
libvirt domain "Windows Server 2016" (actual Windows hostname **ACG-DWP-X-BB**, actually Server 2019
build 17763) — an ACG-owned migration box running Datto Workplace Server + SPMT, **not enrolled in
RMM** and sitting on an APIPA address (no LAN). Diagnosed: host bridging was fine (vnet14 enslaved to
br0, carrier up); the guest simply wasn't getting a DHCP lease from pfSense after ~2 months parked.
Fixed with a static IP (172.16.3.45/22), installed the GuruRMM agent (enrolled under BirthBiologic /
Main Office), and confirmed Datto Workplace Server reconnected and is re-syncing. Established (via the
qemu guest agent and SPMT job storage) that the April 2026 migration only completed Supply Management
(160 files, custom script) + ITSvcs (excluded); the four large folders (Admin 5.8 GB, Donor Services
109 GB, Quality 28 GB, Activity Reports) were SPMT's job and last ran 2026-04-29 — completion still
unconfirmed. Per Mike, full reconciliation waits until Datto finishes re-syncing.

The larger thread was standing up the **Google Workspace → M365 mail migration** end-to-end. Confirmed
the Google super-admin (`sysadmin@birthbiologic.com`) lives in 1Password (Clients vault item "Google");
read it via the SOPS-vaulted 1Password service-account token and mirrored it into SOPS. Onboarded
BirthBio's tenant for **Exchange Operator** (already had Tenant Admin consented, so the suite was
provisioned programmatically — Exchange Operator SP created + Exchange Administrator role). Pulled the
authoritative Google roster via domain-wide delegation (20 accounts: 15 active, 5 suspended),
reconciled against M365, and surfaced two active accounts not on Mike's list (Dr. Chris Gillis
`medicaldirector@`, Michael Merritt `mmerritt@`) plus an address mismatch (Mindi is `mindim@` in
Google, `mmaher@` in M365).

Provisioned the M365 target side to Mike's licensing rules: active-12 → Business Premium (assigned BP
to Mei Mei + Valerie, freed Savanna's BP by moving her to Exchange-only); created Gillis + Merritt with
Exchange-only and vaulted their passwords; licensed the 4 disabled former employees with Exchange-only
(kept sign-in disabled) as future shared-mailbox targets. License math closed exactly: 14 Business
Premium + 7 Exchange Online Plan 1, all consumed.

Hit a real blocker creating the Gmail migration endpoint: Google returned `unauthorized_client … not
authorized for any of the scopes requested`. Root cause = the DWD grant had only 3 of Microsoft's
required **5** scopes (missing `m8/feeds` and `gmail.settings.sharing`); Google rejects the migration
token all-or-nothing. Verified the exact 5-scope string against live MS Learn + a Grok live-search
cross-check (Gemini CLI was down on this box), updated our runbook, and Mike re-authorized all 5 in the
BB Google console. After that the endpoint (`BB-Gmail`) created cleanly and **Batch 1 (14 live
mailboxes, mail + calendar + contacts) was created and auto-started — Status: Syncing**.

## Key Decisions

- **Datto VM gets a static IP (172.16.3.45), not a pfSense DHCP fix.** The fault was pfSense not
  leasing this MAC after a long park; a static on the ACG server range (172.16.3.x) is the reliable,
  convention-consistent fix. Follow-up: add a pfSense reservation or confirm it's outside the DHCP pool.
- **Enrolled the Datto VM under BirthBiologic / Main Office** (not AZ Computer Guru) since the box exists
  solely for BirthBio's migration and we had that site key; reversible (agents can be moved).
- **Former employees migrate to shared mailboxes via a temp Exchange-only license** (migrate into a
  licensed mailbox → convert to shared ≤50 GB = free → reclaim license). Source Google accounts must be
  **un-suspended** during migration (Gmail API can't read suspended accounts).
- **Licensing tiers (Mike's rules):** active-users-list → Business Premium; live Google accounts not yet
  in M365 (Gillis, Merritt) → Exchange-only ("E1" = Exchange Online Plan 1); formers → Exchange-only
  (reclaimable). `operations@` stays BP through migration. Existing BP users left on BP (not downgraded).
- **Batch sequencing:** live users first (Batch 1); formers as Batch 2 after un-suspending them in Google
  and freeing Workspace seats by suspending already-migrated live users.
- **Mindi mapped via the CSV `Username` column** (`EmailAddress=mmaher@`, `Username=mindim@`) — the
  proper MS mechanism — plus a belt-and-suspenders `mindim@` proxy on her mailbox.
- **Target delivery domain = `birthbiologic.onmicrosoft.com`** for Batch 1 (no routing subdomain exists;
  acceptable for a near-term cutover; MS prefers a subdomain for long coexistence).
- **Drove Exchange via REST `InvokeCommand`** (Exchange Operator app token) — the EXO PowerShell module
  isn't installed and the app has no vaulted cert, so app-only Connect-ExchangeOnline wasn't available.

## Problems Encountered

- **Datto VM on APIPA (no LAN).** Host bridging fine; pfSense wasn't leasing the MAC. Fixed with static
  172.16.3.45/22, GW 172.16.0.1, DNS 172.16.0.1+1.1.1.1. Verified gateway/internet/DNS + RMM check-in.
- **`vault.sh get-field` returned `null` (len 4)** for nested secrets until the field arg used dotted
  path: `credentials.client_secret`, `credentials.credential`. Plain leaf names don't resolve.
- **SPB skuId mismatch.** The scope doc's BP GUID (`cbdc14ab-d96c-4132-b7f4-1f3a3a819bb4`) was stale; the
  tenant's real SPB skuId is `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`. License assign 400'd until corrected.
- **License seat propagation lag** — Valerie's BP assign 400'd ("no available licenses") immediately after
  freeing Savanna's seat; succeeded on retry seconds later.
- **`proxyAddresses` read-only via Graph** — adding Mindi's alias required Exchange `Set-Mailbox` (EXO),
  not a Graph PATCH.
- **Gmail migration endpoint failed: `unauthorized_client … not authorized for any of the scopes
  requested`.** DWD had 3 of 5 required scopes. Got the verbatim 5-scope string from MS Learn + Grok;
  Mike re-authorized; endpoint then created.
- **`onboard365.sh` vault path** — looked at `/c/Users/guru/.claude/identity.json`; fixed by exporting
  `VAULT_ROOT_ENV=/d/vault` (logged as friction).
- **GCP API enable initially run as the wrong identity** — Mike first ran `gcloud services enable` as
  `sysadmin@birthbiologic.com` (no rights to ACG's project); succeeded once run as the ACG owner of
  `acg-msp-access`.
- **Gemini CLI down** (`throwIneligibleOrProjectIdError`, needs interactive re-login) — used Grok for the
  live-doc cross-check instead. Logged to errorlog.

## Configuration Changes

- **ACG-DWP-X-BB (Jupiter "Windows Server 2016" VM):** static IP 172.16.3.45/22, GW 172.16.0.1, DNS
  172.16.0.1 + 1.1.1.1 (persistent). GuruRMM agent installed (universal installer), enrolled BirthBiologic
  / Main Office, agent `a4524e85-8a07-45d0-91b1-51ce7e2ca74a`.
- **BirthBio M365 tenant (19a568e8-…):** onboarded Exchange Operator (+ Defender Add-on) SPs via
  `onboard365.sh provision`; roles assigned (Exchange Admin on Exchange Operator + Security Investigator,
  CA Admin on Tenant Admin, User Admin + Auth Admin on User Manager).
  - License changes: Mei Mei (`msenthavy`) +BP; Valerie (`vvaneaton`) +BP; Savanna (`sabron`) BP→EXO;
    created `medicaldirector@` (Gillis) +EXO and `mmerritt@` (Merritt) +EXO; licensed `aboutte`, `araso`,
    `khoffman`, `pnelson` with EXO (kept sign-in disabled).
  - `Set-Mailbox mmaher@` added secondary `smtp:mindim@birthbiologic.com`.
  - Created Gmail migration endpoint `BB-Gmail`; created + auto-started migration batch `BB-Batch1` (14
    users, TargetDeliveryDomain `birthbiologic.onmicrosoft.com`, NotificationEmails sysadmin@).
- **Vault (pushed):** `clients/birth-biologic/google-workspace.sops.yaml`,
  `clients/birth-biologic/m365-medicaldirector.sops.yaml`, `clients/birth-biologic/m365-mmerritt.sops.yaml`.
- **Repo:** updated `projects/msp-tools/runbooks/google-workspace-to-m365-migration.md` (exact 5-scope
  string + all-or-nothing gotcha + Contacts-API-retired/People-API + GCP-owner notes).
- **errorlog.md:** gemini CLI failure entry (+ onboard365 vault-path friction).

## Credentials & Secrets

- **Google Workspace super-admin** `sysadmin@birthbiologic.com` (source tenant) — sourced from 1Password
  Clients vault item "Google"; mirrored to SOPS `clients/birth-biologic/google-workspace.sops.yaml`
  (`credentials.password`, 19 chars). Used for admin.google.com console (DWD/API) + as the migration
  impersonation admin.
- **M365 mailbox — Dr. Chris Gillis** `medicaldirector@birthbiologic.com` — created this session; password
  vaulted at `clients/birth-biologic/m365-medicaldirector.sops.yaml` (forceChangePasswordNextSignIn=true).
- **M365 mailbox — Michael Merritt** `mmerritt@birthbiologic.com` — created this session; password vaulted
  at `clients/birth-biologic/m365-mmerritt.sops.yaml` (forceChangePasswordNextSignIn=true).
- App secrets used (already vaulted): Tenant Admin `msp-tools/computerguru-tenant-admin`
  (`credentials.client_secret`); Exchange Operator `msp-tools/computerguru-exchange-operator`
  (`credentials.client_secret`); Google SA `msp-tools/acg-msp-access-google-workspace`
  (`credentials.credential`, full JSON); 1Password service token
  `infrastructure/1password-service-account.sops.yaml`.

## Infrastructure & Servers

- **ACG-DWP-X-BB** — Jupiter libvirt domain "Windows Server 2016" (actually WS2019, build 17763). Windows
  hostname ACG-DWP-X-BB. NIC virtio 52:54:00:d4:8e:59 on br0 (vnet14). Static 172.16.3.45/22. Runs Datto
  Workplace Server (svc `datto_workplace_server.default`, proc WorkplaceServer) + SPMT (under
  Administrator profile). RMM agent `a4524e85-8a07-45d0-91b1-51ce7e2ca74a`. Datto source tree
  `C:\Users\Public\Desktop\Datto Workplace Server Projects`.
- **Jupiter** 172.16.3.20 (Unraid, virsh host). LAN 172.16.0.0/22, GW pfSense 172.16.0.1. guest-exec
  helper at `/root/gx.sh` on Jupiter.
- **BB-SERVER** — RMM agent `6c02baa7-0f1c-4990-b466-c9ab9eaefd3b`. Also has Datto Workplace Server + the
  original custom-script artifacts at `C:\GuruMigration` (bb-migration-state.json shows 160 Supply Mgmt +
  49 ITSvcs uploaded in April).
- **BirthBio M365 tenant** `birthbiologic.com` / `19a568e8-9e88-413b-9341-cbc224b39145`.
  - SPs: Tenant Admin `7a199b11-97fb-4e65-917d-f8d29a53ba49`; Exchange Operator
    `bab4699b-32a3-4434-9cad-7a4a08cc4d9e`; Security Investigator `bf684a4b-…`; User Manager `3347ebcc-…`;
    Defender Add-on `161b8f61-…`. New user objects: Gillis `1bd491e1-3ba6-4214-8c6d-46426f8681da`, Merritt
    `117a3367-cd5f-4565-af11-af5ff089224f`.
  - SKUs: Business Premium (SPB) `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46` (14/14); Exchange Online Plan 1
    (EXCHANGESTANDARD) `4b9405b0-7788-4568-add1-99614e613b69` (7/7). Accepted domains: birthbiologic.com
    (default), birthbiologic.onmicrosoft.com.
- **Google project** `acg-msp-access` (number 806899474449). SA `acg-msp-access@acg-msp-access.iam.gserviceaccount.com`,
  OAuth2 client ID `102231607889615995452`. APIs enabled: Gmail, Calendar (calendar-json), People.
- **Google roster (DWD pull):** 15 active, 5 suspended. Active staff emails per `clients/birth-biologic/
  docs/migration/google-to-m365-scope.md`; Mindi = `mindim@` (Google) ↔ `mmaher@` (M365).

## Commands & Outputs

- **Required Google DWD scopes (exact, 5, comma-separated, no spaces):**
  `https://mail.google.com/,https://www.googleapis.com/auth/calendar,https://www.google.com/m8/feeds/,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/contacts`
  (`m8/feeds` is a still-valid alias for the contacts scope, served by People API; legacy Contacts API
  retired 2022, not enableable, not needed.)
- EXO via REST: `POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand` with Exchange
  Operator app token (`scope=https://outlook.office365.com/.default`), body
  `{"CmdletInput":{"CmdletName":"…","Parameters":{…}}}`. byte[] params (ServiceAccountKeyFileData, CSVData)
  passed as **base64 strings**.
- `New-MigrationEndpoint -Gmail -Name BB-Gmail -ServiceAccountKeyFileData <b64> -EmailAddress sysadmin@birthbiologic.com` → created.
- `New-MigrationBatch -Name BB-Batch1 -SourceEndpoint BB-Gmail -CSVData <b64> -TargetDeliveryDomain birthbiologic.onmicrosoft.com -AutoStart -NotificationEmails sysadmin@` → Status=Syncing, Total=14.
- Get-MigrationUser BB-Batch1 → 14 Provisioning, 0 skipped (normal initial state).
- Datto source counts (ACG-DWP-X-BB): Admin 6,279/5.8GB · Donor Services 56,826/109GB · Quality 3,714/28GB
  · Supply Mgmt 160/33MB · Activity Reports 1 · ITSvcs 52 (excluded).

## Pending / Incomplete Tasks

- **Batch 1 monitor → MX cutover.** Watch `BB-Batch1` Provisioning→Syncing→Synced. When Synced: flip MX in
  SiteGround → M365, update SPF (`include:spf.protection.outlook.com`), enable/publish DKIM (2 CNAMEs),
  autodiscover CNAME → autodiscover.outlook.com, run final delta, then **complete** the batch.
- **Batch 2 — 5 former employees → shared.** Un-suspend each in Google (free Workspace seats by suspending
  migrated live users), run a Gmail batch (targets already EXO-licensed: aboutte, araso, khoffman, pnelson,
  sabron), then convert to shared mailboxes and reclaim the 5 EXO licenses.
- **Datto → SharePoint reconciliation.** After ACG-DWP-X-BB finishes re-syncing with Datto cloud, compare
  source vs each SharePoint site to confirm what the April SPMT run left unfinished (Admin / Donor Services
  / Quality / Activity Reports).
- **pfSense:** add a DHCP reservation for 172.16.3.45 (MAC 52:54:00:d4:8e:59) or confirm it's outside the pool.
- **Valerie VanEaton** — active (receiving daily; last *sent* 2026-05-13). Julie to confirm whether the
  mid-May send drop-off = leave/departure; if departed, move her to the former→shared track.
- **Decisions still open:** confirm Merritt's long-term tier; whether `operations@` becomes shared post-migration.
- **Wiki:** BirthBio article is stale (says migration incomplete / 13 mailboxes) — recompile.

## Reference Information

- Migration scope doc: `clients/birth-biologic/docs/migration/google-to-m365-scope.md`.
- Runbook (updated): `projects/msp-tools/runbooks/google-workspace-to-m365-migration.md`.
- MS Learn: `manually-configuring-gsuite-for-migration` (scope string), `automated-migration-neweac`,
  `google-workspace-migration-prerequisites`, `perform-g-suite-migration`.
- RMM install one-liner (BirthBio site): `irm https://rmm.azcomputerguru.com/install/BRIGHT-PEAK-5980/windows | iex`.
- Discord DMs to Mike: message_id 1520034139900739627 (initial DWD), 1520055625302675537 (corrected 5-scope).
- Vault enrollment key: `clients/birth-biologic/gururmm-site-main` (site BRIGHT-PEAK-5980, id 3b20ef97-…).

---

## Update: 04:42 PT (2026-06-27) — Datto->SharePoint delta completion, Quality recovery, April-vs-now reconcile, ticket #32187 billed

Continuation of the same session. Covers the SharePoint side: completing the additive delta, recovering an
accidentally-deleted Quality site, reconciling SharePoint to match Datto (source of truth), freezing the
Datto source, and updating/billing the Datto migration ticket.

### Session Summary (update)

After ACG-DWP-X-BB finished re-syncing with Datto cloud, ran the **Datto -> SharePoint delta**. The April
SPMT run was additive and never re-synchronized, so the delta only needed to add files that had never
transferred. Built `delta-recon-v2.ps1` (sanitize-aware reconcile: matches on both raw and sanitized
paths to find GENUINELY_MISSING files) and `delta-upload-v3.ps1` (simple-PUT for <=244MB auto-creating
parent folders, EnsureFolder + chunked for larger, FileShare.ReadWrite shared reads for Datto-locked
files, long-path `\\?\` for [IO.File] reads, SanRemote trim of leading/trailing spaces + trailing dots).
Reconciled to **0 missing** across Supply Management, Admin, Birth Biologic Activity Reports, Donor
Services (107 GB / ~57K files), and Quality. Renamed 19 Datto source files to match SharePoint (stripped
leading/trailing spaces + trailing dots).

**Quality site recovery.** The Quality Department SharePoint site was deleted 6/26. Unified audit log
showed `operations@` deleted the connected M365 Group, which cascaded (AAD -> SharePoint sync) to remove
the site. Restored from the SharePoint deleted-site recycle bin (cert-based app token; SP REST rejects
app-only tokens). Since Quality is being reorganized into the **Quality Systems Department (QSD)** site,
relocated the migrated Quality content there via server-side copy, then filled 44 missing + 3 file-lock
stragglers. Old `/sites/QualityDepartment` auto-purges ~7/26.

**April-vs-now divergence + mirror.** Because the April push was additive (not a sync), anything deleted,
moved, or changed in Datto after April was stale in SharePoint. Treating Datto as source of truth, built
a consolidated change-list (`consolidated_changelist.csv`): **1,583 deleted/moved + 161 modified (~1,744
differences)**. Cross-checked the SP unified audit log to find files users had created/edited directly in
SharePoint (operations@, ksteen, jbeck, etc. on live sites) and **flagged 11 to protect**. Ran
`mirror-execute.ps1` (re-validates each row against a frozen Datto set, DELETEs stale by path-addressed
Graph DELETE -> recycle bin, refreshes modified via PUT, skips protected): **deleted=1,564, refreshed=160,
protected-skip=11, fail=0**. For the 1 modified protected file, pushed the Datto version beside the user's
edit as "...Datto Copy.docx"; the 10 deleted/moved protected are SP-only (no Datto copy) -> left as-is.

**Froze the source.** Stopped + disabled the Datto Workplace Server service on ACG-DWP-X-BB so the source
no longer changes (also resolves the "reappearing files" complaint by removing the stale SP copies).

**Ticket #32187 (Datto, Syncro 109277420).** Posted a highly-detailed public+email completion/remediation
note and billed **5.0h Labor - Remote Business ($150/hr = $750)**. Posted #bot-alerts notifications.

### Key Decisions (update)

- **Datto = source of truth** for the reconcile; SharePoint mirrored to it. Deletes go to the SP recycle
  bin (recoverable 93 days), never hard-deleted.
- **Protect user-touched SP files** — never overwrite/delete the 11 flagged via audit log; for the one
  edited file, keep both (Datto pushed as "Datto Copy") rather than overwrite.
- **Relocate Quality content to QSD** rather than rebuild under the restored old site, matching the planned
  reorg; let the old site auto-purge.
- **Root-cause correction (Mike):** the "reappearing" files were NOT a Datto resurrection. They were stale
  SP copies sitting in SharePoint since the April additive push (files deleted from Datto after April were
  never removed from SP). Rewrote the ticket note's root-cause section accordingly.

### Problems Encountered (update)

- **SP REST "Unsupported app only token"** -> SharePoint requires a cert-based token; granted
  Sites.FullControl.All and used a client_assertion JWT (x5t = cert thumbprint b64url). Fixed.
- **Chunked-upload 400 into brand-new folders** -> switched to simple-PUT (auto-creates parents). Fixed.
- **Long-path SKIP-nofile** -> `\\?\` prefix for [IO.File] reads (not for Rename-Item/File.Move in PS5.1).
- **Filename 400s** = leading/trailing spaces / trailing dots -> SanRemote trim; renamed 19 source files.
- **Datto file-locks** -> FileShare.ReadWrite shared read. Fixed.
- **Background poller broke** (curl --data-binary @file errored each iteration due to $0-relative temp paths
  under run_in_background) -> read the mirror log directly instead. Logged as friction.
- **bot-alert missing link** -> first #bot-alerts post for #32187 omitted the mandated `-> <link>` tail; the
  helper posts text verbatim and does not auto-append. Reposted correctly + logged friction.

### Configuration Changes (update)

- Created on ACG-DWP-X-BB / scratchpad: `delta-recon-v2.ps1`, `delta-upload-v3.ps1`, `mirror-execute.ps1`,
  `consolidated_changelist.csv`, divergence CSVs, `mirror-execute.log`.
- Stopped + disabled Datto Workplace Server service on ACG-DWP-X-BB.
- Renamed 19 Datto source files (whitespace/trailing-dot cleanup) under
  `C:\Users\Public\Desktop\Datto Workplace Server Projects`.

### Pending / Incomplete Tasks (update)

- **Mail:** MX cutover still pending (Batch 1 complete). Then authorize Workspace write scopes
  (apps.licensing + admin.directory.user + Licensing API), unlicense migrated Google users, run Batch 2.
- **SP-only user files** (Shift Coms / DEMO and similar) — decide whether to fold into Datto.
- Old `/sites/QualityDepartment` auto-purges ~7/26 (no action needed).

### Reference Information (update)

- Datto migration ticket: #32187 (Syncro id 109277420). Comment id 420992239 (public+email);
  line item id 43043687 (5.0h Labor - Remote Business, product 1190473, $150).
- #bot-alerts: message_id 1520266361996316802 (corrected, with link).
- SP site IDs — Donor: `birthbiologic.sharepoint.com,bcbfa272-dc85-424c-af66-3f14c75ffeb4,8b0975dd-...`;
  Admin: `...,1baf65c1-c4b3-4602-9111-1f99ae800023,...`; Supply: `...,4700ecf3-25ba-41b6-918c-9fe620038172,...`;
  QSD: `...,3173c017-58bd-406a-8858-2c969667336f,...`.
- Tenant 19a568e8-9e88-413b-9341-cbc224b39145; Graph app client 709e6eed-0711-4875-9c44-2d3518c47063.