Files
claudetools/clients/cascades-tucson/docs/security/offboarding-2026-06-30-tamra-matthews.md
Howard Enos 5db3a27685 sync: auto-sync from HOWARD-HOME at 2026-06-30 12:39:43
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-30 12:39:43
2026-06-30 12:40:12 -07:00

69 lines
4.7 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Offboarding Record — Tamra Matthews
**Date:** 2026-06-30 · **Performed by:** Howard Enos (ClaudeTools session) · **Authorized by:** Howard Enos
**Separation type:** Voluntary (left Cascades, June 2026) · **Role:** Move-In Coordinator (Marketing / Sales)
**Runbook:** `docs/security/termination-procedures.md`
## Identities handled
- **M365 (cloud-only):** `tamra.matthews@cascadestucson.com` — id `2d9cf0d1-2b0b-424e-9cd1-91eaac408837`
(`onPremisesSyncEnabled=null` — cloud-mastered object, NOT Entra-synced)
- **On-prem AD:** `Tamra.Matthews` (was `OU=Marketing,OU=Departments,DC=cascades,DC=local` — separate
object, NOT Entra-synced; renamed from Tamra.Johnson 2026-04-13)
- **ALIS:** Not handled this session — Move-In Coordinator role; confirm/disable ALIS staff profile if
she had clinical/ALIS access (open follow-up below).
## Actions completed (M365)
| # | Action | Result |
|---|---|---|
| 1 | Revoke active sign-in sessions | HTTP 200 |
| 2 | Block sign-in (`accountEnabled=false`) | confirmed false |
| 3 | Reset password (random, vaulted) | OK — no elevation needed (holds no admin role, **no PAA stranding**) |
| 4 | Convert mailbox → **SharedMailbox** | confirmed (`RecipientTypeDetails=SharedMailbox`) |
| 5 | Grant **FullAccess** to Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen | all 4 confirmed FullAccess |
| 6 | Hide from GAL (`HiddenFromAddressListsEnabled=true`) | confirmed |
| 7 | Remove **O365 Business Standard** license (`f245ecc8…`) | confirmed 0 licenses — **frees 1 seat** |
| 8 | Remove from groups `Sales`, `All Cascades`, `SG-SSPR-Eligible` | HTTP 204 ×3 |
### AutoMapping — all 4 auto-attach (resolved)
- **All four delegates** (Crystal Rodriguez, Ashley Jensen, Megan Hiatt, Meredith Kuhn) have
**FullAccess with AutoMapping** — the shared mailbox auto-attaches in their Outlook and stays
until they remove it.
- **Gotcha encountered + fix:** the first pass added all 4 in a rapid loop with `AutoMapping:$true`;
only Crystal + Ashley persisted — Megan + Meredith rolled back to NONE (cmdlet echoed success).
Cause: rapid sequential AutoMapping writes contend on the *same* `msExchDelegateListLink` attribute
on Tamra's mailbox; the middle writes lost the race and a failed link-write aborts the whole
`Add-MailboxPermission` transaction. **Fix:** re-grant the missing users **one at a time, spaced
(~6-8s), with verify-and-retry** — `Remove-MailboxPermission` → poll until NONE →
`Add-MailboxPermission -AutoMapping $true` → confirm it persists. Both took on the first spaced
attempt. (The literal `msExchDelegateListLink` list is not exposed in the Exchange Operator REST
schema; persistence of an `AutoMapping:$true` grant is the success signal.)
## Actions completed (on-prem AD, CS-SERVER)
- `Set-ADAccountPassword -Reset` (random, vaulted)
- `Disable-ADAccount Tamra.Matthews` → Enabled=False
- Group memberships: already 0 (no explicit groups) — nothing to strip
- `Move-ADObject``CN=Tamra Matthews,OU=Excluded-From-Sync,DC=cascades,DC=local`
## Retention / compliance
- **No Litigation Hold applied.** Decision (Howard, 2026-06-30): although Move-In Coordinator is a
resident-intake / PHI-adjacent role, Howard authorized the same posture as the Alma Montt
offboarding — **shared-mailbox conversion + zero-deletion** (no mailbox deleted), license removed to
free the seat. Mailbox is preserved under default MRM retention; revisit if her PHI-access
determination or a legal hold changes. Litigation Hold remains available later (tenant has Business
Premium / Exchange Plan 2) if the determination changes.
- Passwords stored for emergency recovery/audit only: vault `clients/cascades-tucson/tamra-matthews`
(`m365_password`, `ad_password`). **Do NOT re-enable without authorization.**
## Open follow-ups
- [ ] **ALIS staff profile** — confirm whether Tamra had ALIS access; if so, disable the staff record
(audit record stays). Her M365 SSO tie is already severed by the sign-in block.
- [x] ~~AutoMapping for Megan Hiatt + Meredith Kuhn~~**RESOLVED 2026-06-30**: re-granted one at a
time (spaced) so AutoMapping persisted. All 4 now auto-attach.
- [ ] **Reconcile** Tamra out of forward-looking plans/rosters. Share roster
`docs/migration/share-group-roster-proposed-2026-06-25.md` already shows her struck-through
*(leaving)*; `docs/servers/active-directory.md` OU=Marketing row updated to disabled +
Excluded-From-Sync. April/May questionnaires, CSVs, and the staff roster
`reports/cascades-staff-2026-04-22.csv` left as historical record.
- [ ] **Note (separate):** Megan Hiatt's M365 account carries a `CREDENTIAL_STUFFING_ACTIVE` flag in
the April tenant inventory — unrelated to this offboarding, but worth a breach check.