69 lines
4.7 KiB
Markdown
69 lines
4.7 KiB
Markdown
# Offboarding Record — Tamra Matthews
|
||
|
||
**Date:** 2026-06-30 · **Performed by:** Howard Enos (ClaudeTools session) · **Authorized by:** Howard Enos
|
||
**Separation type:** Voluntary (left Cascades, June 2026) · **Role:** Move-In Coordinator (Marketing / Sales)
|
||
**Runbook:** `docs/security/termination-procedures.md`
|
||
|
||
## Identities handled
|
||
- **M365 (cloud-only):** `tamra.matthews@cascadestucson.com` — id `2d9cf0d1-2b0b-424e-9cd1-91eaac408837`
|
||
(`onPremisesSyncEnabled=null` — cloud-mastered object, NOT Entra-synced)
|
||
- **On-prem AD:** `Tamra.Matthews` (was `OU=Marketing,OU=Departments,DC=cascades,DC=local` — separate
|
||
object, NOT Entra-synced; renamed from Tamra.Johnson 2026-04-13)
|
||
- **ALIS:** Not handled this session — Move-In Coordinator role; confirm/disable ALIS staff profile if
|
||
she had clinical/ALIS access (open follow-up below).
|
||
|
||
## Actions completed (M365)
|
||
| # | Action | Result |
|
||
|---|---|---|
|
||
| 1 | Revoke active sign-in sessions | HTTP 200 |
|
||
| 2 | Block sign-in (`accountEnabled=false`) | confirmed false |
|
||
| 3 | Reset password (random, vaulted) | OK — no elevation needed (holds no admin role, **no PAA stranding**) |
|
||
| 4 | Convert mailbox → **SharedMailbox** | confirmed (`RecipientTypeDetails=SharedMailbox`) |
|
||
| 5 | Grant **FullAccess** to Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen | all 4 confirmed FullAccess |
|
||
| 6 | Hide from GAL (`HiddenFromAddressListsEnabled=true`) | confirmed |
|
||
| 7 | Remove **O365 Business Standard** license (`f245ecc8…`) | confirmed 0 licenses — **frees 1 seat** |
|
||
| 8 | Remove from groups `Sales`, `All Cascades`, `SG-SSPR-Eligible` | HTTP 204 ×3 |
|
||
|
||
### AutoMapping — all 4 auto-attach (resolved)
|
||
- **All four delegates** (Crystal Rodriguez, Ashley Jensen, Megan Hiatt, Meredith Kuhn) have
|
||
**FullAccess with AutoMapping** — the shared mailbox auto-attaches in their Outlook and stays
|
||
until they remove it.
|
||
- **Gotcha encountered + fix:** the first pass added all 4 in a rapid loop with `AutoMapping:$true`;
|
||
only Crystal + Ashley persisted — Megan + Meredith rolled back to NONE (cmdlet echoed success).
|
||
Cause: rapid sequential AutoMapping writes contend on the *same* `msExchDelegateListLink` attribute
|
||
on Tamra's mailbox; the middle writes lost the race and a failed link-write aborts the whole
|
||
`Add-MailboxPermission` transaction. **Fix:** re-grant the missing users **one at a time, spaced
|
||
(~6-8s), with verify-and-retry** — `Remove-MailboxPermission` → poll until NONE →
|
||
`Add-MailboxPermission -AutoMapping $true` → confirm it persists. Both took on the first spaced
|
||
attempt. (The literal `msExchDelegateListLink` list is not exposed in the Exchange Operator REST
|
||
schema; persistence of an `AutoMapping:$true` grant is the success signal.)
|
||
|
||
## Actions completed (on-prem AD, CS-SERVER)
|
||
- `Set-ADAccountPassword -Reset` (random, vaulted)
|
||
- `Disable-ADAccount Tamra.Matthews` → Enabled=False
|
||
- Group memberships: already 0 (no explicit groups) — nothing to strip
|
||
- `Move-ADObject` → `CN=Tamra Matthews,OU=Excluded-From-Sync,DC=cascades,DC=local`
|
||
|
||
## Retention / compliance
|
||
- **No Litigation Hold applied.** Decision (Howard, 2026-06-30): although Move-In Coordinator is a
|
||
resident-intake / PHI-adjacent role, Howard authorized the same posture as the Alma Montt
|
||
offboarding — **shared-mailbox conversion + zero-deletion** (no mailbox deleted), license removed to
|
||
free the seat. Mailbox is preserved under default MRM retention; revisit if her PHI-access
|
||
determination or a legal hold changes. Litigation Hold remains available later (tenant has Business
|
||
Premium / Exchange Plan 2) if the determination changes.
|
||
- Passwords stored for emergency recovery/audit only: vault `clients/cascades-tucson/tamra-matthews`
|
||
(`m365_password`, `ad_password`). **Do NOT re-enable without authorization.**
|
||
|
||
## Open follow-ups
|
||
- [ ] **ALIS staff profile** — confirm whether Tamra had ALIS access; if so, disable the staff record
|
||
(audit record stays). Her M365 SSO tie is already severed by the sign-in block.
|
||
- [x] ~~AutoMapping for Megan Hiatt + Meredith Kuhn~~ — **RESOLVED 2026-06-30**: re-granted one at a
|
||
time (spaced) so AutoMapping persisted. All 4 now auto-attach.
|
||
- [ ] **Reconcile** Tamra out of forward-looking plans/rosters. Share roster
|
||
`docs/migration/share-group-roster-proposed-2026-06-25.md` already shows her struck-through
|
||
*(leaving)*; `docs/servers/active-directory.md` OU=Marketing row updated to disabled +
|
||
Excluded-From-Sync. April/May questionnaires, CSVs, and the staff roster
|
||
`reports/cascades-staff-2026-04-22.csv` left as historical record.
|
||
- [ ] **Note (separate):** Megan Hiatt's M365 account carries a `CREDENTIAL_STUFFING_ACTIVE` flag in
|
||
the April tenant inventory — unrelated to this offboarding, but worth a breach check.
|