Mike Swanson
aa9bd26df8
Reconstructed from local transcripts via the new recovery engine. These were substantive sessions never saved with /save. All banner-marked RECOVERED-UNVERIFIED. Notable recoveries: Peaceful Spirit RADIUS/VPN buildout (full command trail), RMM agent check-in comparison, Kristen Datto Workplace sync, Intune+Apple. guru-rmm/guru-connect-scoped logs routed to root session-logs (submodule convention). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
69 lines
4.8 KiB
Markdown
69 lines
4.8 KiB
Markdown
# [RECOVERED] Add developer@ email alias for admin@
|
|
|
|
> **[RECOVERED -- UNVERIFIED]** Auto-reconstructed from transcript 4500e953-49fe-406c-b619-03a35154efc7 (2026-05-15T23:20:09.420Z .. 2026-05-15T23:45:09.907Z) on 2026-06-01. Prose sections are Ollama-drafted from the transcript and may be imprecise; the Commands/Config/Reference sections are extracted verbatim. Review and correct, then remove this banner.
|
|
|
|
## User
|
|
- **User:** Mike Swanson (mike)
|
|
- **Machine:** GURU-5070
|
|
- **Role:** admin
|
|
|
|
## Session Summary
|
|
|
|
The session focused on adding an email alias for the "ACG Admin" distribution group in Exchange Online. Initially, the alias `developer@azcomputerguru.com` was to be added as a secondary SMTP address for the group's primary email `admin@azcomputerguru.com`. A script was used to resolve the tenant and verify the group's current state, revealing that the group was a mail-enabled distribution list managed by Exchange, not Azure AD.
|
|
|
|
The Exchange Operator service principal lacked the Exchange Administrator role, causing permission errors when attempting to modify the group's proxy addresses. The role was assigned to resolve this, enabling the alias addition. The alias was successfully added via Exchange Online, and the change was verified.
|
|
|
|
A secondary task involved searching for emails sent to the group's primary email address, which revealed an Apple Account verification email and a stalled Apple Developer enrollment. These were flagged as pending actions for the user to address.
|
|
|
|
## Key Decisions
|
|
|
|
- Use the Exchange Operator service principal to manage the distribution group alias due to its Exchange-specific capabilities.
|
|
- Assign the Exchange Administrator role to the Exchange Operator service principal to resolve permission issues.
|
|
- Add the alias via Exchange Online instead of Azure AD Graph, as the latter could not modify proxy addresses for distribution lists.
|
|
|
|
## Problems Encountered
|
|
|
|
- The Exchange Operator service principal lacked the Exchange Administrator role, causing 403 errors during proxy address modifications.
|
|
- The script initially attempted to use Azure AD Graph, which could not modify Exchange-managed distribution group settings.
|
|
- The alias addition required a full proxyAddresses replacement, which was not supported via REST in the expected format.
|
|
|
|
## Configuration Changes
|
|
|
|
_Machine-extracted verbatim from the transcript (file targets of Write/Edit/NotebookEdit)._
|
|
|
|
- none detected
|
|
|
|
## Credentials & Secrets
|
|
|
|
_Machine-extracted; review carefully -- secrets are not auto-harvested from transcripts._
|
|
|
|
- none detected (verify against the Commands & Outputs section)
|
|
|
|
## Infrastructure & Servers
|
|
|
|
_Machine-extracted verbatim (IP / hostname regex hits across the whole transcript)._
|
|
|
|
- **Hosts:** `azcomputerguru.com`, `patch-tenant-admin-manifest.sh`, `resolve-tenant.sh`, `user-breach-check.sh`, `tenant-sweep.sh`, `onboard-tenant.sh`, `get-token.sh`, `vault.sh`, `login.microsoftonline.com`, `odata.context`, `graph.microsoft.com`, `azcomputerguru.onmicrosoft.com`, `microsoft.exchange.admin.odata.core.odataserviceexception`, `microsoft.exchange.data.proxyaddresscollection`, `newtonsoft.json.linq.jproperty`, `microsoft.exchange.data.proxyaddress`, `microsoft.exchange.adminapi.commandinvocation.parametertransformationexception`, `adminapi.warnings`, `odata.type`, `outlook.office365.com`, `exchange.generichashtable`, `mail.read`, `id.apple.com`, `email.apple.com`, `identity.json`, `2026-05-15-session.md`, `sync.sh`
|
|
|
|
## Commands & Outputs
|
|
|
|
_Machine-extracted verbatim: mutating Bash/PowerShell commands with truncated output._
|
|
|
|
```
|
|
test -f D:/vault/scripts/vault.sh && echo "vault OK" || echo "vault MISSING"
|
|
```
|
|
Output: vault OK
|
|
|
|
## Pending / Incomplete Tasks
|
|
|
|
- The Apple Account verification email requires user action to complete the verification process.
|
|
- The Apple Developer enrollment HH5UA87LAH is stalled and needs identity verification.
|
|
- A full tenant onboard script for `azcomputerguru.com` was not executed, leaving potential gaps in role assignments for other MSP applications.
|
|
|
|
## Reference Information
|
|
|
|
_Machine-extracted verbatim from the whole transcript via regex. Treat as leads, not gospel; deduped._
|
|
|
|
- **Commit SHAs:** `de8d2de`
|
|
- **URLs:** https://login.microsoftonline.com/${DOMAI, https://graph.microsoft.com/v1.0/$metadata#users(displayName,userPrincipalName,mail,proxyAddresses,id, https://graph.microsoft.com/v1.0/$metadata#groups(id,displayName,mail,proxyAddresses,groupTypes,mailEnabled, https://graph.microsoft.com/v1.0/$metadata#roleManagement/directory/roleAssignments, https://graph.microsoft.com/v1.0/$metadata#roleManagement/directory/roleAssignments/$entity, https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable
|