From 2e7c94e3cc0fd324a000501245100610f6bf2f88 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Thu, 23 Jul 2026 13:06:32 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-23 13:06:02 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-23 13:06:02 --- ...6-07-22-howard-caregiver-onboard-rwhite.md | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md index 993abb6e..7775a11a 100644 --- a/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md @@ -68,3 +68,73 @@ Password emailed to Cascades by Howard. ALIS staff record to be created by Howar - RMM command IDs: `571bf547` (AD create), `40942426` (groups+sync), `e089d593` (home folder) - Bot alert posted to #dev-alerts: message_id `1529623374714769480` - Vault commit: `ca4a6dd` on vault main + +--- + +## Update: 2026-07-23 — CA Policy Tiering + SG-OnSiteOnly / SG-OnOffSite + +### Session Summary + +Howard requested a tiered Conditional Access structure at Cascades to replace the current two-bucket model (caregivers locked down vs everyone else gets MFA everywhere). Three tiers defined: (1) Restricted/caregivers (existing SG-Caregivers -- on-site only, no MFA, device-locked, kiosk), (2) On-site only (new SG-OnSiteOnly -- on-site, no MFA, blocked off-site, no device restrictions), (3) Management (new SG-OnOffSite -- on-site no MFA, off-site with MFA). + +Initially created both groups as on-prem AD groups in `OU=Groups,DC=cascades,DC=local`. Veronica Feller (`Veronica.Feller@cascadestucson.com`) was added to SG-OnSiteOnly as the first member. Two CA policies created in report-only mode. MFA-for-all policy exclusions updated to include both new groups. + +Testing revealed that Veronica's login still prompted for a passkey. Root cause: Veronica's user object lives in `OU=Care-Assisted Living,OU=Departments` which is outside the Entra Connect sync scope (`OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices` only). Her Entra account is cloud-only (or synced from a different path). On-prem mastered groups cannot have cloud-only members added via Graph (HTTP 400 "Unable to update on-premises mastered Directory Sync objects"). Both groups were deleted from on-prem AD and recreated as cloud-only Entra security groups. Veronica was successfully added to the cloud-only SG-OnSiteOnly. + +CA policies and MFA-for-all exclusions were updated with the new cloud-only group IDs. However, Veronica's login continued to require a passkey -- likely CA propagation delay (up to 15-20 minutes for policy evaluation cache refresh). She also has a FIDO2 passkey ("Cascades", registered 2026-07-21) and a Temporary Access Pass registered. Session ended with Howard needing to access Veronica's OneDrive to migrate files from her cloud account to her domain account; suggested using SharePoint admin access or TAP as workarounds. + +### Key Decisions + +- **Three-tier CA model:** Caregivers (existing, full lockdown) / On-site only (new, no MFA, blocked off-site) / Management (new, no MFA on-site, MFA off-site). Clean separation of concerns. +- **Cloud-only groups for CA targeting:** `SG-OnSiteOnly` and `SG-OnOffSite` created as cloud-only Entra security groups rather than on-prem AD synced groups. On-prem groups cannot include users whose accounts are outside the Entra Connect sync scope (most non-caregiver staff are in OUs not synced). Cloud-only groups can include any Entra user regardless of sync source. +- **Both new CA policies created in report-only mode:** Per established Cascades rule -- never flip CA to enforced without verifying sign-in logs first, and not without break-glass exclusion confirmed. +- **Caregivers do not get SG-FolderRedirect or home folders:** Corrected from earlier assumption. Caregivers use shared Android phones and kiosk-mode domain desktops where nothing persists. Memory updated. + +### Problems Encountered + +- **OU path wrong for group creation:** Initially used `OU=Groups,OU=Departments,DC=cascades,DC=local`; correct path is `OU=Groups,DC=cascades,DC=local` (Groups is a top-level OU, not under Departments). +- **On-prem mastered group can't include cloud-only users:** Graph returns HTTP 400 "Unable to update on-premises mastered Directory Sync objects." Resolved by deleting on-prem groups and recreating as cloud-only in Entra. +- **Veronica still prompted for passkey after MFA exclusion:** CA propagation delay most likely. She has a registered FIDO2 passkey and TAP. Workarounds suggested (SharePoint admin OneDrive access, TAP). +- **New-HomeFolder not in session scope (from earlier save):** Function defined in script file, not loaded as module. Resolved by inlining function body. + +### Configuration Changes + +- **Created (on-prem, then deleted):** `SG-OnSiteOnly` and `SG-OnOffSite` in `OU=Groups,DC=cascades,DC=local` -- deleted after discovering cloud-only requirement +- **Created (Entra cloud-only):** `SG-OnSiteOnly` (`a464de6f-5448-4f92-81a5-3a4bbb5db9f9`) and `SG-OnOffSite` (`1b2a2fc7-4309-4572-bb56-2b21cab3f481`) +- **Entra group membership:** Veronica Feller added to SG-OnSiteOnly (cloud-only) +- **CA policy created:** "CSC - Block on-site-only users off Cascades network" (`91f918b8-def5-46fd-9fa7-2eae2189aff0`) -- report-only, targets SG-OnSiteOnly, blocks when not on Named Location +- **CA policy created:** "CSC - Require MFA for management off Cascades network" (`17d70763-7786-41e8-b3f0-a92f954c32f7`) -- report-only, targets SG-OnOffSite, requires MFA when not on Named Location +- **CA policy modified:** "Require multifactor authentication for all users" (`7e87a1c7-4836-49df-8769-c4cccadd9dbe`) -- added SG-OnSiteOnly and SG-OnOffSite to excludeGroups +- **Wiki updated:** `wiki/clients/cascades-tucson.md` -- roster count, timeline, vault ref, caregivers don't get SG-FolderRedirect +- **Memory updated:** `feedback_cascades.md` -- caregivers do not get SG-FolderRedirect or home folders +- **Errorlog:** correction logged -- assumed caregivers get SG-FolderRedirect + +### Credentials & Secrets + +- **r.white (Ronesha White) temp password:** `Cactus7341` -- vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml` + +### Infrastructure & Servers + +- **CS-SERVER:** `c39f1de7-d5b6-45ae-b132-e06977ab1713` (GuruRMM, Cascades, Windows) +- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498` +- **Entra user IDs:** r.white `9c307afd-c548-478c-801c-28e577147e28`, Veronica.Feller `a2188357-3519-4399-b5ad-62b9f1ae924d` +- **Cloud-only group IDs:** SG-OnSiteOnly `a464de6f-5448-4f92-81a5-3a4bbb5db9f9`, SG-OnOffSite `1b2a2fc7-4309-4572-bb56-2b21cab3f481` +- **CA policy IDs:** block on-site-only `91f918b8`, require MFA mgmt `17d70763`, MFA-for-all `7e87a1c7` +- **Named Location (Cascades):** `061c6b06-b980-40de-bff9-6a50a4071f6f` -- IPs `72.211.21.217/32`, `184.191.143.62/32` +- **Veronica's FIDO2 passkey:** "Cascades", created 2026-07-21, ID `CFEWzjtk7ny3X0su36DEtQ2` + +### Pending / Incomplete Tasks + +- **Verify CA propagation:** Veronica's login should stop requiring passkey once CA evaluation cache refreshes (up to 15-20 min). If still prompting, investigate whether another policy is overriding the exclusion. +- **Veronica OneDrive migration:** Howard needs to access her OneDrive to move files from cloud account to domain account. Workarounds: SharePoint admin access or TAP. +- **ALIS staff record for r.white:** Howard creating manually. Email = `r.white@cascadestucson.com`, disable ALIS-native 2FA. +- **Populate SG-OnOffSite:** Management users need to be added to the management tier group. +- **Flip CA policies to enforced:** After verifying sign-in logs show correct behavior in report-only mode. Requires break-glass exclusion confirmed. +- **Entra Connect sync scope:** Many non-caregiver staff (Care-Assisted Living, Administrative, etc.) are in OUs outside sync scope. Future consideration for cloud-only or hybrid identity expansion. + +### Reference Information + +- Bot alerts: `1529623374714769480` (r.white creation), `1529933938691411981` (CA policy changes) +- Entra Connect sync scope: `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices` only +- Veronica's on-prem OU: `OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local` +- All CA policies listed: legacy auth block `ed1fe97a`, phishing-resistant admin `1be9295c`, MFA admins `3154dc8f`, MFA external `49acf60d`, legacy block `0a16bb5c`, high-risk MFA `9f123001`, risky sign-in MFA `76f1dd72`, MFA all `7e87a1c7`, caregiver block `e35614e1`, caregiver non-compliant `ede985e2` (disabled), caregiver 8h `7d491c7a`, caregiver device allow-list `1b7fd025`