# Howard Account Cleanup - 2026-04-22

## Context

Two separate humans share the name "Howard":
- **Howard Enos** — MSP tech at Computer Guru. Accesses Cascades tenant.
- **Dax Howard** — a person who runs Cascades. Has the `dax.howard@cascadestucson.com` member mailbox.

Prior documentation (`docs/cloud/m365.md` as it existed) incorrectly mapped the AD `howard` account to Dax Howard's M365 mailbox, conflating the two identities. The G1 hygiene script executed earlier tonight populated the AD `howard` account's `proxyAddresses` / `mail` / `DisplayName` with Dax Howard's attributes — a genuine error that would have caused a duplicate / orphan at Entra Connect sync time.

## Decision (Howard Enos, 2026-04-22)

1. **Remove the external guest** `howard@azcomputerguru.com` from Cascades tenant — was redundant; MSP access preserved via `sysadmin@cascadestucson.com`.
2. **Remove the AD `howard` account** — orphan MSP-created account (desc "Home Offie" typo, PasswordNeverExpires, unused group memberships). Not in active use.
3. **Leave `dax.howard@cascadestucson.com` alone** — Dax Howard's real Cascades mailbox. Keep as-is.

## Pre-state checks (safety)

- **Global Admin role membership** (Graph): `sysadmin@cascadestucson.com` (Computer Guru Support) holds the Global Administrator role. Admin path preserved after guest removal.
- **Guest's role/group memberships** (Graph): none. Pure sign-in account with no authorization side effects.
- **AD `howard`'s group memberships** (AD): only `Domain Users` (default). No custom groups depending on it.

## Actions executed

### 1. Deleted M365 guest `howard@azcomputerguru.com`

- Tier: `user-manager` (Graph write)
- Object ID: `db2aee97-9c5d-40ce-8610-b75efc3ca906`
- UPN: `howard_azcomputerguru.com#EXT#@NETORGFT4257522.onmicrosoft.com`
- HTTP: 204 (success)
- Verify: subsequent GET returns 404 Request_ResourceNotFound
- **Soft-delete recovery window:** 30 days in Entra (`Restore-MgDirectoryDeletedItem`)

### 2. Deleted AD user `howard`

- Ran via GuruRMM on CS-SERVER (agent `6766e973-e703-47c1-be56-76950290f87c`)
- Script: `docs/migration/scripts/ad-howard-delete.ps1`
- Pre-state exported: `D:\Backups\howard-delete-2026-04-22-205158\howard-pre.xml`
- Pre-state captured:
  - SAM=howard
  - UPN=howard@cascadestucson.com
  - Display="Howard Dax" (wrong value from earlier G1 script — was correct to delete)
  - Description="Home Offie" (typo)
  - mail=dax.howard@cascadestucson.com (wrong value from G1 — was correct to delete)
  - proxyAddresses=SMTP:dax.howard@cascadestucson.com, smtp:cara.lespron@cascadestucson.com (wrong — belonged to Dax)
  - Groups: Domain Users only
- Removed via `Remove-ADUser -Identity howard -Confirm:$false`
- Verified: `Get-ADUser -Identity howard` returns "Cannot find an object"
- **AD Recycle Bin recovery window:** 180 days
- **Rollback:** `Restore-ADObject -Identity 2050d21f-7649-4033-b1fd-83cfc286b056`

### 3. Updated docs/cloud/m365.md

- Corrected the `howard | dax.howard@` mapping line (root cause of the confusion)
- Struck through the `howard@azcomputerguru.com` + `howaed@azcomputerguru.com` external guest entries (both no longer in tenant)

## Dax Howard — open questions

Dax Howard has a Cascades M365 member account (`dax.howard@cascadestucson.com`, Business Standard license, alias `cara.lespron@`) but no AD account. As of 2026-04-22, he's:

- Not on the returned staff CSV from Meredith/John (`reports/cascades-staff-2026-04-22.csv`)
- Not on the working account-setup list (`docs/cloud/cascades-staff-working-list-2026-04-22.md`)
- Has an active licensed mailbox

**Questions to ask Meredith when convenient:**
1. Who is Dax Howard? (executive / regional / legacy?)
2. Is his mailbox actively used?
3. Should he have an AD account created for hybrid identity?
4. Is the `cara.lespron@` alias still needed, or can it be removed?

Not blocking Wave 0.5 — he's cloud-only and stays that way unless an AD counterpart is added.

## Impact on Entra Connect sync plan

- AD now has 41 enabled users (was 42, howard removed).
- The earlier G1 hygiene run's wrong `proxyAddresses` / `mail` / `DisplayName` attributes on AD `howard` are gone with the account — no lingering mismatch to clean up.
- Dax Howard stays cloud-only; his M365 account will show as "Cloud Only" in Entra admin post-sync, separate from the AD-synced population. No conflict.
- No need to re-run the G1 hygiene script — the deletion is idempotent.

## Session log for future reference

Added this cleanup as a concrete lesson: **always verify identity mapping from live Graph data, not from prior doc state**, before bulk AD attribute changes. The G1 script's proxyAddresses mapping came from `docs/cloud/m365.md` which had the wrong assumption baked in. The error was caught immediately by Howard spotting the dual-identity before it reached a sync attempt.