claudetools/clients/cascades-tucson/reports/2026-04-22-howard-account-cleanup.md

Howard Account Cleanup - 2026-04-22

Context

Two separate humans share the name "Howard":

• Howard Enos — MSP tech at Computer Guru. Accesses Cascades tenant.
• Dax Howard — a person who runs Cascades. Has the dax.howard@cascadestucson.com member mailbox.

Prior documentation (docs/cloud/m365.md as it existed) incorrectly mapped the AD howard account to Dax Howard's M365 mailbox, conflating the two identities. The G1 hygiene script executed earlier tonight populated the AD howard account's proxyAddresses / mail / DisplayName with Dax Howard's attributes — a genuine error that would have caused a duplicate / orphan at Entra Connect sync time.

Decision (Howard Enos, 2026-04-22)

1. Remove the external guest howard@azcomputerguru.com from Cascades tenant — was redundant; MSP access preserved via sysadmin@cascadestucson.com.
2. Remove the AD howard account — orphan MSP-created account (desc "Home Offie" typo, PasswordNeverExpires, unused group memberships). Not in active use.
3. Leave dax.howard@cascadestucson.com alone — Dax Howard's real Cascades mailbox. Keep as-is.

Pre-state checks (safety)

• Global Admin role membership (Graph): sysadmin@cascadestucson.com (Computer Guru Support) holds the Global Administrator role. Admin path preserved after guest removal.
• Guest's role/group memberships (Graph): none. Pure sign-in account with no authorization side effects.
• AD howard's group memberships (AD): only Domain Users (default). No custom groups depending on it.

Actions executed

1. Deleted M365 guest howard@azcomputerguru.com

• Tier: user-manager (Graph write)
• Object ID: db2aee97-9c5d-40ce-8610-b75efc3ca906
• UPN: howard_azcomputerguru.com#EXT#@NETORGFT4257522.onmicrosoft.com
• HTTP: 204 (success)
• Verify: subsequent GET returns 404 Request_ResourceNotFound
• Soft-delete recovery window: 30 days in Entra (Restore-MgDirectoryDeletedItem)

2. Deleted AD user howard

• Ran via GuruRMM on CS-SERVER (agent 6766e973-e703-47c1-be56-76950290f87c)
• Script: docs/migration/scripts/ad-howard-delete.ps1
• Pre-state exported: D:\Backups\howard-delete-2026-04-22-205158\howard-pre.xml
• Pre-state captured:
  • SAM=howard
  • UPN=howard@cascadestucson.com
  • Display="Howard Dax" (wrong value from earlier G1 script — was correct to delete)
  • Description="Home Offie" (typo)
  • mail=dax.howard@cascadestucson.com (wrong value from G1 — was correct to delete)
  • proxyAddresses=SMTP:dax.howard@cascadestucson.com, smtp:cara.lespron@cascadestucson.com (wrong — belonged to Dax)
  • Groups: Domain Users only
• Removed via Remove-ADUser -Identity howard -Confirm:$false
• Verified: Get-ADUser -Identity howard returns "Cannot find an object"
• AD Recycle Bin recovery window: 180 days
• Rollback: Restore-ADObject -Identity 2050d21f-7649-4033-b1fd-83cfc286b056

3. Updated docs/cloud/m365.md

• Corrected the howard | dax.howard@ mapping line (root cause of the confusion)
• Struck through the howard@azcomputerguru.com + howaed@azcomputerguru.com external guest entries (both no longer in tenant)

Dax Howard — open questions

Dax Howard has a Cascades M365 member account (dax.howard@cascadestucson.com, Business Standard license, alias cara.lespron@) but no AD account. As of 2026-04-22, he's:

• Not on the returned staff CSV from Meredith/John (reports/cascades-staff-2026-04-22.csv)
• Not on the working account-setup list (docs/cloud/cascades-staff-working-list-2026-04-22.md)
• Has an active licensed mailbox

Questions to ask Meredith when convenient:

1. Who is Dax Howard? (executive / regional / legacy?)
2. Is his mailbox actively used?
3. Should he have an AD account created for hybrid identity?
4. Is the cara.lespron@ alias still needed, or can it be removed?

Not blocking Wave 0.5 — he's cloud-only and stays that way unless an AD counterpart is added.

Impact on Entra Connect sync plan

• AD now has 41 enabled users (was 42, howard removed).
• The earlier G1 hygiene run's wrong proxyAddresses / mail / DisplayName attributes on AD howard are gone with the account — no lingering mismatch to clean up.
• Dax Howard stays cloud-only; his M365 account will show as "Cloud Only" in Entra admin post-sync, separate from the AD-synced population. No conflict.
• No need to re-run the G1 hygiene script — the deletion is idempotent.

Session log for future reference

Added this cleanup as a concrete lesson: always verify identity mapping from live Graph data, not from prior doc state, before bulk AD attribute changes. The G1 script's proxyAddresses mapping came from docs/cloud/m365.md which had the wrong assumption baked in. The error was caught immediately by Howard spotting the dual-identity before it reached a sync attempt.