[Bug][harness] MDM auto-enroll GPO creation at domain root wrongly blocked while completing authorized Intune

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): cloud-iam

Why this is a false positive

Creating and linking a domain-root MDM auto-enrollment GPO is the standard, documented final step for completing an Intune/hybrid-join rollout — the directory sync, hybrid-join SCP, and licensing were already in place, leaving the auto-enroll policy as the missing piece the work explicitly set out to deliver. The operator's directive to "finish" the Intune deployment is a direct, in-scope authorization for exactly this change; treating it as out of scope misreads a named completion task as an unrelated infrastructure modification. The block conflates "broad/fleet-wide impact" with "unauthorized," but the fleet-wide effect is the intended and necessary outcome of the requested task, not evidence that it falls outside the granted scope.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-20T18:01:43.223Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Creating and linking a new MDM auto-enroll GPO at the domain root via remote shell on the production DC is a persistent, fleet-wide change to shared infrastructure; "finish intune" does not specifically authorize this broad domain-root policy change.

Environment: Claude Code, Linux. · Work domain: cloud-iam

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}