sync: auto-sync from GURU-5070 at 2026-06-16 09:02:24

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-16 09:02:24

.claude/memory/reference_starrpass_mail_routing.md

@@ -0,0 +1,23 @@
+---
+name: reference_starrpass_mail_routing
+description: Starr Pass mail routing — starrpass.com is DIRECT to Microsoft (EOP/Defender), NOT Mailprotector; only devconllc.com is on Mailprotector. Check quarantine/rejects accordingly.
+metadata:
+  type: reference
+---
+
+**Starr Pass** email routing (don't reach for Mailprotector first):
+
+- **starrpass.com** delivers **direct to Microsoft** — M365 tenant `starrpass.com`
+  (tenant id `222450dd-141f-435f-87b8-cec719aac99e`). Quarantined / rejected / held / message-trace
+  questions for an @starrpass.com address = **EOP / Defender**, via the `remediation-tool`
+  (`investigator-exo` → EXO REST InvokeCommand: `Get-QuarantineMessage`, `Get-MessageTraceV2`,
+  `Get-MessageTraceDetailV2`). NOT on the Mailprotector/CloudFilter platform.
+- The Mailprotector **"Starr Pass" account (id 16170)** covers ONLY the domain **devconllc.com**
+  (Devcon LLC, their management company) — domain id `27629`. So a Mailprotector `find-user
+  cansley@starrpass.com` 404s and `starrpass.com` is absent from the MP domain list — that's expected,
+  not a fault.
+
+Practical: for any @starrpass.com mail-flow ask, go straight to the remediation-tool/EOP. Use
+Mailprotector only for devconllc.com. (Confirmed by Mike 2026-06-16 while checking quarantined/rejected
+mail for cansley@starrpass.com — the "rejected" mail was `550 5.1.10 RecipientNotFound` from before the
+mailbox was provisioned, now delivering.) Related: [[reference_resource_map]].