Files

Howard Enos 5db3a27685 sync: auto-sync from HOWARD-HOME at 2026-06-30 12:39:43

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-30 12:39:43

2026-06-30 12:40:12 -07:00

4.7 KiB

Raw Blame History

Offboarding Record — Tamra Matthews

Date: 2026-06-30 · Performed by: Howard Enos (ClaudeTools session) · Authorized by: Howard Enos Separation type: Voluntary (left Cascades, June 2026) · Role: Move-In Coordinator (Marketing / Sales) Runbook: docs/security/termination-procedures.md

Identities handled

M365 (cloud-only): tamra.matthews@cascadestucson.com — id 2d9cf0d1-2b0b-424e-9cd1-91eaac408837 (onPremisesSyncEnabled=null — cloud-mastered object, NOT Entra-synced)
On-prem AD: Tamra.Matthews (was OU=Marketing,OU=Departments,DC=cascades,DC=local — separate object, NOT Entra-synced; renamed from Tamra.Johnson 2026-04-13)
ALIS: Not handled this session — Move-In Coordinator role; confirm/disable ALIS staff profile if she had clinical/ALIS access (open follow-up below).

Actions completed (M365)

#	Action	Result
1	Revoke active sign-in sessions	HTTP 200
2	Block sign-in (`accountEnabled=false`)	confirmed false
3	Reset password (random, vaulted)	OK — no elevation needed (holds no admin role, no PAA stranding)
4	Convert mailbox → SharedMailbox	confirmed (`RecipientTypeDetails=SharedMailbox`)
5	Grant FullAccess to Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen	all 4 confirmed FullAccess
6	Hide from GAL (`HiddenFromAddressListsEnabled=true`)	confirmed
7	Remove O365 Business Standard license (`f245ecc8…`)	confirmed 0 licenses — frees 1 seat
8	Remove from groups `Sales`, `All Cascades`, `SG-SSPR-Eligible`	HTTP 204 ×3

AutoMapping — all 4 auto-attach (resolved)

All four delegates (Crystal Rodriguez, Ashley Jensen, Megan Hiatt, Meredith Kuhn) have FullAccess with AutoMapping — the shared mailbox auto-attaches in their Outlook and stays until they remove it.
Gotcha encountered + fix: the first pass added all 4 in a rapid loop with AutoMapping:$true; only Crystal + Ashley persisted — Megan + Meredith rolled back to NONE (cmdlet echoed success). Cause: rapid sequential AutoMapping writes contend on the same msExchDelegateListLink attribute on Tamra's mailbox; the middle writes lost the race and a failed link-write aborts the whole Add-MailboxPermission transaction. Fix: re-grant the missing users one at a time, spaced (~6-8s), with verify-and-retry — Remove-MailboxPermission → poll until NONE → Add-MailboxPermission -AutoMapping $true → confirm it persists. Both took on the first spaced attempt. (The literal msExchDelegateListLink list is not exposed in the Exchange Operator REST schema; persistence of an AutoMapping:$true grant is the success signal.)

Actions completed (on-prem AD, CS-SERVER)

Set-ADAccountPassword -Reset (random, vaulted)
Disable-ADAccount Tamra.Matthews → Enabled=False
Group memberships: already 0 (no explicit groups) — nothing to strip
Move-ADObject → CN=Tamra Matthews,OU=Excluded-From-Sync,DC=cascades,DC=local

Retention / compliance

No Litigation Hold applied. Decision (Howard, 2026-06-30): although Move-In Coordinator is a resident-intake / PHI-adjacent role, Howard authorized the same posture as the Alma Montt offboarding — shared-mailbox conversion + zero-deletion (no mailbox deleted), license removed to free the seat. Mailbox is preserved under default MRM retention; revisit if her PHI-access determination or a legal hold changes. Litigation Hold remains available later (tenant has Business Premium / Exchange Plan 2) if the determination changes.
Passwords stored for emergency recovery/audit only: vault clients/cascades-tucson/tamra-matthews (m365_password, ad_password). Do NOT re-enable without authorization.

Open follow-ups

ALIS staff profile — confirm whether Tamra had ALIS access; if so, disable the staff record (audit record stays). Her M365 SSO tie is already severed by the sign-in block.
~~AutoMapping for Megan Hiatt + Meredith Kuhn~~ — RESOLVED 2026-06-30: re-granted one at a time (spaced) so AutoMapping persisted. All 4 now auto-attach.
Reconcile Tamra out of forward-looking plans/rosters. Share roster docs/migration/share-group-roster-proposed-2026-06-25.md already shows her struck-through (leaving); docs/servers/active-directory.md OU=Marketing row updated to disabled + Excluded-From-Sync. April/May questionnaires, CSVs, and the staff roster reports/cascades-staff-2026-04-22.csv left as historical record.
Note (separate): Megan Hiatt's M365 account carries a CREDENTIAL_STUFFING_ACTIVE flag in the April tenant inventory — unrelated to this offboarding, but worth a breach check.

4.7 KiB Raw Blame History Unescape Escape