From ab987bf9e1084e38814fc0413d993e184f470d4e Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Thu, 9 Jul 2026 16:30:16 -0700 Subject: [PATCH] wiki(sif-oidak): close the onmicrosoft.com UPN rename as not actionable Removing onmicrosoft.com from M365 usernames needs sifoidak.com verified as a custom Entra domain, which needs a DNS TXT record at GoDaddy. Mike confirmed ACG has no registrar access to that account, so UPNs stay on sifoidak.onmicrosoft.com and new users follow the same convention. Recorded as decided rather than blocked so it is not re-proposed. Co-Authored-By: Claude Opus 4.8 (1M context) --- wiki/clients/sif-oidak.md | 48 ++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/wiki/clients/sif-oidak.md b/wiki/clients/sif-oidak.md index 4f0f412f..866b3bbe 100644 --- a/wiki/clients/sif-oidak.md +++ b/wiki/clients/sif-oidak.md @@ -82,30 +82,33 @@ Mail lives at GoDaddy and is not managed through M365. SamAccountName = first-initial + surname, UPN `@SifOidak.local`, `Domain Users` group, temp password with `-ChangePasswordAtLogon $true`. Verify `pwdLastSet=0` on **both** DCs. *(Without this the user cannot log in to their machine at all — see the 2026-07-09 history entry.)* -2. **M365 account** — Graph user + `usageLocation: US` **before** license assignment, then assign - `O365_BUSINESS`. Watch for seat auto-expansion. +2. **M365 account** — Graph user, UPN `.sod@sifoidak.onmicrosoft.com` (the + `onmicrosoft.com` suffix is correct and unavoidable — see below), `usageLocation: US` **before** + license assignment, then assign `O365_BUSINESS`. Watch for seat auto-expansion. 3. **Email account** — provisioned at **GoDaddy on sifoidak.com**, not in M365. 4. Vault every credential (`clients/sif-oidak/ad-users.sops.yaml`), never paste it into a ticket. -### Username convention — no `onmicrosoft.com` (REQUESTED, BLOCKED) +### Username convention — `onmicrosoft.com` stays (DECIDED 2026-07-09, do not re-open) -Mike's requirement (2026-07-09): M365 usernames must **not** contain `onmicrosoft.com`. +M365 usernames at this client **will keep the `@sifoidak.onmicrosoft.com` suffix.** New users get +`@sifoidak.onmicrosoft.com`. This is settled — don't propose changing it again. -**This is currently impossible.** `sifoidak.onmicrosoft.com` is the tenant's *only* verified domain -(`isInitial: true`, `isDefault: true`); no custom domain has been added. A UPN can only use a -verified domain. To satisfy the requirement: +**Why it can't change:** `sifoidak.onmicrosoft.com` is the tenant's *only* verified domain +(`isInitial: true`, `isDefault: true`), and a UPN may only use a verified domain. Using +`@sifoidak.com` would require adding it as a custom Entra domain and proving ownership with a **DNS +TXT record** — but `sifoidak.com` is registered at **GoDaddy** (`ns19/ns20.domaincontrol.com`) and +**ACG does not have registrar access.** Mike confirmed on 2026-07-09 that we cannot get it, so the +rename is off the table. -1. Add `sifoidak.com` as a custom domain in Entra, verify it via a **DNS TXT record**. - - The domain is registered at **GoDaddy** (`ns19/ns20.domaincontrol.com`). **ACG has no - GoDaddy credentials for Sif-oidak in the vault** — client/registrar access is needed first. - - Add it **without enabling the Exchange service** so the existing `MX -> secureserver.net` - GoDaddy mail flow is not disturbed. -2. Set the new domain as default, then rename UPNs to `@sifoidak.com`. -3. **Renaming a UPN breaks existing Office sign-ins** — users must sign in again. Schedule it and - notify them; do not do it silently. +Renaming would also have broken every existing user's Office sign-in until they re-authenticated — +a real cost for a cosmetic gain, with no upside while mail lives at GoDaddy anyway. -Existing UPNs are also inconsistent — most are `.sod@`, but `m.allen@` and -`marcella.enos@` differ. Settle a single convention as part of this change. +If registrar access is ever obtained, the path is: add `sifoidak.com` **without the Exchange +service** (to protect the `MX -> secureserver.net` GoDaddy mail flow), verify, set default, rename. +Until then this is not actionable. + +**Note on the existing UPNs:** most are `.sod@`, but `m.allen@` and +`marcella.enos@` deviate. Match `.sod@` for new users. ### AD naming conventions (match these) @@ -317,9 +320,7 @@ SIF-SERVER, so the GPO path is wrong. Correct the GPO to `\\SIF-SERVER2\SHARP MX - [ ] **Still outstanding (re-confirmed 2026-07-09):** re-run `onboard-tenant.sh sifoidak.onmicrosoft.com` to backfill 2 missing Security Investigator Graph permissions (`User.Read.All`, `AuditLog.Read.All`). A `signInActivity` query on 2026-07-09 still 403s with "does not have required Microsoft Graph permission(s): AuditLog.Read.All" — so sign-in history is currently unreadable for this tenant. - [ ] Confirm which laptop is actually Dwayne Ortega's (Sif-Laptop555 assumed, was offline 2026-07-09) and verify he can sign in + complete the forced password change -- [ ] **Obtain GoDaddy/registrar access for `sifoidak.com`** — prerequisite for removing `onmicrosoft.com` from M365 usernames (needs a DNS TXT verification record). Vault it once obtained. -- [ ] Add `sifoidak.com` as a verified Entra domain (**no Exchange service**, to protect GoDaddy mail flow), then rename UPNs; notify users, sign-ins will break -- [ ] Settle one UPN convention (`m.allen@` and `marcella.enos@` deviate from `.sod@`) +- [x] ~~Remove `onmicrosoft.com` from M365 usernames~~ — **CLOSED 2026-07-09.** ACG has no registrar access to `sifoidak.com` (GoDaddy); Mike confirmed we cannot obtain it. UPNs stay on `sifoidak.onmicrosoft.com`. Do not re-open. - [ ] Fix GPO printer path: it pushes `\\SIF-SERVER\SHARP MX-6240N PCL6`, but that queue is shared on **SIF-SERVER2** (event 513, error 0x709) - [ ] Consider whether AD password policy should be hardened (currently min length 6, complexity OFF) - [ ] Decide whether Dwayne needs `AssistancePrograms Group` membership (jalbert has it; Dwayne created with `Domain Users` only) @@ -366,9 +367,10 @@ Investigation also surfaced a GPO pushing the MX-6240N queue from the wrong serv Also established this session: the tenant has **no Exchange mailboxes** (`O365_BUSINESS` = Apps-for-business, `EXCHANGE_S_FOUNDATION` stub; all users `mail: null`, no proxyAddresses), and email for `sifoidak.com` is hosted at GoDaddy. Mike set a standing rule that new Sif-oidak users get -**both** an AD account and an M365 account, and that usernames should drop `onmicrosoft.com` — the -latter is blocked on adding+verifying `sifoidak.com` as a custom Entra domain (registrar access -required). See the Onboarding Runbook. +**both** an AD account and an M365 account. The related request to drop `onmicrosoft.com` from +usernames was investigated and **closed the same day**: it requires verifying `sifoidak.com` as a +custom Entra domain via a DNS TXT record, and Mike confirmed ACG has no registrar access to the +GoDaddy account. UPNs stay as-is. See the Onboarding Runbook. ## Backlinks