azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8d2ca14caca814826f4e890126aa5ac26e66f3e9
claudetools/clients/birth-biologic/session-logs/2026-07/2026-07-17-mike-sharepoint-permissions-remediation-32187.md
Mike Swanson 3a7b6a1cc1 sync: auto-sync from GURU-BEAST-ROG at 2026-07-17 10:36:19 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-17 10:36:19
2026-07-17 10:37:10 -07:00

9.0 KiB
Raw Blame History

Birth Biologic — SharePoint Permissions Remediation (Donor Services site) — Syncro #32187

User

  • Executed by: ClaudeTools Discord Bot (GURU-BEAST-ROG)
  • Requested by: Mike Swanson (@azcomputerguru, via Discord) - admin
  • Role: automation (acting on the requester's behalf)

Session Summary

Discord-bot session (thread 1527711911456538624). Mike asked for a /sync and a check of the Birth Biologic ticket reply. Annise (client) had replied on Syncro #32187 approving the SharePoint permissions plan Mike emailed 7/16: lock the Donor Services site down so the 6 Donation Coordinators are read-only, kill the org-wide edit links, and consolidate the scattered folder-by-folder permissions. Mike said "Go for it", confirmed the detailed execution preview with YES, and the full remediation was executed live on the tenant via the remediation-tool SharePoint tiers (cert-based app-only tokens, Tenant Admin app, Sites.FullControl.All).

Four steps executed and verified on tenant 19a568e8-9e88-413b-9341-cbc224b39145: (1) Tenant sharing defaults via CSOM admin API — DefaultSharingLinkType 3→1 (Anyone→Specific people) and DefaultLinkPermission 0→1 (View). (2) Added the six Donation Coordinators (Christina Cox, Valerie VanEaton, Ashley Williams, Lastashia May, Mei Mei Senthavy, Mindi Maher) to the Donor Services site Visitors group (id 4) — read-only site-wide. (3) Restored role inheritance on the Documents library (78,378 items), the 5 unique-permission folders (found by depth-limited probing, not brute force over 20,540 folders), and the 10 individually-shared files — order mattered: the "Acquisition and Lab Processes" folder had no Members-Edit grant, so inheritance was reset BEFORE deleting sharing links to avoid locking out editors. (4) Removed all 14 SharingLinks.*.OrganizationEdit site groups — 13 were auto-cleaned by the inheritance resets (the 404s on removebyid were expected, not errors), 1 orphan (group 28, deleted file) removed manually. Zero SharingLinks groups remain.

Verified via getusereffectivepermissions on a Suitability doc: ccox and mmaher view=YES/edit=no (coordinators), vfountain and ksteen view=YES/edit=YES (editors) — exactly the intended posture, no lockouts.

Closed out on Syncro: posted the customer-visible completion reply to Annise as Mike (comment 424227376, emailed), set #32187 to Resolved per Mike, and billed 1.0 hr Remote Labor per Mike. Invoice 68053 netted $0 — applied 1 prepay hour (block 3.0 → 2.0). Low-block invoice note set and Winter pinged in #bot-alerts (block now under 4 hrs). Bot-alerts posted for the comment, status change, and billing.

Key Decisions

  • Inheritance reset BEFORE sharing-link deletion on folders whose editors depended on the org-wide edit link (Acquisition and Lab Processes had no Members-Edit grant) — reversing the order would have locked out working editors mid-change.
  • Depth-limited folder probing (164 folders at depth ≤7) instead of per-folder permission checks across all 20,540 folders — found all 5 unique-permission folders; unique permissions live shallow in this library.
  • RenderListDataAsStream with CAML paging for folder enumeration — OData $filter throws SPQueryThrottledException on the 78k-item list.
  • Treated 13 removebyid 404s as success, verified end state instead of retrying — inheritance resets auto-delete orphaned SharingLinks groups; confirmed zero SharingLinks groups remained.
  • The "Inclement Weather" folder reset was safe — its per-user Read grants to the 6 coordinators were the old manual workaround, now superseded by Visitors membership.
  • Status → Waiting on Customer initially, then Resolved on Mike's explicit instruction ("1hr labor - resolved status").
  • Billing as Remote Labor (1190473) at 1.0 hr — prepaid customer, so the invoice auto-applied 1 prepay hour ($0 due); correct behavior, not an error.

Problems Encountered

  • OData folder query silently returned 0 rows then surfaced SPQueryThrottledException (list view threshold, 78,378 items) — switched to RenderListDataAsStream with CAML <View Scope="RecursiveAll"> + FSObjType=1 filter and NextHref paging.
  • All resetroleinheritance POSTs returned HTTP 411 (Length Required) — SharePoint REST POSTs need an explicit empty body: retry with -d '' → all 200.
  • Graph group lookup by mail returned empty for donorservices@ — used $search="displayName:donor" with ConsistencyLevel: eventual; two same-named groups existed, picked the site-connected one (11d28c77) by matching its member list to the 7/16 plan email.
  • 13 of 14 sitegroups/removebyid returned 404 — expected: the inheritance resets had already auto-deleted those SharingLinks groups. Verified final group list instead of retrying.

Configuration Changes

  • No repo file changes (live-tenant work only). Scratch files (.sg.json, .folders.tsv, .unique-folders.tsv, .spadm.err) in the remediation-tool skill dir were cleaned up.
  • Birth Biologic tenant (live SharePoint changes):
    • Tenant sharing: DefaultSharingLinkType = 1 (Specific people), DefaultLinkPermission = 1 (View)
    • Donor Services site Visitors group (id 4): +6 members (ccox, vvaneaton, awilliams, lmay, msenthavy, mmaher @birthbiologic.com)
    • Documents library (guid 7924d2ff-a79f-4b93-a38d-0c779146b525), folders 4/5/154329/154506/155622, and 10 shared files: role inheritance restored (HasUniqueRoleAssignments=false everywhere)
    • All 14 SharingLinks.*.OrganizationEdit site groups removed (13 auto, orphan group 28 manual)
  • Syncro #32187 (id 109277420): comment 424227376 (customer-visible, emailed), status → Resolved, line item 43315362 (1.0 hr Labor - Remote Business), invoice 68053 ($0, 1 prepay hr applied), invoice note "Block hours remaining: 2. You're running low..."

Credentials & Secrets

  • No new credentials. Used ComputerGuru Tenant Admin app (709e6eed-0711-4875-9c44-2d3518c47063, vault msp-tools/computerguru-tenant-admin.sops.yaml) via get-token.sh sharepoint / sharepoint-admin tiers (cert-based — SharePoint rejects client_secret tokens) and investigator tier for Graph reads. Syncro: Mike's per-user key via syncro-env.sh (CLAUDETOOLS_REQUESTER_USER=mike).

Infrastructure & Servers

  • Birth Biologic M365 tenant: 19a568e8-9e88-413b-9341-cbc224b39145
  • SharePoint: birthbiologic.sharepoint.com / birthbiologic-admin.sharepoint.com
  • Donor Services site: /sites/DonorServices (M365 group 11d28c77-...), Documents library guid 7924d2ff-a79f-4b93-a38d-0c779146b525, 78,378 items / 20,540 folders
  • Site groups after remediation: 6 standard only (Owners/Members/Visitors + system)
  • CSOM Tenant admin TypeId {268004ae-ef6b-4e9b-8425-127220d84719}; effective-permissions check via getusereffectivepermissions(@u) with claims-encoded UPN; Low bitmask bit 1=ViewListItems, bit 4=EditListItems

Commands & Outputs

  • Tokens: bash scripts/get-token.sh 19a568e8-... sharepoint|sharepoint-admin|investigator (run from .claude/skills/remediation-tool)
  • Tenant defaults write: CSOM ProcessQuery SetProperty DefaultSharingLinkType/DefaultLinkPermission with <Parameter Type="Enum">1</Parameter>; verified by re-read
  • Add to Visitors: POST $SITE/_api/web/sitegroups(4)/users body {"__metadata":{"type":"SP.User"},"LoginName":"i:0#.f|membership|<upn>"}
  • Inheritance: POST .../resetroleinheritance -d '' (empty body mandatory — 411 otherwise)
  • Folder enum: RenderListDataAsStream, CAML RecursiveAll + FSObjType=1, NextHref paging
  • Effective perms: getusereffectivepermissions(@u)?@u='i%3A0%23.f%7Cmembership%7C<upn>'
  • Syncro: POST /tickets/109277420/comment → 424227376; PUT status Resolved; POST add_line_item → 43315362; POST /invoices {ticket_id, customer_id} → invoice 1651084694 (#68053, total 0.0, line annotated "Applied 1.0 Prepay Hours"); prepay 3.0 → 2.0 verified

Pending / Incomplete Tasks

  • Winter follow-up: Birth Biologic prepay block at 2.0 hrs (< 4) — low-block renewal ping sent to #bot-alerts (invoice 68053).
  • #32492 (separate ticket, still Waiting on Customer since 7/1): site-creation lockdown (SelfServiceSiteCreationDisabled + Group.Unified restriction) awaiting Annise's go-ahead — NOT part of this remediation.
  • Client may report access adjustments after coordinators notice the change — comment invited them to reply if anything is unreachable/over-permissioned.

Reference Information

  • Syncro #32187 id 109277420, customer Birth Biologic 17983014; comment 424227376; line item 43315362; invoice 1651084694 (#68053); ticket URL https://computerguru.syncromsp.com/tickets/109277420
  • Prior context logs: session-logs/2026-07/2026-07-01-mike-remediation-tool-sharepoint-access-bb-32492.md, clients/birth-biologic/session-logs/2026-07/2026-07-06-mike-birthbio-sharepoint-move-ownership.md
  • Reference doc: .claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md
  • Discord thread 1527711911456538624; bot-alerts 1527729772442947634 (comment), 1527730372375478344 (low-block), 1527730411311071333 (billing)
Reference in New Issue View Git Blame Copy Permalink