claudetools/.claude/skills/onboard365/references/customer-consent-instructions.md

Customer Consent Instructions (template)

Use this when handing the single consent link to a customer's Global Administrator. Fill in {{CUSTOMER}}, {{CONSENT_URL}} (from onboard365.sh link <domain>), and your name.

---

Subject: Action needed: one-click approval to connect Arizona Computer Guru to your Microsoft 365

Hi {{ADMIN_NAME}},

To manage and protect your Microsoft 365 environment, we need a one-time approval from a Microsoft 365 Global Administrator at {{CUSTOMER}}. This is a single click — you won't need to approve anything else after this.

1. Open this link while signed in as a Global Administrator:

   {{CONSENT_URL}}

2. Review the screen (it will show "ComputerGuru Tenant Admin") and click Accept.

That's it. Once you've accepted, reply to let us know and we'll finish the setup on our end.

Thanks, {{TECH_NAME}} Arizona Computer Guru · 520.304.8300

---

Notes for the tech (not for the customer)

• The approver MUST be a Global Administrator. A User Admin / other role cannot grant application admin consent — the Accept will fail or be greyed out.
• The single grant is for ComputerGuru Tenant Admin only. After they accept, run onboard365.sh provision <domain> — that creates the other app SPs and assigns roles with no further customer interaction.
• If they report an error like "Need admin approval" / "AADSTS650056" / "AADSTS7000229" on the link, they almost always signed in with a non-GA account. Have them retry as a GA.
• Don't send the per-app links. One link is the whole point. Per-app fallback URLs only come into play if onboard-tenant.sh reports a specific app failed programmatic consent.