diff --git a/wiki/clients/sif-oidak.md b/wiki/clients/sif-oidak.md index 4f0f412f..866b3bbe 100644 --- a/wiki/clients/sif-oidak.md +++ b/wiki/clients/sif-oidak.md @@ -82,30 +82,33 @@ Mail lives at GoDaddy and is not managed through M365. SamAccountName = first-initial + surname, UPN `@SifOidak.local`, `Domain Users` group, temp password with `-ChangePasswordAtLogon $true`. Verify `pwdLastSet=0` on **both** DCs. *(Without this the user cannot log in to their machine at all — see the 2026-07-09 history entry.)* -2. **M365 account** — Graph user + `usageLocation: US` **before** license assignment, then assign - `O365_BUSINESS`. Watch for seat auto-expansion. +2. **M365 account** — Graph user, UPN `.sod@sifoidak.onmicrosoft.com` (the + `onmicrosoft.com` suffix is correct and unavoidable — see below), `usageLocation: US` **before** + license assignment, then assign `O365_BUSINESS`. Watch for seat auto-expansion. 3. **Email account** — provisioned at **GoDaddy on sifoidak.com**, not in M365. 4. Vault every credential (`clients/sif-oidak/ad-users.sops.yaml`), never paste it into a ticket. -### Username convention — no `onmicrosoft.com` (REQUESTED, BLOCKED) +### Username convention — `onmicrosoft.com` stays (DECIDED 2026-07-09, do not re-open) -Mike's requirement (2026-07-09): M365 usernames must **not** contain `onmicrosoft.com`. +M365 usernames at this client **will keep the `@sifoidak.onmicrosoft.com` suffix.** New users get +`@sifoidak.onmicrosoft.com`. This is settled — don't propose changing it again. -**This is currently impossible.** `sifoidak.onmicrosoft.com` is the tenant's *only* verified domain -(`isInitial: true`, `isDefault: true`); no custom domain has been added. A UPN can only use a -verified domain. To satisfy the requirement: +**Why it can't change:** `sifoidak.onmicrosoft.com` is the tenant's *only* verified domain +(`isInitial: true`, `isDefault: true`), and a UPN may only use a verified domain. Using +`@sifoidak.com` would require adding it as a custom Entra domain and proving ownership with a **DNS +TXT record** — but `sifoidak.com` is registered at **GoDaddy** (`ns19/ns20.domaincontrol.com`) and +**ACG does not have registrar access.** Mike confirmed on 2026-07-09 that we cannot get it, so the +rename is off the table. -1. Add `sifoidak.com` as a custom domain in Entra, verify it via a **DNS TXT record**. - - The domain is registered at **GoDaddy** (`ns19/ns20.domaincontrol.com`). **ACG has no - GoDaddy credentials for Sif-oidak in the vault** — client/registrar access is needed first. - - Add it **without enabling the Exchange service** so the existing `MX -> secureserver.net` - GoDaddy mail flow is not disturbed. -2. Set the new domain as default, then rename UPNs to `@sifoidak.com`. -3. **Renaming a UPN breaks existing Office sign-ins** — users must sign in again. Schedule it and - notify them; do not do it silently. +Renaming would also have broken every existing user's Office sign-in until they re-authenticated — +a real cost for a cosmetic gain, with no upside while mail lives at GoDaddy anyway. -Existing UPNs are also inconsistent — most are `.sod@`, but `m.allen@` and -`marcella.enos@` differ. Settle a single convention as part of this change. +If registrar access is ever obtained, the path is: add `sifoidak.com` **without the Exchange +service** (to protect the `MX -> secureserver.net` GoDaddy mail flow), verify, set default, rename. +Until then this is not actionable. + +**Note on the existing UPNs:** most are `.sod@`, but `m.allen@` and +`marcella.enos@` deviate. Match `.sod@` for new users. ### AD naming conventions (match these) @@ -317,9 +320,7 @@ SIF-SERVER, so the GPO path is wrong. Correct the GPO to `\\SIF-SERVER2\SHARP MX - [ ] **Still outstanding (re-confirmed 2026-07-09):** re-run `onboard-tenant.sh sifoidak.onmicrosoft.com` to backfill 2 missing Security Investigator Graph permissions (`User.Read.All`, `AuditLog.Read.All`). A `signInActivity` query on 2026-07-09 still 403s with "does not have required Microsoft Graph permission(s): AuditLog.Read.All" — so sign-in history is currently unreadable for this tenant. - [ ] Confirm which laptop is actually Dwayne Ortega's (Sif-Laptop555 assumed, was offline 2026-07-09) and verify he can sign in + complete the forced password change -- [ ] **Obtain GoDaddy/registrar access for `sifoidak.com`** — prerequisite for removing `onmicrosoft.com` from M365 usernames (needs a DNS TXT verification record). Vault it once obtained. -- [ ] Add `sifoidak.com` as a verified Entra domain (**no Exchange service**, to protect GoDaddy mail flow), then rename UPNs; notify users, sign-ins will break -- [ ] Settle one UPN convention (`m.allen@` and `marcella.enos@` deviate from `.sod@`) +- [x] ~~Remove `onmicrosoft.com` from M365 usernames~~ — **CLOSED 2026-07-09.** ACG has no registrar access to `sifoidak.com` (GoDaddy); Mike confirmed we cannot obtain it. UPNs stay on `sifoidak.onmicrosoft.com`. Do not re-open. - [ ] Fix GPO printer path: it pushes `\\SIF-SERVER\SHARP MX-6240N PCL6`, but that queue is shared on **SIF-SERVER2** (event 513, error 0x709) - [ ] Consider whether AD password policy should be hardened (currently min length 6, complexity OFF) - [ ] Decide whether Dwayne needs `AssistancePrograms Group` membership (jalbert has it; Dwayne created with `Domain Users` only) @@ -366,9 +367,10 @@ Investigation also surfaced a GPO pushing the MX-6240N queue from the wrong serv Also established this session: the tenant has **no Exchange mailboxes** (`O365_BUSINESS` = Apps-for-business, `EXCHANGE_S_FOUNDATION` stub; all users `mail: null`, no proxyAddresses), and email for `sifoidak.com` is hosted at GoDaddy. Mike set a standing rule that new Sif-oidak users get -**both** an AD account and an M365 account, and that usernames should drop `onmicrosoft.com` — the -latter is blocked on adding+verifying `sifoidak.com` as a custom Entra domain (registrar access -required). See the Onboarding Runbook. +**both** an AD account and an M365 account. The related request to drop `onmicrosoft.com` from +usernames was investigated and **closed the same day**: it requires verifying `sifoidak.com` as a +custom Entra domain via a DNS TXT record, and Mike confirmed ACG has no registrar access to the +GoDaddy account. UPNs stay as-is. See the Onboarding Runbook. ## Backlinks