claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-alma-offboarding-recovery-verify.md

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

A prior session working Cascades of Tucson was lost mid-task (Howard accidentally cleared the
working context). This session reconstructed what that lost session had done, confirmed an
outstanding message to Mike had NOT been sent, sent it, then verified the underlying work
end-to-end against live systems.

The lost session had offboarded **Alma Montt** (terminated; Memory Care Life Enrichment /
MC Reception; no PHI/clinical access). Recovery was possible because the work product survived
in two places even though no session log had been checkpointed: the offboarding record
`clients/cascades-tucson/docs/security/offboarding-2026-06-25-alma-montt.md` and the uncommitted
datto-edr skill changes in the working tree (unrelated to Alma). The coord message log (last 30)
confirmed nothing about "tenant control / remove access" had gone out.

The one item the lost session had flagged for Mike was a tenant-security decision: resetting
Alma's M365 password required JIT-elevating the `ComputerGuru - Tenant Admin` service principal
to **Privileged Authentication Administrator (PAA)**, and Microsoft Graph blocked the automatic
teardown ("removing self from built-in role is not allowed"). That SP is therefore still holding
a standing PAA role on the Cascades tenant. Because tenant role/access posture is Mike's call
(admin/owner, Global Admin), a coord message was sent to Mike (his most-active session today,
GURU-5070/claude-main) laying out the issue, the exact removal steps, and a recommended posture
(keep JIT, fix the teardown so it stops stranding the role).

Finally, the Alma offboarding was verified live rather than trusted from the doc. M365 state was
read via the remediation-tool skill (investigator Graph token + investigator-exo Exchange token),
and on-prem AD state via the rmm skill against CS-SERVER. All eight claimed actions confirmed
true against live state. The only loose end is the leftover PAA role assignment, now in Mike's
queue.

## Key Decisions

- **Did not guess the message content for Mike.** Reconstructed it from the surviving offboarding
  doc rather than fabricating; the "remove some access" item is specifically the leftover PAA role
  on the Tenant Admin SP.
- **Sent the coord message to Mike's most-active session (GURU-5070)** rather than broadcasting,
  since it is a decision specifically for Mike. Coord messages persist/queue if he is on another box.
- **Verified offboarding live with least-privilege tokens** (investigator + investigator-exo for
  read; read-only Get-ADUser on CS-SERVER) rather than relying on the doc's self-reported results.
- **Recommended keeping JIT elevation (no standing PAA)** for the Tenant Admin SP and fixing the
  teardown, vs. granting permanent PAA — least-privilege for an auth-admin role.

## Problems Encountered

- **Lost session context** — Howard cleared the working context accidentally. Resolved by grepping
  surviving artifacts (offboarding doc, uncommitted working-tree changes) + the coord message log
  to reconstruct state; confirmed the Mike message was never sent.
- **Bash `$UID` collision** — first Graph query used a variable named `UID`, which is a readonly
  bash builtin (expanded to the OS uid 197609), so the query hit the wrong resource
  (`Request_ResourceNotFound: '197609'`). Resolved by renaming the variable to `AID`.
- **EXO MailboxPermission AccessRights parse** — initial parse pulled the wrong key and showed
  `AccessRights: None`; re-queried the raw permission object to confirm Shelby.Trozzi holds
  `FullAccess` (not inherited, not deny).

## Configuration Changes

- **Created:** `clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-alma-offboarding-recovery-verify.md` (this log)
- No code or config changes made this session (verification was read-only).
- Note: uncommitted **datto-edr skill** changes remain in the working tree from the lost session
  (`.claude/skills/datto-edr/scripts/edr.py`, `edr_client.py`, new `selftest.py`) — Locations vs
  scan-Targets inventory-model refactor. Unrelated to Alma; left as-is for a separate review/commit.

## Credentials & Secrets

- Alma Montt offboarding password stored for emergency recovery/audit only at vault
  `clients/cascades-tucson/alma-montt` (do NOT re-enable without authorization). No new credentials
  created or discovered this session.

## Infrastructure & Servers

- **M365 tenant:** cascadestucson.com — Tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498`
- **Alma Montt M365 object id:** `b2fb546e-687a-4647-b286-9c8edd3d989f`
- **On-prem DC:** CS-SERVER (192.168.2.254), `cascades.local`; GuruRMM agent id (live this session)
  `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolls — resolve live by hostname).
- **Remediation apps used:** ComputerGuru Security Investigator (`bfbc12a4-f0dd-4e12-b06d-997e7271e10c`,
  Graph read + EXO read). The PAA-stranded SP is **ComputerGuru - Tenant Admin**.
- **Coord API:** http://172.16.3.30:8001/api/coord — message sent to GURU-5070/claude-main.

## Commands & Outputs

- Graph user verify (Security Investigator token):
  `GET /v1.0/users/{id}?$select=accountEnabled,assignedLicenses,showInAddressList` ->
  `accountEnabled=false`, `assignedLicenses=[]`, `showInAddressList=false`; `memberOf` -> none.
- EXO mailbox verify (Security Investigator EXO token):
  `GET adminapi/beta/{tenant}/Mailbox('Alma.Montt@cascadestucson.com')` ->
  `RecipientTypeDetails=SharedMailbox`; `.../MailboxPermission` -> `Shelby.Trozzi -> [FullAccess]`
  (IsInherited=false, Deny=false).
- AD verify (RMM, CS-SERVER, exit 0):
  `Get-ADUser Alma.Montt -Properties Enabled,MemberOf,DistinguishedName` ->
  `Enabled=False`, `DN=CN=Alma Montt,OU=Excluded-From-Sync,DC=cascades,DC=local`, `GroupCount=0`.
- Coord message POST -> id `4b2bb6a9-881b-4003-984c-687183b96802` (to GURU-5070/claude-main).

## Pending / Incomplete Tasks

- **[MIKE / SECURITY] Remove the standing Privileged Authentication Administrator role from the
  `ComputerGuru - Tenant Admin` SP** on the Cascades tenant (Entra portal: Roles & admins ->
  Privileged Authentication Administrator -> remove the SP). LEAVE its Conditional Access
  Administrator role (intentional). Either Mike does it, or grants Howard GA briefly. Message sent.
- **[POSTURE] Decide the JIT-elevation pattern** so password resets via the Tenant Admin SP stop
  stranding PAA (self-removal is blocked by Graph). Recommended: keep JIT, fix teardown.
- **[SEPARATE] datto-edr skill changes** uncommitted in the working tree — review + commit/discard
  on their own.
- Reconcile: Alma removed from proposed share rosters
  (`docs/migration/share-group-roster-proposed-2026-06-25.md`).

## Reference Information

- Offboarding record: `clients/cascades-tucson/docs/security/offboarding-2026-06-25-alma-montt.md`
- Termination runbook: `docs/security/termination-procedures.md`
- Coord message id: `4b2bb6a9-881b-4003-984c-687183b96802`
- Cascades wiki: `wiki/clients/cascades-tucson.md`

## Update: 12:53 PT — Reconciled Alma out of all active plans

Following the verified offboarding, reconciled Alma Montt out of every forward-looking Cascades
doc so no future session/tech treats her as a current or to-be-created user. The 2026-06-25
proposed share roster was already done (struck + OFFBOARDED) by the lost session. Edited the
remaining active docs, each annotated with `OFFBOARDED 2026-06-25` + a pointer to the offboarding
record (strikethrough preserves the decision history rather than deleting it):

- `docs/servers/active-directory.md` — current-state AD reference: changelog entry, Enabled-Accounts
  table row, OU tree (Administrative), MCReception printer access, and Pending-Issues row all updated
  to reflect disabled + moved to OU=Excluded-From-Sync.
- `docs/printers.md` — MCReception printer user list (removed Alma; note to reassign replacement).
- `docs/cloud/user-account-rollout-plan.md` — added a [RECONCILE] banner; fixed persona count 18->17,
  SG-External-Signin-Allowed seed line, the per-person resolution row, the Wave-1 create list, and the
  decision summary.
- `docs/cloud/p2-staff-candidates.md` — license-math count 18->17; candidate roster row.
- `PLAN-AND-QUESTIONS-2026-04-24.md` — Track C / C1 Phase 2 sync list.
- `docs/migration/share-access-matrix-2026-04-23.md` — Alma section + LifeEnrichment share RW list.
- `docs/migration/scripts/phase2-print-server.ps1` — MCReception comment + printer Comment field.

Left as historical record (dated point-in-time artifacts, intentionally NOT rewritten): the April
questionnaires/working-lists/followups, `reports/cascades-staff-2026-04-22.csv`, the Canva and
orphan-deletes reports, the 2026-04-22 HIPAA review, `scripts/create-alma-montt-2026-05-18.ps1`,
`scripts/build-open-questions-docx.py`, and `PLAN-AND-QUESTIONS-2026-04-23-archived.md`.

Ticked the offboarding record follow-up checkbox (reconciliation complete). Remaining open item is
unchanged: Mike to remove the stranded Privileged Authentication Administrator role on the Tenant
Admin SP.

## Update: 15:21 PT — Compiled the Cascades wiki (full recompile)

Ran `/wiki-compile client:cascades-tucson --full`. Pulled live Syncro data (customer 20149445):
hours 48.25 -> 47.75 as of 2026-06-25; 29 assets; open work tickets dropped from 6 to 5 (#32230
Karen->ALDOCS now Resolved); 4 hardware items Invoiced (#32440 server SSDs, #32439 MemCare UPS,
#32443 Front Desk battery, #32330 Chris Knight PC). New source material folded in: the two
2026-06-25 logs (this one + synology-skill-verify) and two 2026-06-24 plans (CARF technology,
CSC-ENT/voice/Helpany consolidation) + the offboarding record.

Process note: first delegated the synthesis to a Sonnet subagent, which hit the 32000-output-token
ceiling trying to regenerate all 634 lines and wrote nothing. Switched to staging a copy of the live
article and applying TARGETED edits for just the deltas (same serialized+staged workflow: per-article
coord lock 59885881..., staged file, diff reviewed, applied, lock released, staging cleared). This
preserved the existing synthesis exactly instead of risking a lossy full regen.

Changes landed in the article (620 -> 634 lines, additive): Profile Syncro refresh; Alma offboarding
in Access + Email&Identity (SPB seat freed) + History; the stranded Tenant Admin PAA role as an open
security item in Access + Active Work; CARF Technology & System Plan deliverable in Active Work +
History; CSC-ENT device-island consolidation in History. wiki/index.md row + compile date bumped to
2026-06-25. Committed + pushed (wiki: compile cascades-tucson (full)).

FRICTION (worth a rule): a Sonnet wiki-compile subagent asked to emit a full ~600-line article via
the Write tool blows the 32k output-token cap. For large existing articles, do TARGETED staged edits
of the deltas, not a full regen — or have the subagent Edit a staged copy rather than Write the whole
file.