sync: auto-sync from HOWARD-HOME at 2026-04-24 14:31:14
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-04-24 14:31:14
This commit is contained in:
@@ -0,0 +1,133 @@
|
||||
# Mailbox restore + retention remediation — 2026-04-24
|
||||
|
||||
> **Scope expanded 2026-04-24 (same session):** after Jeff's restore succeeded, Howard correctly flagged that NO terminated employee mailbox should have been deleted — HIPAA §164.316(b)(2) requires 7-year retention. All 7 mailboxes from the 2026-04-22 orphan cleanup were restored from the 30-day soft-delete bin. See §"Full 7-mailbox retention remediation" below. Policy document: `docs/security/termination-procedures.md`.
|
||||
|
||||
---
|
||||
|
||||
## Original scope: Jeff Bristol mailbox restore — 2026-04-24
|
||||
|
||||
## Context
|
||||
|
||||
Ashley Jensen reported to Howard: "I seem to have lost access to Jeff's email and the fax email (efax thing). In your spare time, can you help me get them back??"
|
||||
|
||||
Root cause: on 2026-04-22 we deleted 7 orphan M365 accounts including `jeff.bristol@cascadestucson.com` per HR-confirmed orphan cleanup (`reports/2026-04-22-m365-orphan-deletes.md`). Ashley had delegate access to Jeff's mailbox — her access vanished with the delete.
|
||||
|
||||
## Decision
|
||||
|
||||
Howard authorized 2026-04-24: restore Jeff, convert to shared mailbox, grant Ashley Full Access + Send As. Net outcome = Ashley regains access with no license cost.
|
||||
|
||||
Howard's directive: the fax mailbox (`fax@cascadestucson.com`) is separate and is **NOT** to be touched by me (Claude) in this session — Howard will audit its permissions and (planned) refactor the transport rule to a shared-mailbox model later.
|
||||
|
||||
## Actions executed
|
||||
|
||||
### Step 1 — Graph restore (User Manager tier)
|
||||
|
||||
- `POST https://graph.microsoft.com/v1.0/directory/deletedItems/8ec8248a-46e8-4771-9220-047887928777/restore`
|
||||
- HTTP 200 — restore succeeded
|
||||
- Post-restore verification via `GET /users/{id}`:
|
||||
- `displayName`: "Jeff Bristol"
|
||||
- `userPrincipalName`: `jeff.bristol@cascadestucson.com` (UPN correctly restored)
|
||||
- `accountEnabled`: `false` (matches pre-delete disabled state)
|
||||
- `mail`: `jeff.bristol@cascadestucson.com`
|
||||
- `assignedLicenses`: `[]` (no licenses — expected; will convert to shared mailbox which needs none)
|
||||
|
||||
### Step 2+ — Exchange Online writes — **DEFERRED**
|
||||
|
||||
Exchange REST `POST /adminapi/beta/{tenant}/InvokeCommand` returned **HTTP 401 `invalid_token`** for both `Get-Mailbox jeff.bristol@...` and `Get-Mailbox ashley.jensen@...` (sanity check).
|
||||
|
||||
Token inspection showed valid token state:
|
||||
- `aud`: `https://outlook.office365.com` (correct)
|
||||
- `roles`: `full_access_as_app`
|
||||
- `wids`: includes `29232cdf-9323-42fd-ade2-1d097af3e4de` (Exchange Administrator)
|
||||
|
||||
Diagnosis: the Exchange Administrator directory role was just assigned to the Security Investigator SP (`c64ee5c1-a607-46cb-81b8-42de3de98d48`) by `onboard-tenant.sh` minutes prior. Exchange Online RBAC propagation typically takes 30–60 minutes (sometimes hours) after a fresh role assignment before the SP's token is honored for cmdlet execution.
|
||||
|
||||
Tenant-wide issue (not Jeff-specific): the sanity check against an unrelated mailbox (`ashley.jensen@`) returned the same 401.
|
||||
|
||||
### Step 2+ — Handed off to Howard (manual in Exchange Admin Center)
|
||||
|
||||
Because Ashley needs access now and Exchange RBAC was still propagating, Howard took the portal path directly. Revised scope per Howard 2026-04-24: **FullAccess only, no Send As** (Ashley only needs read).
|
||||
|
||||
Howard's portal work (confirmed 2026-04-24):
|
||||
1. Recipients → Mailboxes → Jeff Bristol → **Convert to Shared** — pending automated step at 15:13 PDT cron retry (if RBAC propagated) or Howard later
|
||||
2. Delegation confirmed by Howard: Ashley already had both **Read and manage (Full Access)** AND **Send As** on Jeff's mailbox — left as-is per Howard's direction 2026-04-24 ("she is already set to read and send as jeff, that is fine. we will leave it as is"). The earlier "FullAccess only, no Send As" instruction is superseded.
|
||||
3. Ashley adds shared mailbox in Outlook: File → Account Settings → More Settings → Advanced → Add → `jeff.bristol@cascadestucson.com` (or OWA at `outlook.office.com/mail/jeff.bristol@cascadestucson.com`)
|
||||
|
||||
### Fax@ mailbox state (captured by Howard's screenshot 2026-04-24 14:12)
|
||||
|
||||
Pulled by Howard in Exchange Admin Center:
|
||||
|
||||
| Property | Value |
|
||||
|---|---|
|
||||
| Type | **Shared Mailbox** (display name "Fax Cascades") |
|
||||
| Send as delegates | **0** |
|
||||
| Read and manage (Full Access) delegates | **0** |
|
||||
|
||||
Zero pre-existing delegations. Ashley's "lost access to fax email" was not loss of a delegate grant — her access was chained through Jeff's mailbox or some other indirect path that broke when Jeff was deleted.
|
||||
|
||||
Screenshot: `docs/servers/fax-packetdial-whitelabel/Screenshot 2026-04-24 141248.png` (copied into repo separately if needed for future reference).
|
||||
|
||||
### Transport rule — fixed by Howard
|
||||
|
||||
Howard removed the broken recipients from `Fax Forward and Retain Copy` transport rule (2026-04-24). Anna Pitzlin no longer in the BCC list; silent NDR-on-every-fax problem eliminated.
|
||||
|
||||
## Related / follow-ups
|
||||
|
||||
- **Britney Thompson** is still in the rule's BCC list and is scheduled for disable post-Litigation Hold — remove before her disable to avoid the same NDR issue.
|
||||
- **Proposed refactor (per master plan Track C):** replace the transport rule entirely with direct FullAccess permissions on the `fax@` shared mailbox for the 9 legitimate recipients. Each user opens `fax@` as a secondary mailbox in Outlook. Cleaner audit trail, no rule maintenance on staff changes. Because fax@ currently has zero delegates, this refactor starts from a clean slate.
|
||||
- **Exchange RBAC propagation:** was still incomplete at time of this session. Next remediation-tool invocation (>1h later or next day) should be able to use `investigator-exo` tier for Exchange REST writes against Cascades.
|
||||
|
||||
## Files
|
||||
|
||||
- Graph restore response: `/tmp/remediation-tool/207fa277-e9d8-4eb7-ada1-1064d2221498/jeff-restore/restore-resp.json`
|
||||
- Post-restore user check: `/tmp/remediation-tool/.../jeff-restore/user-check.json`
|
||||
- Fax architecture doc: `docs/servers/fax-whitelabel.md` (written same session)
|
||||
- Original deletion record: `reports/2026-04-22-m365-orphan-deletes.md`
|
||||
|
||||
---
|
||||
|
||||
## Full 7-mailbox retention remediation (same session, expanded scope)
|
||||
|
||||
### Trigger
|
||||
|
||||
Howard 2026-04-24: "in fact we shouldnt delete any email accounts, they should all be set for some kind of retention for the 7 years (hippa+1 year) requirement."
|
||||
|
||||
Applied retroactively to the 6 other mailboxes deleted in the same 2026-04-22 sweep that were still recoverable within the 30-day soft-delete window.
|
||||
|
||||
### Soft-delete bin enumeration
|
||||
|
||||
```
|
||||
GET /directory/deletedItems/microsoft.graph.user
|
||||
```
|
||||
|
||||
8 items returned. 2 were excluded from restoration:
|
||||
- `mdm@cascadestucson.com` (failed service account replaced by `mdms@` 2026-04-20 — no PHI)
|
||||
- `howard_azcomputerguru.com#EXT#@NETORGFT4257522.onmicrosoft.com` (Howard's own external guest — no Cascades PHI, intentional delete)
|
||||
|
||||
### Restorations (Graph User Manager tier)
|
||||
|
||||
All 6 returned HTTP 200:
|
||||
|
||||
| User | Object ID | Pre-delete state | Post-restore state |
|
||||
|---|---|---|---|
|
||||
| ann.dery | `103b3ac4-2302-4334-8c8e-e66d383c883d` | Disabled, 0 lic | Disabled, 0 lic |
|
||||
| anna.pitzlin | `06aa2955-f124-447d-8a16-cc7779aaf28f` | Disabled, 0 lic | Disabled, 0 lic |
|
||||
| kristiana.dowse | `0c501281-3e80-48e0-8a3f-e460a15df470` | Disabled, 0 lic | Disabled, 0 lic |
|
||||
| nela.durut-azizi | `84cef8a2-6988-44ea-bf20-a72fe622750d` | Disabled, 0 lic | Disabled, 0 lic |
|
||||
| nick.pavloff | `4b46f47a-6c57-477d-bd6d-53f99324aee4` | Disabled, 0 lic | Disabled, 0 lic |
|
||||
| **jodi.ramstack** | `b7cddbeb-6026-436b-a3aa-67c4be43e3fb` | **Enabled, 1 Business Standard lic** (zombie) | Enabled, 1 lic |
|
||||
|
||||
### Follow-on actions — blocked pending Exchange RBAC propagation
|
||||
|
||||
Exchange REST `Set-Mailbox -Type Shared` et al. returned HTTP 401 (RBAC not yet propagated after onboard-tenant.sh assigned Exchange Administrator role this session). Retries pending.
|
||||
|
||||
For each of the 7 restored mailboxes (6 above + Jeff):
|
||||
1. `Set-Mailbox -Identity <upn> -Type Shared`
|
||||
2. `Set-Mailbox -Identity <upn> -HiddenFromAddressListsEnabled $true`
|
||||
3. For Jodi specifically: remove the Business Standard license after conversion — recurring $12.50/mo savings
|
||||
4. Apply Litigation Hold with 2557-day duration **only after** Business Premium purchase (Cascades currently on Business Standard; Litigation Hold is a Plan-2 feature)
|
||||
5. Add to 7-year retention tracker: source-date = 2026-04-22 (original deletion date), eligible-for-review = 2033-04-22
|
||||
|
||||
### Policy document
|
||||
|
||||
Written same session: `docs/security/termination-procedures.md` — mandates preservation-first procedure for all future workforce departures and documents this incident (IR-2026-04-24-001) with remediation steps.
|
||||
Reference in New Issue
Block a user