46 lines
3.2 KiB
Markdown
46 lines
3.2 KiB
Markdown
# Offboarding Record — Alma Montt
|
||
|
||
**Date:** 2026-06-25 · **Performed by:** Howard Enos (ClaudeTools session) · **Authorized by:** Howard Enos
|
||
**Separation type:** Termination (no longer with Cascades) · **Role:** Memory Care Life Enrichment / MC Reception
|
||
**Runbook:** `docs/security/termination-procedures.md`
|
||
|
||
## Identities handled
|
||
- **M365 (cloud-only):** `Alma.Montt@cascadestucson.com` — id `b2fb546e-687a-4647-b286-9c8edd3d989f`
|
||
- **On-prem AD:** `Alma.Montt` (was OU=Administrative,OU=Departments,DC=cascades,DC=local — separate object, NOT Entra-synced)
|
||
- **ALIS:** N/A — Alma had no ALIS access (Life Enrichment role, not clinical/caregiver; confirmed Howard 2026-06-25)
|
||
|
||
## Actions completed (M365)
|
||
| # | Action | Result |
|
||
|---|---|---|
|
||
| 1 | Revoke active sign-in sessions | HTTP 200 |
|
||
| 2 | Block sign-in (`accountEnabled=false`) | confirmed false |
|
||
| 3 | Reset password (random, vaulted) | OK (via JIT PAA — see follow-up) |
|
||
| 4 | Grant `Shelby.Trozzi` **FullAccess + AutoMapping** to mailbox | confirmed (auto-attaches in Shelby's Outlook) |
|
||
| 5 | Convert mailbox → **SharedMailbox** | confirmed (78 MB / 198 items) |
|
||
| 6 | Remove **Business Premium (SPB)** license | confirmed 0 licenses — **frees 1 SPB seat** |
|
||
| 7 | Hide from GAL | confirmed |
|
||
| 8 | Remove from `SG-SSPR-Eligible` | HTTP 204 |
|
||
|
||
## Actions completed (on-prem AD, CS-SERVER)
|
||
- `Disable-ADAccount Alma.Montt` → Enabled=False
|
||
- Group memberships stripped → groupCount=0
|
||
- Moved to `OU=Excluded-From-Sync,DC=cascades,DC=local`
|
||
|
||
## Retention / compliance
|
||
- **No Litigation Hold applied.** Decision (Howard, 2026-06-25): Alma had **no PHI / medical-data access**
|
||
in her role, so the 7-yr litigation hold is not required. Mailbox is preserved via shared-mailbox
|
||
conversion + zero-deletion posture (no mailbox deleted). Revisit only if her PHI-access
|
||
determination changes.
|
||
- Password stored for emergency recovery/audit only: vault `clients/cascades-tucson/alma-montt`.
|
||
**Do NOT re-enable without authorization.**
|
||
|
||
## Open follow-ups
|
||
- [x] ~~ALIS staff profile~~ — N/A, no ALIS access (Howard 2026-06-25).
|
||
- [ ] **SECURITY — needs Global Admin / portal:** the password reset required a JIT elevation of the
|
||
**ComputerGuru – Tenant Admin** service principal to **Privileged Authentication Administrator**, and
|
||
the automatic role removal was blocked by Graph ("removing self from built-in role is not allowed").
|
||
**The PAA role is still assigned to the SP and must be removed manually** in Entra
|
||
(Roles & admins → Privileged Authentication Administrator → remove `ComputerGuru - Tenant Admin`).
|
||
Its standing **Conditional Access Administrator** role is intentional — leave that.
|
||
- [x] Reconcile: Alma removed from the proposed share rosters (`docs/migration/share-group-roster-proposed-2026-06-25.md`) **and all other active plans** (2026-06-25): `docs/servers/active-directory.md`, `docs/printers.md`, `docs/cloud/user-account-rollout-plan.md`, `docs/cloud/p2-staff-candidates.md`, `PLAN-AND-QUESTIONS-2026-04-24.md`, `docs/migration/share-access-matrix-2026-04-23.md`, `docs/migration/scripts/phase2-print-server.ps1`. Dated April/May questionnaires, CSVs, reports, and the archived plan left as historical record.
|