claudetools/clients/lamaddux/session-logs/2026-06/2026-06-12-mike-calendar-sharing-fix.md

2026-06-12 — Lamaddux Calendar Sharing Fix (Jim ↔ Leeann)

User

• User: Mike Swanson (mike)
• Machine: Mikes-MacBook-Air
• Role: admin

Session Summary

The session addressed calendar sharing issues between users jim@jparkinsonaz.com and leeann@lamaddux.com on lamaddux.com. The error "Calendar sharing is not available with the following entries because of permission settings on your network" was traced to an Exchange sharing policy misconfiguration. Although both users reside in the same tenant (2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929), the policy did not recognize jparkinsonaz.com as an internal domain. PowerShell scripts were developed to resolve this. The first script, fix-lamaddux-calendar-sharing.ps1, updated the sharing policy to include both domains. A second script, fix-lamaddux-calendar-delegation.ps1, was created to use direct delegate permissions as a workaround. Additionally, an automation issue was encountered with the remediation-tool on macOS due to a missing PyJWT dependency in the externally managed Python environment.

Key Decisions

• Implemented PowerShell scripts to update Exchange sharing policies rather than attempting automated remediation-tool execution
• Applied direct delegate permissions as a workaround for sharing restrictions
• Created two solution paths: policy fix (recommended long-term) vs delegate permissions (immediate workaround)
• Deferred PyJWT installation to preserve system Python environment integrity

Problems Encountered

• Exchange sharing policy did not recognize jparkinsonaz.com as internal domain despite both users being in same tenant
• Calendar sharing failed with "permission settings on your network" error when Jim attempted to share with Leeann
• Remediation-tool automation blocked by missing PyJWT dependency on macOS externally-managed Python environment (pip install blocked)
• Homebrew package pyjwt not available (suggested pywhat instead), preventing automated token acquisition

Configuration Changes

Files Created

• tmp/fix-lamaddux-calendar-sharing.ps1 — PowerShell script to update tenant sharing policy
• tmp/fix-lamaddux-calendar-delegation.ps1 — PowerShell script for direct calendar delegation workaround

Files Modified

• None (solutions not yet executed by user)

Credentials & Secrets

None created or discovered. Existing credentials referenced from vault:

• Tenant: lamaddux.com 2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929
• Users: jim@jparkinsonaz.com (obj 387dc966-fd91-4512-9b0f-d80b125769f4), leeann@lamaddux.com
• Vault: clients/lamaddux/jim-parkinson-m365.sops.yaml (referenced, not accessed)

Infrastructure & Servers

• Tenant: lamaddux.com / 2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929
• Custom Domains: lamaddux.com (primary), jparkinsonaz.com (verified custom domain)
• Users:
  • jim@jparkinsonaz.com — Exchange Online Plan 1, object ID 387dc966-fd91-4512-9b0f-d80b125769f4
  • leeann@lamaddux.com — tenant owner
• Apps Referenced:
  • ComputerGuru Security Investigator (bfbc12a4-f0dd-4e12-b06d-997e7271e10c) — for read-only Exchange checks
  • Vault: msp-tools/computerguru-security-investigator.sops.yaml

Commands & Outputs

Attempted Token Acquisition (Failed)

export VAULT_ROOT_ENV="/Users/azcomputerguru/vault" && \
cd /Users/azcomputerguru/.claude/skills/remediation-tool && \
bash scripts/get-token.sh 2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929 investigator-exo

Error: ERROR: PyJWT not installed (pip install PyJWT cryptography)

Python Package Installation Attempts

python3 -m pip install --quiet PyJWT cryptography

Error: error: externally-managed-environment (macOS Homebrew Python restriction)

brew install pyjwt

Error: No available formula with the name "pyjwt". Did you mean pywhat?

PowerShell Solution Scripts Created

Script 1: Policy Fix (Recommended) Location: tmp/fix-lamaddux-calendar-sharing.ps1

• Updates default sharing policy
• Adds both domains with CalendarSharingFreeBusyReviewer permission
• Command: Set-SharingPolicy -Identity $policy.Name -Domains @{Add='lamaddux.com:CalendarSharingFreeBusyReviewer','jparkinsonaz.com:CalendarSharingFreeBusyReviewer'}

Script 2: Delegation Workaround Location: tmp/fix-lamaddux-calendar-delegation.ps1

• Grants direct mailbox folder permission
• Command: Add-MailboxFolderPermission -Identity "jim@jparkinsonaz.com:\Calendar" -User "leeann@lamaddux.com" -AccessRights Reviewer
• Bypasses sharing policy entirely

Pending / Incomplete Tasks

1. User to execute PowerShell fix — Mike needs to run one of the provided scripts:
   • Recommended: tmp/fix-lamaddux-calendar-sharing.ps1 (long-term policy fix)
   • Alternative: tmp/fix-lamaddux-calendar-delegation.ps1 (immediate workaround)
2. Verify calendar sharing works — After script execution, Jim should close/reopen Outlook and retry sharing
3. Resolve PyJWT dependency — For future remediation-tool automation:
   • Option A: Create venv for remediation-tool
   • Option B: Install via system package manager if available
   • Option C: Document manual PowerShell workflow as standard for Exchange policy changes
4. Graduate tmp/ scripts — If PowerShell approach becomes standard, consider moving scripts to clients/lamaddux/scripts/ or projects/msp-tools/remediation-tool/scripts/

Reference Information

• Session Log Reference: session-logs/2026-06-12-mike-jparkinson-mail-migration.md (Jim's initial M365 migration context)
• Related Ticket: Syncro #32411 (id 112542872) — mail migration to resolve calendar sync
• Exchange Sharing Policy Documentation:
  • Default policy allows same-tenant sharing, but custom domains may not be recognized automatically
  • Domains parameter format: 'domain.com:CalendarSharingFreeBusyReviewer'
  • Permission levels: CalendarSharingFreeBusySimple | FreeBusyDetail | FreeBusyReviewer | FullDetails
• Remediation Tool:
  • Base: /Users/azcomputerguru/.claude/skills/remediation-tool
  • Token script: scripts/get-token.sh
  • Tier: investigator-exo for Exchange Online read operations
  • Tier: exchange-op for write operations (not used this session)
• Migration Context: Jim migrated from Neptune on-prem Exchange to lamaddux.com M365 tenant on 2026-06-12
• Domain Setup: jparkinsonaz.com added as verified custom domain, DNS cut over to O365

---

Session saved: 2026-06-12 13:37 PT