azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
295126ee6c4abe2588f94de0e022eabdbb1c925d
claudetools/clients/azcomputerguru.com/session-logs/2026-05-23-recovered-use-intune-with-apple-devices.md
Mike Swanson aa9bd26df8 chore: backfill 12 recovered session logs (reviewed) 
Reconstructed from local transcripts via the new recovery engine. These
were substantive sessions never saved with /save. All banner-marked
RECOVERED-UNVERIFIED. Notable recoveries: Peaceful Spirit RADIUS/VPN
buildout (full command trail), RMM agent check-in comparison, Kristen
Datto Workplace sync, Intune+Apple. guru-rmm/guru-connect-scoped logs
routed to root session-logs (submodule convention).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-01 19:12:55 -07:00

19 KiB
Raw Blame History

[RECOVERED] Use Intune with Apple devices

[RECOVERED -- UNVERIFIED] Auto-reconstructed from transcript eca77c0f-b935-4fb5-8d8a-da3a5c230afe (2026-05-23T23:58:47.026Z .. 2026-05-24T00:21:10.410Z) on 2026-06-01. Prose sections are Ollama-drafted from the transcript and may be imprecise; the Commands/Config/Reference sections are extracted verbatim. Review and correct, then remove this banner.

User

  • User: Mike Swanson (mike)
  • Machine: GURU-5070
  • Role: admin

Session Summary

The session focused on setting up Apple Business Manager (ABM) for integration with Microsoft Intune to manage Apple devices. The team verified the existence of an Apple ABM verification email sent to the admin@azcomputerguru.com mailbox, which was found to be non-existent. The verification email was located in the mike@azcomputerguru.com mailbox. The team then proceeded to add an alias, apple@azcomputerguru.com, to the admin@azcomputerguru.com distribution group to facilitate future communication. Despite initial issues with adding the alias, the team successfully configured the alias using the Exchange Admin API, ensuring it was recognized and functional.

Key Decisions

  • Adding apple@azcomputerguru.com as an alias to the admin@azcomputerguru.com distribution group to streamline ABM communication.
  • Using the Exchange Admin API to ensure the alias was added correctly, given the initial failure with the REST endpoint.

Problems Encountered

  • The admin@azcomputerguru.com mailbox did not exist, requiring the team to search for alternative mailboxes.
  • Initial attempts to add the alias to the distribution group failed, necessitating a switch to the Exchange Admin API for proper configuration.
  • The alias was not recognized initially, prompting a re-evaluation of the request format to align with the API's expected input.

Configuration Changes

Machine-extracted verbatim from the transcript (file targets of Write/Edit/NotebookEdit).

  • none detected

Credentials & Secrets

Machine-extracted; review carefully -- secrets are not auto-harvested from transcripts.

  • none detected (verify against the Commands & Outputs section)

Infrastructure & Servers

Machine-extracted verbatim (IP / hostname regex hits across the whole transcript).

  • Hosts: business.apple.com, identity.apple.com, yourdomain.com, azcomputerguru.com, vault.sh, get-token.sh, onboard-tenant.sh, patch-tenant-admin-manifest.sh, resolve-tenant.sh, tenant-sweep.sh, user-breach-check.sh, schemas.xmlsoap.org, schemas.microsoft.com, graph.microsoft.com, azcomputerguru.onmicrosoft.com, outlook.office365.com, microsoft.exchange.admin.odata.core.odataserviceexception, microsoft.exchange.data.proxyaddresscollection, newtonsoft.json.linq.jproperty, microsoft.exchange.data.proxyaddress, microsoft.exchange.adminapi.commandinvocation.parametertransformationexception, adminapi.warnings, odata.type, odata.context, exchange.generichashtable

Commands & Outputs

Machine-extracted verbatim: mutating Bash/PowerShell commands with truncated output.

test -f D:/vault/scripts/vault.sh && echo "vault ok" || echo "vault missing"

Output: vault ok

TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

# EWS FindItem - search for emails from Apple in admin mailbox
curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
  xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
  <soap:Header>
    <t:RequestServerVersion Version="Exchange2016"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>admin@azcomputerguru.com</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal="Shallow">
      <m:ItemShape>
        <t:BaseShape>AllProperties</t:BaseShape>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned="20" Offset="0" BasePoint="Beginning"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="message:From"/>
            <t:Constant Value="apple.com"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="Apple Business Manager"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="ABM"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="business.apple.com"/>
          </t:Contains>
          <t:Contains ContainmentMode="Substring" ContainmentComparison="IgnoreCase">
            <t:FieldURI FieldURI="item:Subject"/>
            <t:Constant Value="verify"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id="inbox"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>'

Output: <?xml version="1.0" encoding="utf-8"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><s:Fault>a:ErrorNonExistentMailboxThe SMTP address has no mailbox ass ... [truncated]

TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

search_mailbox() {
  local MAILBOX=$1
  echo "=== Searching $MAILBOX ==="
  curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -d "<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"
  xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\"
  xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\">
  <soap:Header>
    <t:RequestServerVersion Version=\"Exchange2016\"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>$MAILBOX</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal=\"Shallow\">
      <m:ItemShape>
        <t:BaseShape>IdOnly</t:BaseShape>
        <t:AdditionalProperties>
          <t:FieldURI FieldURI=\"item:Subject\"/>
          <t:FieldURI FieldURI=\"message:From\"/>
          <t:FieldURI FieldURI=\"item:DateTimeReceived\"/>
        </t:AdditionalProperties>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned=\"10\" Offset=\"0\" BasePoint=\"Beginning\"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"message:From\"/>
            <t:Constant Value=\"apple.com\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"Apple Business Manager\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"appleid\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"verify your\"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id=\"inbox\"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>" | grep -oP '(?<=<t:Subject>)[^<]+|(?<=<t:From>)[^<]+|(?<=<t:DateTimeReceived>)[^<]+|ErrorNonExistentMailbox|TotalItemsInView="\K[0-9]+'
}

search_mailbox "mike@azcomputerguru.com"
search_mailbox "support@azcomputerguru.com"

Output: Exit code 2 === Searching mike@azcomputerguru.com === grep: -P supports only unibyte and UTF-8 locales === Searching support@azcomputerguru.com === grep: -P supports only unibyte and UTF-8 locales

TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d investigator-exo 2>/dev/null)

ews_search() {
  local MAILBOX=$1
  echo "=== $MAILBOX ==="
  curl -s -X POST "https://outlook.office365.com/EWS/Exchange.asmx" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -d "<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"
  xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\"
  xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\">
  <soap:Header>
    <t:RequestServerVersion Version=\"Exchange2016\"/>
    <t:ExchangeImpersonation>
      <t:ConnectingSID>
        <t:PrimarySmtpAddress>$MAILBOX</t:PrimarySmtpAddress>
      </t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal=\"Shallow\">
      <m:ItemShape>
        <t:BaseShape>IdOnly</t:BaseShape>
        <t:AdditionalProperties>
          <t:FieldURI FieldURI=\"item:Subject\"/>
          <t:FieldURI FieldURI=\"message:From\"/>
          <t:FieldURI FieldURI=\"item:DateTimeReceived\"/>
        </t:AdditionalProperties>
      </m:ItemShape>
      <m:IndexedPageItemView MaxEntriesReturned=\"10\" Offset=\"0\" BasePoint=\"Beginning\"/>
      <m:Restriction>
        <t:Or>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"message:From\"/>
            <t:Constant Value=\"apple.com\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"Apple Business Manager\"/>
          </t:Contains>
          <t:Contains ContainmentMode=\"Substring\" ContainmentComparison=\"IgnoreCase\">
            <t:FieldURI FieldURI=\"item:Subject\"/>
            <t:Constant Value=\"verify your\"/>
          </t:Contains>
        </t:Or>
      </m:Restriction>
      <m:ParentFolderIds>
        <t:DistinguishedFolderId Id=\"inbox\"/>
      </m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>" | grep -oE '<t:Subject>[^<]+</t:Subject>|<t:From>[^<]+</t:From>|<t:DateTimeReceived>[^<]+</t:DateTimeReceived>|TotalItemsInView="[0-9]+"'
}

ews_search "mike@azcomputerguru.com"
ews_search "support@azcomputerguru.com"

Output: === mike@azcomputerguru.com === TotalItemsInView="1" <t:Subject>Verify your Apple Account email address.</t:Subject> <t:DateTimeReceived>2026-05-24T00:09:56Z</t:DateTimeReceived> === support@azcomputerguru.com === TotalItemsInView="0"

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# First, look up the distribution group via EXO InvokeCommand
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '{Name: .value[0].Name, PrimarySmtpAddress: .value[0].PrimarySmtpAddress, EmailAddresses: .value[0].EmailAddresses}'

Output: {

"Name": "admin@azcomputerguru.com",

"PrimarySmtpAddress": "admin@azcomputerguru.com",

"EmailAddresses": [

"smtp:developer@azcomputerguru.com",

"SMTP:admin@azcomputerguru.com",

"smtp:Sifo-Office@azcomputerguru.com",

"smtp:sifoidak@azcomputerguru.com",

"smtp:admin_a ... [truncated]

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": {
          "Add": ["smtp:apple@azcomputerguru.com"]
        }
      }
    }
  }' | jq '.'

Output: {

"error": {

"code": "BadRequest",

"message": "Invalid Operation",

"innererror": {

  "message": "Invalid Operation",

  "type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",

  "stacktrace": "",

  "internalexception": {

    "message": "Cannot p ... [truncated]

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# Pass the full EmailAddresses array with apple@ appended
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": [
          "smtp:developer@azcomputerguru.com",
          "SMTP:admin@azcomputerguru.com",
          "smtp:Sifo-Office@azcomputerguru.com",
          "smtp:sifoidak@azcomputerguru.com",
          "smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",
          "smtp:apple@azcomputerguru.com"
        ]
      }
    }
  }' | jq '.'

Output: {

"@odata.context": "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable)",

"adminapi.warnings@odata.type": "#Collection(String)",

"@adminapi.warnings": [],

"value": []

}

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

# Verify the alias was added
curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '.value[0].EmailAddresses'

Output: [

"smtp:developer@azcomputerguru.com",

"SMTP:admin@azcomputerguru.com",

"smtp:Sifo-Office@azcomputerguru.com",

"smtp:sifoidak@azcomputerguru.com",

"smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",

"X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF2 ... [truncated]

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"CmdletInput\": {
      \"CmdletName\": \"Set-DistributionGroup\",
      \"Parameters\": {
        \"Identity\": \"admin@azcomputerguru.com\",
        \"EmailAddresses\": \"@{Add='smtp:apple@azcomputerguru.com'}\"
      }
    }
  }" | jq '.'

Output: {

"error": {

"code": "BadRequest",

"message": "Invalid Operation",

"innererror": {

  "message": "Invalid Operation",

  "type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",

  "stacktrace": "",

  "internalexception": {

    "message": "Cannot p ... [truncated]

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Set-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com",
        "EmailAddresses": [
          "smtp:developer@azcomputerguru.com",
          "SMTP:admin@azcomputerguru.com",
          "smtp:Sifo-Office@azcomputerguru.com",
          "smtp:sifoidak@azcomputerguru.com",
          "smtp:admin_azcomputerguru.com@azcomputerguru.onmicrosoft.com",
          "X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=3ba6a831669c4577a3badb895e16a0a8-ACG A",
          "smtp:apple@azcomputerguru.com"
        ]
      }
    }
  }' | jq '.'

Output: {

"@odata.context": "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/$metadata#Collection(Exchange.GenericHashTable)",

"adminapi.warnings@odata.type": "#Collection(String)",

"@adminapi.warnings": [],

"value": []

}

EXO_TOKEN=$(bash D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh ce61461e-81a0-4c84-bb4a-7b354a9a356d exchange-op 2>/dev/null)

curl -s -X POST "https://outlook.office365.com/adminapi/beta/ce61461e-81a0-4c84-bb4a-7b354a9a356d/InvokeCommand" \
  -H "Authorization: Bearer $EXO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "CmdletInput": {
      "CmdletName": "Get-DistributionGroup",
      "Parameters": {
        "Identity": "admin@azcomputerguru.com"
      }
    }
  }' | jq '.value[0].EmailAddresses'

Output: [

"X500:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=3ba6a831669c4577a3badb895e16a0a8-ACG A",

"smtp:apple@azcomputerguru.com",

"smtp:developer@azcomputerguru.com",

"SMTP:admin@azcomputerguru.com",

"smtp:Sifo-Office@azcomputerguru.com",

" ... [truncated]

Pending / Incomplete Tasks

  • None.

Reference Information

Machine-extracted verbatim from the whole transcript via regex. Treat as leads, not gospel; deduped.

Reference in New Issue View Git Blame Copy Permalink