sync: auto-sync from HOWARD-HOME at 2026-06-30 11:27:16

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-30 11:27:16

clients/cascades-tucson/docs/security/offboarding-2026-06-30-tamra-matthews.md

@@ -0,0 +1,66 @@
+# Offboarding Record — Tamra Matthews
+
+**Date:** 2026-06-30 · **Performed by:** Howard Enos (ClaudeTools session) · **Authorized by:** Howard Enos
+**Separation type:** Voluntary (left Cascades, June 2026) · **Role:** Move-In Coordinator (Marketing / Sales)
+**Runbook:** `docs/security/termination-procedures.md`
+
+## Identities handled
+- **M365 (cloud-only):** `tamra.matthews@cascadestucson.com` — id `2d9cf0d1-2b0b-424e-9cd1-91eaac408837`
+  (`onPremisesSyncEnabled=null` — cloud-mastered object, NOT Entra-synced)
+- **On-prem AD:** `Tamra.Matthews` (was `OU=Marketing,OU=Departments,DC=cascades,DC=local` — separate
+  object, NOT Entra-synced; renamed from Tamra.Johnson 2026-04-13)
+- **ALIS:** Not handled this session — Move-In Coordinator role; confirm/disable ALIS staff profile if
+  she had clinical/ALIS access (open follow-up below).
+
+## Actions completed (M365)
+| # | Action | Result |
+|---|---|---|
+| 1 | Revoke active sign-in sessions | HTTP 200 |
+| 2 | Block sign-in (`accountEnabled=false`) | confirmed false |
+| 3 | Reset password (random, vaulted) | OK — no elevation needed (holds no admin role, **no PAA stranding**) |
+| 4 | Convert mailbox → **SharedMailbox** | confirmed (`RecipientTypeDetails=SharedMailbox`) |
+| 5 | Grant **FullAccess** to Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen | all 4 confirmed FullAccess |
+| 6 | Hide from GAL (`HiddenFromAddressListsEnabled=true`) | confirmed |
+| 7 | Remove **O365 Business Standard** license (`f245ecc8…`) | confirmed 0 licenses — **frees 1 seat** |
+| 8 | Remove from groups `Sales`, `All Cascades`, `SG-SSPR-Eligible` | HTTP 204 ×3 |
+
+### AutoMapping caveat (delegate auto-attach)
+- **Crystal Rodriguez + Ashley Jensen** — added with `AutoMapping:$true`; the shared mailbox
+  **auto-attaches** in their Outlook.
+- **Megan Hiatt + Meredith Kuhn** — `AutoMapping:$true` would not persist via the ComputerGuru
+  Exchange Operator app: the cmdlet echoed success but the grant rolled back (a failed
+  `msExchDelegateListLink` write aborts the whole `Add-MailboxPermission` transaction). Re-added with
+  `AutoMapping:$false`, which **persisted**. They have full access but the box does **not**
+  auto-attach — one-time manual add in Outlook (File → Open & Export → Other User's Folder, or add
+  `tamra.matthews@cascadestucson.com` as an additional mailbox), **or** flip auto-mapping from an
+  interactive EXO PowerShell session later (`Add-MailboxPermission … -AutoMapping $true`).
+
+## Actions completed (on-prem AD, CS-SERVER)
+- `Set-ADAccountPassword -Reset` (random, vaulted)
+- `Disable-ADAccount Tamra.Matthews` → Enabled=False
+- Group memberships: already 0 (no explicit groups) — nothing to strip
+- `Move-ADObject` → `CN=Tamra Matthews,OU=Excluded-From-Sync,DC=cascades,DC=local`
+
+## Retention / compliance
+- **No Litigation Hold applied.** Decision (Howard, 2026-06-30): although Move-In Coordinator is a
+  resident-intake / PHI-adjacent role, Howard authorized the same posture as the Alma Montt
+  offboarding — **shared-mailbox conversion + zero-deletion** (no mailbox deleted), license removed to
+  free the seat. Mailbox is preserved under default MRM retention; revisit if her PHI-access
+  determination or a legal hold changes. Litigation Hold remains available later (tenant has Business
+  Premium / Exchange Plan 2) if the determination changes.
+- Passwords stored for emergency recovery/audit only: vault `clients/cascades-tucson/tamra-matthews`
+  (`m365_password`, `ad_password`). **Do NOT re-enable without authorization.**
+
+## Open follow-ups
+- [ ] **ALIS staff profile** — confirm whether Tamra had ALIS access; if so, disable the staff record
+      (audit record stays). Her M365 SSO tie is already severed by the sign-in block.
+- [ ] **AutoMapping for Megan Hiatt + Meredith Kuhn** — either they add the shared mailbox manually,
+      or flip `-AutoMapping $true` from an interactive EXO session (the app-based REST path won't
+      persist it for these two). Crystal + Ashley already auto-attach.
+- [ ] **Reconcile** Tamra out of forward-looking plans/rosters. Share roster
+      `docs/migration/share-group-roster-proposed-2026-06-25.md` already shows her struck-through
+      *(leaving)*; `docs/servers/active-directory.md` OU=Marketing row updated to disabled +
+      Excluded-From-Sync. April/May questionnaires, CSVs, and the staff roster
+      `reports/cascades-staff-2026-04-22.csv` left as historical record.
+- [ ] **Note (separate):** Megan Hiatt's M365 account carries a `CREDENTIAL_STUFFING_ACTIVE` flag in
+      the April tenant inventory — unrelated to this offboarding, but worth a breach check.