claudetools/clients/birth-biologic/session-logs/2026-07/2026-07-06-mike-birthbio-sharepoint-move-ownership.md

User

• User: Mike Swanson (mike)
• Machine: GURU-5070
• Role: admin

Session Summary

Birth Biologic reported (warranty) that users "can no longer move files within SharePoint" — Move/Copy options greyed out and drag-drop silently failing. Investigated the migrated Quality library and confirmed Mike's hypothesis: every migrated folder/file is authored by SharePoint App (the app-only service principal that ran the Datto->SharePoint Graph/SPMT uploads) — there is no human owner on any of it. By contrast, a folder a real user created (Quality General, author Julie Beck) is normal and movable. This is the whole problem: SharePoint disables Move/Copy/Rename on items whose author is a system/app account, so users can manage their own content but not the app-migrated content.

Ruled out the other candidate causes via Graph and (once authenticated correctly) SharePoint REST: no retention/records labels on the items; library ForceCheckout=false and EnableModeration=false (no require-checkout, no content approval); no files checked out (CheckoutUserId null on all sampled items); and inheritance is intact with the Members group granted write — the Quality staff (Julie Beck, Brandy Burgess, Mary Ster, Vicki Fountain, Alicia Meneely, Kristin Steen + sysadmin/operations) are all Members, so they have Edit. That leaves the app authorship as the sole cause.

The investigation stalled twice on SharePoint access before landing on the correct method. Using the Tenant Admin app's client_secret against SharePoint REST returned Unsupported app only token; I initially (wrongly) concluded app-only SP REST was blocked and wrote a memory saying to fall back to delegated/PnP. Mike corrected this: the app suite has a dedicated SharePoint tier — SharePoint app-only requires the certificate, not the secret. Minting via get-token.sh birthbiologic.com sharepoint produced a cert token with roles=["Sites.FullControl.All"] and SP REST worked immediately. Rewrote the memory to the correct cert-based guidance.

The fix was scoped but not yet executed (awaiting Mike's go + target-owner decision): re-stamp Author/Editor on the app-owned items to a real user via cert-based CSOM SystemUpdate (SystemUpdate so it does not bump Modified dates — matters for a QMS/compliance library), test on one folder, have a Quality user confirm Move works, then run across all migrated libraries (Quality, Admin, Donor Services, Supply — all migrated the same way, so all affected). Mike also raised standardizing all M365 app-only auth on cert (recommended — cert is resource-agnostic and kills the secret-vs-cert friction).

Key Decisions

• Diagnosis = app/System-Account authorship, not permissions/checkout/retention — all three ruled out with live data; the SharePoint App vs Julie Beck author contrast is the tell.
• Fix via CSOM SystemUpdate (not a plain REST MERGE) to preserve Modified dates on QMS records.
• Do not bulk-run yet — test-on-one + user confirmation first; this is a live client library.
• Recommend cert-only for all M365 app-only tasks — a cert works for Graph/EXO too, is MS best practice, and removes the secret-vs-cert branching that wasted time this session.

Problems Encountered

• Used the client_secret for SharePoint -> Unsupported app only token; wrongly concluded "no app-only SP access" and wrote a misleading memory. Correct method: the cert tier via get-token.sh <tenant> sharepoint (Sites.FullControl.All). Memory rewritten; logged as a correction.
• Group lookup by Quality Systems Department returned empty first because I filtered on an assumed rename; the group is still named Quality Systems Department. Re-queried with startswith(displayName,'Quality').
• /tmp path tripped the block-tmp-path hook on a Bash call (Git-Bash /tmp mismatch); reran with a scratchpad path.

Configuration Changes

• No changes to the BirthBio tenant/SharePoint yet (investigation only; the re-author fix is pending go).
• Repo: rewrote .claude/memory/reference_m365_app_sharepoint_rest_vs_graph.md (secret->cert correction) + updated its MEMORY.md index line. Added this session log. (BUG-024/musl log from earlier today is separate.)

Credentials & Secrets

• No new secrets. SharePoint access = Tenant Admin app CERT (vault msp-tools/computerguru-tenant-admin.sops.yaml: cert_thumbprint_b64url + cert_private_key_pem_b64), minted by remediation-tool get-token.sh <tenant> sharepoint. The app's client_secret (same entry) is Graph/EXO only — rejected by SharePoint.
• Gap flagged: BirthBio's sysadmin@birthbiologic.com M365 password is NOT in the SOPS vault (only the Google Workspace one is, clients/birth-biologic/google-workspace.sops.yaml). Mike says the M365 sysadmin creds are in 1Password for BirthBio. Not needed for the fix (cert tier suffices), but worth vaulting.

Infrastructure & Servers

• Tenant: birthbiologic.com / 19a568e8-9e88-413b-9341-cbc224b39145.
• Tenant Admin app: 709e6eed-0711-4875-9c44-2d3518c47063 (secret = Graph/EXO; CERT = SharePoint Sites.FullControl.All).
• QSD site: https://birthbiologic.sharepoint.com/sites/QualitySystemsDepartment; site id 3173c017-58bd-406a-8858-2c969667336f; drive b!F8BzMb1YakCIWCyWlmczb09LHqtxDxVMpLT6kAwYmsM7NUY4oPLSRq7ng3tJq-E9.
• QSD M365 group: QualitySystemsDepartment@birthbiologic.com, id 166dbc15-f60b-4dfc-9581-236980032da4; Members (=site Edit): sysadmin, Julie Beck, Brandy Burgess, Mary Ster, Vicki Fountain, Alicia Meneely, Kristin Steen, Operations.
• Documents library: ForceCheckout=false, EnableModeration=false, EnableVersioning=true, EnableMinorVersions=false.

Commands & Outputs

• Mint SP cert token: cd .claude/skills/remediation-tool && bash scripts/get-token.sh birthbiologic.com sharepoint -> token roles ["Sites.FullControl.All"]. (sharepoint-admin tier = the -admin.sharepoint.com resource.)
• Ownership (Graph): GET /drives/{drive}/root/children?$select=name,createdBy,lastModifiedBy -> all SharePoint App.
• Author contrast (SP REST): GET .../lists/getbytitle('Documents')/items?$select=FileLeafRef,CheckoutUserId,Author/Title,Editor/Title&$expand=Author,Editor -> migrated = SharePoint App, Quality General = Julie Beck; CheckoutUserId null throughout.
• Secret-vs-cert: SP REST with the secret token -> Unsupported app only token; with the cert token -> works.

Pending / Incomplete Tasks

• Execute the fix (warranty): re-stamp Author/Editor on app-owned items to a real user via cert CSOM SystemUpdate. Decision needed from Mike: target owner (sysadmin@ neutral, or a Quality lead like Julie/Brandy). Test one folder -> Quality user confirms Move -> bulk across Quality, Admin, Donor Services, Supply.
• Cert-only standardization (follow-up): switch get-token.sh to cert-first for every tier; register the cert on any secret-only apps; retire secrets. Prevents this recurring.
• Vault the BirthBio sysadmin@ M365 password (currently only in 1Password).

Reference Information

• Authoritative SP access doc: .claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md + app-suite.md.
• Memory: .claude/memory/reference_m365_app_sharepoint_rest_vs_graph.md (corrected to cert).
• Wiki: wiki/clients/birth-biologic.md (File Storage / SharePoint Site Map; QSD site+drive IDs already recorded there).
• Symptom class: greyed-out Move/Copy/Rename + silent drag-drop fail on items authored by SharePoint App/System Account.