claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-tamra-matthews-offboarding.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Offboarded Tamra Matthews (Move-In Coordinator, Marketing/Sales) from Cascades of Tucson after she left the facility in June 2026. Followed the canonical termination runbook (docs/security/termination-procedures.md) and the Alma Montt offboarding (2026-06-25) as the proven pattern. Work spanned the M365 cloud tenant (via the remediation-tool skill) and the on-prem AD domain controller CS-SERVER (via the rmm skill); both passwords were vaulted.

Established live pre-state first: Tamra's M365 object (tamra.matthews@cascadestucson.com, id 2d9cf0d1-2b0b-424e-9cd1-91eaac408837) is cloud-only (onPremisesSyncEnabled=null) with a single O365 Business Standard license and membership in Sales, All Cascades, and SG-SSPR-Eligible. The on-prem Tamra.Matthews is a separate, non-synced object in OU=Marketing,OU=Departments with no explicit group memberships. All four mailbox-delegate recipients (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen) resolved as UserMailboxes; all three target groups were static (not dynamic), so removable.

Before mutating anything, surfaced one genuine compliance fork to Howard: unlike Alma (no PHI), Move-In Coordinator is a resident-intake / PHI-adjacent role, so the runbook's 7-yr Litigation Hold could apply. Howard authorized the Alma-style posture — shared-mailbox + zero-deletion, free the seat, no litigation hold (revisit if the PHI determination changes; hold remains available since the tenant has Business Premium/Exchange Plan 2).

Executed the M365 sequence (revoke sessions, block sign-in, vaulted password reset, convert to SharedMailbox, grant the 4 delegates FullAccess+AutoMapping, hide from GAL, remove license, strip 3 groups), then the on-prem AD lockdown (reset password, Disable-ADAccount, move to OU=Excluded-From-Sync). Verified every step against live state. Vaulted both passwords, wrote the offboarding record, reconciled the AD current-state doc + share roster, and synced. Per Howard's direction, AutoMapping was then fixed for all 4 delegates and a /save run before proceeding to a breach check on Megan Hiatt.

Key Decisions

• No litigation hold despite PHI-adjacent role — Howard explicitly authorized the same preserve-but-no-hold posture as Alma. Documented the deviation in the offboarding record so the PHI-role/no-hold decision is auditable.
• Treated the M365 object as cloud-only and the AD object as separate — onPremisesSyncEnabled=null confirmed the M365 account is cloud-mastered; the domain lockdown was a distinct operation on CS-SERVER (same split as Alma).
• Removed license only AFTER shared-mailbox conversion — per runbook, so the mailbox is never a licensed-then-unlicensed user mailbox at risk of default-retention deletion.
• Fixed AutoMapping by spaced, one-at-a-time re-grants rather than leaving Megan/Meredith on manual-add — Howard wanted the box to auto-attach and stay.

Problems Encountered

• AutoMapping silently rolled back for 2 of 4 delegates. The first pass added all 4 in a rapid loop with AutoMapping:$true; the cmdlet echoed [FullAccess] for all 4, but a readback showed only Crystal + Ashley persisted — Megan + Meredith were NONE. Cause: rapid sequential AutoMapping writes contend on the same msExchDelegateListLink multivalued attribute on Tamra's mailbox; a failed link-write aborts the whole Add-MailboxPermission transaction, so the middle writes lost the race and rolled back entirely. Resolved by re-granting one user at a time, spaced ~6-8s, with Remove-MailboxPermission → poll-until-NONE → Add-MailboxPermission -AutoMapping $true → verify-persists. Both took on the first spaced attempt. Logged to errorlog.md (--friction).
• Graph read-replica lag — immediately after PATCH accountEnabled=false (HTTP 204), a verify read still showed accountEnabled=true; a re-read seconds later showed false. Not a failure, just eventual consistency. Same lag bit the Meredith remove (still showed FullAccess right after the remove), handled with a poll-until-NONE loop.
• msExchDelegateListLink not readable via REST — the Exchange Operator REST Get-Mailbox schema doesn't expose the attribute, so AutoMapping can't be directly read; persistence of an AutoMapping:$true grant (no rollback) is the success signal used instead.

Configuration Changes

• Created: clients/cascades-tucson/docs/security/offboarding-2026-06-30-tamra-matthews.md (offboarding record).
• Created: clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-tamra-matthews-offboarding.md (this log).
• Created (vault): clients/cascades-tucson/tamra-matthews.sops.yaml (encrypted; m365_password + ad_password + metadata). Committed + pushed to the vault repo.
• Edited: clients/cascades-tucson/docs/servers/active-directory.md — OU=Marketing Tamra.Matthews row struck + annotated OFFBOARDED/disabled/Excluded-From-Sync.
• Edited: clients/cascades-tucson/docs/migration/share-group-roster-proposed-2026-06-25.md — Tamra (leaving) → (OFFBOARDED 2026-06-30) (4 lines).
• Appended: errorlog.md — EXO AutoMapping rollback friction entry.

Credentials & Secrets

• Tamra Matthews offboarding passwords (emergency/audit only; DO NOT re-enable without authorization): vault clients/cascades-tucson/tamra-matthews — fields m365_password, ad_password. Generated random, complexity-guaranteed; not pasted into chat/tickets. Scratchpad plaintext was scrubbed after vaulting.

Infrastructure & Servers

• M365 tenant: cascadestucson.com — Tenant ID 207fa277-e9d8-4eb7-ada1-1064d2221498
• Tamra M365 object id: 2d9cf0d1-2b0b-424e-9cd1-91eaac408837 (cloud-only)
• Removed license SKU: f245ecc8-75af-4f8e-b61f-27d8114de5f3 (O365 Business Standard) — seat freed
• Delegate mailbox GUIDs: megan.hiatt 448588b1-cb16-41e4-95b3-a496ebf0c7e8; meredith.kuhn 02ebe159-818e-4814-a72a-3620dea944a0
• Groups removed from: Sales 757e7628-ff38-477c-a5a1-71b27e94d365 (Unified), All Cascades 0344d8ae-bf3c-4b2f-b30b-c9fa93a20aa2 (Unified), SG-SSPR-Eligible d6044864-a0ef-4c30-ba37-cdba7074437e (security)
• On-prem DC: CS-SERVER (192.168.2.254), cascades.local; GuruRMM agent id (live this session) c39f1de7-d5b6-45ae-b132-e06977ab1713. Tamra final DN CN=Tamra Matthews,OU=Excluded-From-Sync,DC=cascades,DC=local, Enabled=False.
• Remediation apps used: Security Investigator (bfbc12a4, Graph+EXO read), Exchange Operator (b43e7342, EXO write), User Manager (64fac46b, Graph user/group/license write), Tenant Admin (709e6eed, password reset — no PAA elevation needed for a non-admin target).

Commands & Outputs

• Block sign-in: PATCH /users/{id} {"accountEnabled":false} → HTTP 204 (verify lagged true→false).
• Revoke sessions: POST /users/{id}/revokeSignInSessions → HTTP 200.
• Password reset: reset-password.sh … tamra.matthews … → [OK] no elevation needed (non-admin).
• Convert shared: EXO Set-Mailbox -Type Shared → RecipientTypeDetails=SharedMailbox.
• Grants (final): all 4 Get-MailboxPermission -User <u> → ["FullAccess"].
• License remove: POST /users/{id}/assignLicense removeLicenses=[f245ecc8…] → 0 licenses.
• Group removes: DELETE /groups/{gid}/members/{id}/$ref → 204 ×3.
• AD lockdown (RMM cmd a788a445…, exit 0): Set-ADAccountPassword -Reset + Disable-ADAccount + Move-ADObject → Enabled=False, DN in OU=Excluded-From-Sync, Groups=0.
• AutoMapping fix: per-user Remove-MailboxPermission → poll NONE → Add-MailboxPermission -AutoMapping $true → persists (Megan + Meredith, first spaced attempt).

Pending / Incomplete Tasks

• ALIS — Howard handling; unsure Tamra used ALIS. If she had a staff profile, disable it (M365 SSO tie already severed by the sign-in block).
• Breach check on Megan Hiatt — NEXT step this session. Megan's account carried a CREDENTIAL_STUFFING_ACTIVE marker in the April tenant inventory; Howard recalls an April remediation that should have stopped it — verify it held (/remediation-tool check megan.hiatt@…).
• Litigation hold — not applied (Howard authorized); revisit only if Tamra's PHI-access determination or a legal hold changes.

Reference Information

• Offboarding record: clients/cascades-tucson/docs/security/offboarding-2026-06-30-tamra-matthews.md
• Termination runbook: docs/security/termination-procedures.md
• Prior offboarding (pattern): docs/security/offboarding-2026-06-25-alma-montt.md
• Vault: clients/cascades-tucson/tamra-matthews
• Cascades wiki: wiki/clients/cascades-tucson.md