75 lines
4.3 KiB
Markdown
75 lines
4.3 KiB
Markdown
# Offboarding Lockdown — Teresa Carpio (VWP)
|
|
|
|
- **Date (UTC):** 2026-06-29
|
|
- **Tech:** Mike Swanson (GURU-5070)
|
|
- **Reason:** Employee quit unexpectedly — lock out of all access, primarily email.
|
|
- **Tenant:** valleywideplastering.com (`5c53ae9f-7071-4248-b834-8685b646450f`)
|
|
- **Target:** `teresa@valleywideplastering.com` (objectId `615d8ef9-e3cc-49a8-bd56-19921cafea4e`)
|
|
- **Tooling:** remediation-tool skill (ComputerGuru tiered app suite)
|
|
|
|
## Pre-action state (read-only check — clean)
|
|
|
|
- Account enabled; created 2023-03-17; last password change 2025-09-04.
|
|
- Mailbox: **0 inbox rules**, no forwarding, no hidden rules, no foreign delegates/SendAs.
|
|
- Auth methods (3): password, SMS `+1 602-228-3396`, Microsoft Authenticator (iPhone 14 Plus).
|
|
- Licenses: M365 Business Premium (no Teams), Flow Free.
|
|
- **Directory role: User Administrator** (privileged — unusual for payroll staff).
|
|
- Group memberships: Estimating Archive, Office Archive, QB, Valley Wide Plastering.
|
|
- Sign-ins (30d interactive): 0 flagged / none non-US. No risky-user/risk detections.
|
|
- **Sent/Deleted review (per request):** no exfiltration. Sent = routine internal pay
|
|
sheets/orders/estimating to coworkers + legit vendors (henryproducts.com, engagebp.com);
|
|
last send 2026-06-29 07:58 MST. Deleted = newsletters/automated notices only (no record
|
|
destruction / track-covering).
|
|
|
|
## Actions taken (confirmed by Mike)
|
|
|
|
| Action | Result |
|
|
|---|---|
|
|
| Reset password to random value (permanent) | OK — required JIT elevation (she holds User Admin) |
|
|
| Delete SMS auth method (`+1 602-228-3396`) | HTTP 204 |
|
|
| Delete Microsoft Authenticator (iPhone 14 Plus) | HTTP 204 |
|
|
| Revoke all sign-in sessions | `value: true` |
|
|
| Block sign-in (`accountEnabled=false`) | HTTP 204 — verified false |
|
|
| Remove User Administrator directory role | HTTP 204 — role now has zero members; user has no roles |
|
|
| Verify auth methods | Only `passwordAuthenticationMethod` remains (no MFA) |
|
|
|
|
Account is **cloud-only** (`onPremisesSyncEnabled: null`) — the on-prem AD account is a separate
|
|
identity. New password stored in vault: `clients/valleywide/teresa-m365-offboarded`. License +
|
|
mailbox retained for handoff (account disabled, not deleted).
|
|
|
|
**Billing:** Syncro **#32487** (Emergency offboarding) — 1.0 hr emergency remote billed as `26184`
|
|
@ qty 1.5 (prepaid premium); invoice $0.00, block 15.5 → 14.0 hrs.
|
|
|
|
**Rose access:** could not verify delegate/SendAs — EXO read returns HTTP 401 (Security Investigator
|
|
SP lacks Exchange Admin role on this tenant). Earlier breach check showed no foreign delegates.
|
|
|
|
## [CRITICAL] Cleanup required — human Global Admin action
|
|
|
|
The password reset JIT-granted **Privileged Authentication Administrator** to the ComputerGuru
|
|
Tenant Admin SP (`fccda86c-77ca-4248-b876-b0cdba8605d4`). The script could not auto-remove it:
|
|
an app-only SP **cannot remove its own** privileged role ("no privilege to remove self"). Standing
|
|
PAA is now on our SP in the VWP tenant and must be removed by a human Global Admin:
|
|
|
|
> Entra portal → Roles and administrators → Privileged Authentication Administrator →
|
|
> remove **ComputerGuru Tenant Admin**. (Assignment id `ikzke6-tKk6E1qsmSeCKE2yozfzKd0hCuHawzbqGBdQ-1`.)
|
|
|
|
This is a script design flaw (logged to errorlog) — likely also left standing PAA on
|
|
**birthbiologic.com** (the 2026-06-08 reset). Worth a fleet sweep.
|
|
|
|
## Still open
|
|
|
|
- **On-prem AD `VWP.US`** — disable her personal user. **BLOCKED on VPN** (no route to
|
|
192.168.0.25; needs VWP OpenVPN connected). The **`VWP\Payroll`** account she used on the XP
|
|
Orders VM is likely *shared* — confirm before disabling.
|
|
- Shared mailboxes `payroll@` / `orders@` — rotate / remove her access if delegated.
|
|
- VPN (OpenVPN on UDM), RDP/RemoteApp to VWP-QBS, QuickBooks login.
|
|
|
|
## Handoff (done 2026-06-29)
|
|
|
|
Granted **`payroll@valleywideplastering.com` FullAccess** on `teresa@` (InheritanceType All,
|
|
AutoMapping on) via Exchange Operator — Teresa's mailbox auto-mounts in the payroll Outlook
|
|
profile. FullAccess only; no Send-As/Send-on-Behalf. Verified (not inherited, Deny: False).
|
|
Documented on Syncro #32487 (public + emailed comment). Note: the **Exchange Operator** SP
|
|
IS consented + Exchange-Admin-roled on VWP — the earlier 401 was the *Security Investigator*
|
|
SP (different app); gotchas tenant table is stale on VWP.
|