azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-23 13:06:02

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-23 13:06:02
This commit is contained in:
Howard Enos
2026-07-23 13:06:32 -07:00
parent c87ff8824a
commit 2e7c94e3cc
1 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md
View File

@@ -68,3 +68,73 @@ Password emailed to Cascades by Howard. ALIS staff record to be created by Howar
- RMM command IDs: `571bf547` (AD create), `40942426` (groups+sync), `e089d593` (home folder)
- Bot alert posted to #dev-alerts: message_id `1529623374714769480`
- Vault commit: `ca4a6dd` on vault main
---
## Update: 2026-07-23 — CA Policy Tiering + SG-OnSiteOnly / SG-OnOffSite
### Session Summary
Howard requested a tiered Conditional Access structure at Cascades to replace the current two-bucket model (caregivers locked down vs everyone else gets MFA everywhere). Three tiers defined: (1) Restricted/caregivers (existing SG-Caregivers -- on-site only, no MFA, device-locked, kiosk), (2) On-site only (new SG-OnSiteOnly -- on-site, no MFA, blocked off-site, no device restrictions), (3) Management (new SG-OnOffSite -- on-site no MFA, off-site with MFA).
Initially created both groups as on-prem AD groups in `OU=Groups,DC=cascades,DC=local`. Veronica Feller (`Veronica.Feller@cascadestucson.com`) was added to SG-OnSiteOnly as the first member. Two CA policies created in report-only mode. MFA-for-all policy exclusions updated to include both new groups.
Testing revealed that Veronica's login still prompted for a passkey. Root cause: Veronica's user object lives in `OU=Care-Assisted Living,OU=Departments` which is outside the Entra Connect sync scope (`OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices` only). Her Entra account is cloud-only (or synced from a different path). On-prem mastered groups cannot have cloud-only members added via Graph (HTTP 400 "Unable to update on-premises mastered Directory Sync objects"). Both groups were deleted from on-prem AD and recreated as cloud-only Entra security groups. Veronica was successfully added to the cloud-only SG-OnSiteOnly.
CA policies and MFA-for-all exclusions were updated with the new cloud-only group IDs. However, Veronica's login continued to require a passkey -- likely CA propagation delay (up to 15-20 minutes for policy evaluation cache refresh). She also has a FIDO2 passkey ("Cascades", registered 2026-07-21) and a Temporary Access Pass registered. Session ended with Howard needing to access Veronica's OneDrive to migrate files from her cloud account to her domain account; suggested using SharePoint admin access or TAP as workarounds.
### Key Decisions
- **Three-tier CA model:** Caregivers (existing, full lockdown) / On-site only (new, no MFA, blocked off-site) / Management (new, no MFA on-site, MFA off-site). Clean separation of concerns.
- **Cloud-only groups for CA targeting:** `SG-OnSiteOnly` and `SG-OnOffSite` created as cloud-only Entra security groups rather than on-prem AD synced groups. On-prem groups cannot include users whose accounts are outside the Entra Connect sync scope (most non-caregiver staff are in OUs not synced). Cloud-only groups can include any Entra user regardless of sync source.
- **Both new CA policies created in report-only mode:** Per established Cascades rule -- never flip CA to enforced without verifying sign-in logs first, and not without break-glass exclusion confirmed.
- **Caregivers do not get SG-FolderRedirect or home folders:** Corrected from earlier assumption. Caregivers use shared Android phones and kiosk-mode domain desktops where nothing persists. Memory updated.
### Problems Encountered
- **OU path wrong for group creation:** Initially used `OU=Groups,OU=Departments,DC=cascades,DC=local`; correct path is `OU=Groups,DC=cascades,DC=local` (Groups is a top-level OU, not under Departments).
- **On-prem mastered group can't include cloud-only users:** Graph returns HTTP 400 "Unable to update on-premises mastered Directory Sync objects." Resolved by deleting on-prem groups and recreating as cloud-only in Entra.
- **Veronica still prompted for passkey after MFA exclusion:** CA propagation delay most likely. She has a registered FIDO2 passkey and TAP. Workarounds suggested (SharePoint admin OneDrive access, TAP).
- **New-HomeFolder not in session scope (from earlier save):** Function defined in script file, not loaded as module. Resolved by inlining function body.
### Configuration Changes
- **Created (on-prem, then deleted):** `SG-OnSiteOnly` and `SG-OnOffSite` in `OU=Groups,DC=cascades,DC=local` -- deleted after discovering cloud-only requirement
- **Created (Entra cloud-only):** `SG-OnSiteOnly` (`a464de6f-5448-4f92-81a5-3a4bbb5db9f9`) and `SG-OnOffSite` (`1b2a2fc7-4309-4572-bb56-2b21cab3f481`)
- **Entra group membership:** Veronica Feller added to SG-OnSiteOnly (cloud-only)
- **CA policy created:** "CSC - Block on-site-only users off Cascades network" (`91f918b8-def5-46fd-9fa7-2eae2189aff0`) -- report-only, targets SG-OnSiteOnly, blocks when not on Named Location
- **CA policy created:** "CSC - Require MFA for management off Cascades network" (`17d70763-7786-41e8-b3f0-a92f954c32f7`) -- report-only, targets SG-OnOffSite, requires MFA when not on Named Location
- **CA policy modified:** "Require multifactor authentication for all users" (`7e87a1c7-4836-49df-8769-c4cccadd9dbe`) -- added SG-OnSiteOnly and SG-OnOffSite to excludeGroups
- **Wiki updated:** `wiki/clients/cascades-tucson.md` -- roster count, timeline, vault ref, caregivers don't get SG-FolderRedirect
- **Memory updated:** `feedback_cascades.md` -- caregivers do not get SG-FolderRedirect or home folders
- **Errorlog:** correction logged -- assumed caregivers get SG-FolderRedirect
### Credentials & Secrets
- **r.white (Ronesha White) temp password:** `Cactus7341` -- vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`
### Infrastructure & Servers
- **CS-SERVER:** `c39f1de7-d5b6-45ae-b132-e06977ab1713` (GuruRMM, Cascades, Windows)
- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498`
- **Entra user IDs:** r.white `9c307afd-c548-478c-801c-28e577147e28`, Veronica.Feller `a2188357-3519-4399-b5ad-62b9f1ae924d`
- **Cloud-only group IDs:** SG-OnSiteOnly `a464de6f-5448-4f92-81a5-3a4bbb5db9f9`, SG-OnOffSite `1b2a2fc7-4309-4572-bb56-2b21cab3f481`
- **CA policy IDs:** block on-site-only `91f918b8`, require MFA mgmt `17d70763`, MFA-for-all `7e87a1c7`
- **Named Location (Cascades):** `061c6b06-b980-40de-bff9-6a50a4071f6f` -- IPs `72.211.21.217/32`, `184.191.143.62/32`
- **Veronica's FIDO2 passkey:** "Cascades", created 2026-07-21, ID `CFEWzjtk7ny3X0su36DEtQ2`
### Pending / Incomplete Tasks
- **Verify CA propagation:** Veronica's login should stop requiring passkey once CA evaluation cache refreshes (up to 15-20 min). If still prompting, investigate whether another policy is overriding the exclusion.
- **Veronica OneDrive migration:** Howard needs to access her OneDrive to move files from cloud account to domain account. Workarounds: SharePoint admin access or TAP.
- **ALIS staff record for r.white:** Howard creating manually. Email = `r.white@cascadestucson.com`, disable ALIS-native 2FA.
- **Populate SG-OnOffSite:** Management users need to be added to the management tier group.
- **Flip CA policies to enforced:** After verifying sign-in logs show correct behavior in report-only mode. Requires break-glass exclusion confirmed.
- **Entra Connect sync scope:** Many non-caregiver staff (Care-Assisted Living, Administrative, etc.) are in OUs outside sync scope. Future consideration for cloud-only or hybrid identity expansion.
### Reference Information
- Bot alerts: `1529623374714769480` (r.white creation), `1529933938691411981` (CA policy changes)
- Entra Connect sync scope: `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices` only
- Veronica's on-prem OU: `OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local`
- All CA policies listed: legacy auth block `ed1fe97a`, phishing-resistant admin `1be9295c`, MFA admins `3154dc8f`, MFA external `49acf60d`, legacy block `0a16bb5c`, high-risk MFA `9f123001`, risky sign-in MFA `76f1dd72`, MFA all `7e87a1c7`, caregiver block `e35614e1`, caregiver non-compliant `ede985e2` (disabled), caregiver 8h `7d491c7a`, caregiver device allow-list `1b7fd025`