claudetools/clients/cascades-tucson/session-logs/2026-04-20-howard-intune-mdm-prereqs-and-enrollment-profile.md

Cascades Tucson — Intune MDM prereqs + Android enrollment profile

User

• User: Howard Enos (howard)
• Machine: ACG-TECH03L
• Role: tech

Session

• Date: 2026-04-19 → 2026-04-20 (spanned midnight UTC)
• Goal: Take Cascades from zero Intune config to ready-to-enroll for 25 Samsung A15 caregiver phones + 9 kitchen iPads

Starting state

Per reports/2026-04-19-intune-mdm-prereq-gap.md the tenant had Intune provisioned but zero configured. MDM authority null, no Apple push cert, Managed Play notBound, no compliance/config/enrollment profiles.

What we did

1. MDM service account (MDMS@cascadestucson.com)

First attempt was mdm@cascadestucson.com. Created the M365 user with Business Premium (one of 34 spare SPB seats, $0 new spend), enrolled Microsoft Authenticator for MFA, then pre-created a consumer Google account at accounts.google.com/signup for the Managed Play binding. Turned out this was wrong — the Managed Play enterprise signup flow rejects any email that already has a consumer Google account, throwing "Email address is associated with an existing consumer account." Dropped the whole mdm@ identity (deleted in M365 and Google) and recreated as MDMS@cascadestucson.com — this time went straight to the Intune "Launch Google" bind flow without pre-creating anything, and Google created the enterprise admin identity cleanly.

• Account: MDMS@cascadestucson.com, display "MDMS Service Account", standard user (no admin roles), Business Premium
• MFA: Microsoft Authenticator (Howard's personal device — transition later)
• Forwarding: ForwardingSmtpAddress: howard@azcomputerguru.com, DeliverToMailboxAndForward=true, set via Exchange REST Set-Mailbox
• MFA enforcement: already covered by tenant CA policy "Require multifactor authentication for all users" (8 CA policies total on the tenant, pre-existing)
• Vault: clients/cascades-tucson/mdm-service-account.sops.yaml

2. Managed Google Play enterprise bind

Clicked "Launch Google to connect now" from Intune → Google signup flow created the Managed Play enterprise tied to MDMS@ → redirected back to Intune.

• Graph verified: bindStatus: boundAndValidated, owner mdms@cascadestucson.com, organization "Cascades of Tucson"
• Note: Intune auto-created a default "personally-owned work profile" Android enrollment profile during the bind. Harmless — we're using Dedicated mode, not work profile.

3. Apple MDM Push Certificate

Phase A (Intune) → download CSR. Phase B (Apple) → created Apple ID mdms@cascadestucson.com. Phase C → upload CSR to identity.apple.com/pushcert, download .pem. Phase D → upload .pem + Apple ID back to Intune.

• Cert serial: 16FA0CAED8EEB74F
• Topic: com.apple.mgmt.External.84214b0c-21cc-4b44-8fd0-e5ad569109ea
• Expires: 2027-04-20 → renewal task #9 scheduled for 2027-03-20
• CRITICAL: at renewal time use SAME Apple ID and click "Renew" (not "Create"). Creating a new cert = all enrolled iPads wipe.

4. Wi-Fi credential vaulted

CSCNet WPA2-Personal password (Ftfd85710#) was only in Syncro customer notes. Added to vault: clients/cascades-tucson/wifi-cscnet.sops.yaml. Per-room VLAN assignment is handled at the UniFi controller level — phones on staff areas will land on VLAN 20 (INTERNAL).

5. Android enrollment foundation

• Entra security group: Cascades - Shared Phones (Assigned membership)
• Enrollment profile: CSC - Android Shared Phones — Corporate-owned dedicated device (NOT AOSP multi-user)
• Token: MVDVVDMPSHYJAGDAJOCN, QR code generated, expires 2026-06-22
• Profile now linked to the Entra group (devices auto-join on enrollment)

Architecture notes for tomorrow

• Hardware is Samsung Galaxy A15 (consumer) → Android Enterprise Dedicated + Microsoft 365 Shared Device Mode, not AOSP multi-user. Shared sign-in happens at the app layer (Teams/Authenticator/Edge use Entra ID with global sign-out clearing state between caregivers).
• HIPAA audit trail: per-user identity is real (Entra sign-in into MS apps), not at the OS level. This matches what's acceptable for shared-device caregiver scenarios.
• iPads are already on a generic Apple ID and physically deployed in the kitchen. Bringing them into Intune is lower priority than phones. ABM + DEM deferred until after phones are live.

What's next (pick up here)

Phase B Android config — walkthrough started, paused at B-1:

• B-1: Compliance policy CSC - Android Compliance (HIPAA baseline) — min Android 13, numeric-complex 6-digit PIN, 2-min inactivity lock, encryption required, block rooted devices. Walkthrough was written, Howard to execute first thing.
• B-2: Configuration profile for CSCNet Wi-Fi + dedicated-device restrictions (block factory reset, no USB transfer, no unknown sources)
• B-3: Required apps from Managed Play — Company Portal, Microsoft Authenticator, Microsoft Edge, Microsoft Teams
• B-4: ALIS web app/shortcut pointing to https://cascadestucson.alisonline.com/Login
• B-5: App configuration policy enabling Shared Device Mode on Authenticator + Teams
• B-6: Test enroll 1 phone via QR code, validate, then roll remaining 24

Estimated total time to finish Phase B + first test enroll: ~60-90 minutes.

Artifacts

• Prereq gap report: reports/2026-04-19-intune-mdm-prereq-gap.md
• Vault: clients/cascades-tucson/mdm-service-account.sops.yaml (full MDM identity + credentials)
• Vault: clients/cascades-tucson/wifi-cscnet.sops.yaml (CSCNet WPA2 password)
• Graph artifacts: /tmp/remediation-tool/207fa277-e9d8-4eb7-ada1-1064d2221498/ (cached token + query responses)