sync: auto-sync from HOWARD-HOME at 2026-07-23 17:28:08

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-23 17:28:08

clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-caregiver-devicetest-cleanup.md

@@ -0,0 +1,54 @@
+# Session Log: Cascades Caregiver DeviceTest Group Cleanup
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Howard requested verification that the SG-Caregivers-DeviceTest Entra security group (used during the phased caregiver device allow-list CA policy rollout) was empty, since testing had concluded. The group was not empty -- it contained one member: pilot.test@cascadestucson.com (a test account created for the pilot phase).
+
+Howard directed that the account be disabled, its license removed, but NOT deleted so it could be reused for future testing. All three actions were completed: account disabled, removed from SG-Caregivers-DeviceTest, and the M365 Business Premium (SPB) license removed. Verification confirmed the account is now disabled with zero licenses and the group is empty.
+
+This frees one M365 Business Premium license on the Cascades tenant.
+
+## Key Decisions
+
+- Account kept (disabled, not deleted) per Howard's direction -- preserves the test account for future pilot/testing use without consuming a license.
+- License removed (M365 Business Premium / SPB SKU cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46) to free the seat.
+
+## Configuration Changes
+
+- **Entra ID user pilot.test@cascadestucson.com** (id: aa443169-7db6-4903-afe2-7c4c5a90e30d): accountEnabled set to false
+- **Entra ID group SG-Caregivers-DeviceTest** (id: db5849ec-242d-4b05-9d1b-940a830e7a60): pilot.test removed from membership; group now empty
+- **License**: M365 Business Premium (SPB) removed from pilot.test@cascadestucson.com
+
+## Credentials & Secrets
+
+No new credentials surfaced.
+
+## Infrastructure & Servers
+
+- **Tenant:** Cascades of Tucson (207fa277-e9d8-4eb7-ada1-1064d2221498)
+- **Group:** SG-Caregivers-DeviceTest (db5849ec-242d-4b05-9d1b-940a830e7a60) -- used by CA policy "CSC - Caregivers: allow-listed devices only (TEST GROUP)"
+- **Account:** pilot.test@cascadestucson.com (aa443169-7db6-4903-afe2-7c4c5a90e30d) -- now disabled, unlicensed
+
+## Commands & Outputs
+
+- Graph GET groups filter displayName eq 'SG-Caregivers-DeviceTest' -- found group id db5849ec
+- Graph GET group members -- found 1 member: pilot.test@cascadestucson.com
+- Graph PATCH user accountEnabled:false -- 204 success
+- Graph DELETE group member ref -- 204 success
+- Graph POST assignLicense removeLicenses SPB -- 200 success (first attempt used plural endpoint `assignLicenses` which returned 405; corrected to singular `assignLicense`)
+- Verification: accountEnabled=false, assignedLicenses=[], group members=[]
+
+## Pending / Incomplete Tasks
+
+None. All requested changes completed and verified.
+
+## Reference Information
+
+- CA policy referenced: "CSC - Caregivers: allow-listed devices only (TEST GROUP)"
+- License SKU: cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46 (Microsoft 365 Business Premium / SPB)
+- Remediation tool tiers used: investigator (reads), user-manager (writes)