claudetools/clients/cascades-tucson/reports/2026-04-19-intune-mdm-prereq-gap.md

Cascades Tucson — Intune / MDM Prerequisites Gap Check

• Date: 2026-04-19 (UTC)
• Tenant: cascadestucson.com (207fa277-e9d8-4eb7-ada1-1064d2221498)
• Intune account ID: 15b6c28c-47fa-40b0-a6af-b9e03ab959c3
• Method: Read-only Graph API via Claude-MSP-Access app (no changes made)
• Goal: establish what's configured vs. what needs setup before enrolling 25 shared Android phones (AESDM) + 9 kitchen iPads (Intune DEM)

---

Findings

#	Prereq	Status	Notes
1	MDM authority = Intune	Not set (null)	intuneAccountId is populated so Intune is provisioned. Just the authority flag hasn't been toggled. One-click in the admin center. One-time irreversible choice.
2	Apple MDM push certificate	Not configured (ResourceNotFound)	Blocks ALL iPad/iOS management. Must generate at identity.apple.com/pushcert and upload. Annual renewal.
3	Apple Business Manager / DEP token	0 tokens	Optional for 9 iPads — manual enrollment works without it, but lose management on factory reset. Recommended.
3b	Apple VPP token	0 tokens	Not required unless paid iPad apps need to be pushed. Skip for kitchen POS scenario.
4	Managed Google Play enterprise	bindStatus: notBound / enrollmentTarget: none	Blocks ALL Android Enterprise management (AESDM, dedicated, work profile). One-click bind in the admin center, sign in with a Cascades Google account.

Existing Intune objects

Object	Count	Notes
Compliance policies	0	Clean slate
Device configuration profiles	0	Clean slate
Enrollment configurations	5	All are Microsoft built-in defaults (device limit, platform restrictions, WHfB, Windows 10 ESP, Windows Restore). None custom.
Android Device Owner enrollment profiles	0	None (need for AESDM / dedicated device mode)
Managed devices	0	None enrolled

---

Gap list — what Howard needs to do before enrolling devices

Must-do (blocking)

1. Set MDM authority to Intune. Admin center → Tenant administration → Mobile Device Management authority → pick Microsoft Intune. Takes 5 seconds. Cannot be undone. Is a hard prerequisite for every step below.

2. Upload Apple MDM push certificate. Required for any iPad management. Process:

   • Intune admin center → Devices → iOS/iPadOS → Enrollment → Apple MDM Push Certificate
   • Download CSR from Intune
   • Upload CSR at identity.apple.com/pushcert using a dedicated Apple ID (recommend mdm-push@cascadestucson.com so turnover doesn't break it — not Meredith's personal, not kitchenipads@)
   • Download the .pem cert from Apple, upload back into Intune
   • Annual renewal on the same Apple ID — if the Apple ID is lost, ALL enrolled iPads must be wiped and re-enrolled

3. Bind Managed Google Play account. Required for AESDM and any Android Enterprise policies.

   • Intune admin center → Devices → Android → Android Enterprise → Managed Google Play
   • Click Launch Google → sign in with a dedicated Google account (recommend managedplay@cascadestucson.com, NOT a personal Google account)
   • Accept terms, link → bindStatus becomes bound

Should-do (strong recommendation)

4. Create Apple Business Manager account and link to Intune.
   • Sign up at business.apple.com (free, takes ~15 min + an Apple ID verification phone call for the D-U-N-S number)
   • Create an MDM server entry in ABM named "Intune — Cascades"
   • Download ABM token, upload to Intune at Enrollment → Apple → Enrollment program tokens
   • For existing iPads: add their serial numbers to ABM manually (one-time)
   • For future iPads: buy them through Apple or an ABM-linked reseller and they auto-appear

Not needed for current scope

5. Apple VPP token — only needed if pushing paid apps. Kitchen POS app is probably free or sideloaded.
6. Windows Autopilot — 89 Entra-registered Windows PCs exist, but Windows management is out of scope for this pass.

---

Dependencies (do in this order)

Step 1 (MDM authority)
  │
  ├── Step 3 (Google Play bind) ──► can enroll Android phones
  │
  ├── Step 2 (Apple push cert) ──► can manually enroll iPads
  │        │
  │        └── Step 4 (ABM + token) ──► iPads auto-enroll + survive reset

Steps 1 and 3 together unlock the 25 Android phones. Steps 1 + 2 together unlock the 9 iPads (with ABM as the recommended polish).

---

Policy scaffold (to be built after prereqs)

For the Android phones (AESDM):

• Enrollment profile: Android Enterprise Corporate-owned, dedicated device, mode = AOSP multi-user (this is AESDM) — generates a token/QR code for device enrollment
• Compliance policy: encryption on, screen lock 4+ digits, 2-min timeout, no developer options, no debugging, Android 11+
• Configuration profile: Wi-Fi (CSCNet), restrictions (no factory reset, no USB transfer, no unknown sources)
• Apps: Company Portal (system), Authenticator, Edge, ALIS (as web app), Teams — required, auto-install

For the kitchen iPads (Intune DEM):

• Create dem-ipads@cascadestucson.com user with Business Premium license assigned, mark as Device Enrollment Manager
• Enrollment profile: iOS/iPadOS, device-without-user-affinity, kiosk mode
• Compliance policy: passcode required, encryption on, no jailbreak
• Configuration profile: Wi-Fi (CSCNet VLAN 20), Single App Mode locked to the kitchen POS app, disable App Store, disable Settings
• Apps: kitchen POS app (required)

---

Data sources

Raw Graph responses cached at /tmp/remediation-tool/207fa277-e9d8-4eb7-ada1-1064d2221498/intune-prereqs/:

• org.json — organization object (MDM authority field)
• devicemgmt-beta.json — deviceManagement root
• apple-push.json — Apple push cert
• dep.json — DEP tokens
• vpp.json — VPP tokens
• gplay.json — Managed Google Play binding
• compliance.json, configs.json, enrollment.json — existing policies
• android-doe.json — Android Device Owner enrollment profiles
• managed-devices.json — enrolled device inventory