160 lines
7.0 KiB
Markdown
160 lines
7.0 KiB
Markdown
---
|
|
title: Quantum WMS
|
|
slug: quantumwms
|
|
type: client
|
|
project_key: clients/quantumwms
|
|
last_updated: 2026-05-26
|
|
---
|
|
|
|
# Quantum WMS
|
|
|
|
## Overview
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Company | Quantum WMS |
|
|
| Primary domain | quantumwms.com |
|
|
| Personal domain | sheilaperess.com |
|
|
| M365 tenant | `NETORGFT2570783.onmicrosoft.com` / `8f7eaff4-f913-4d3f-b8b9-92e695d987c6` |
|
|
| GoDaddy admin | `plan@johnvelez.com` (John Velez) — ACG has delegate access |
|
|
| Project key | `clients/quantumwms` |
|
|
|
|
## Contacts
|
|
|
|
| Name | Role | Notes |
|
|
|---|---|---|
|
|
| John Velez | Primary / M365 global admin | plan@johnvelez.com; GoDaddy account owner for both domains |
|
|
| Sheila Peress | Owner/principal | sheilaperess.com personal domain; compliance decision-maker; final say on license tier |
|
|
|
|
## Current Email Infrastructure
|
|
|
|
- **Registrar:** GoDaddy (quantumwms.com + sheilaperess.com) — ACG has delegate access
|
|
- **DNS:** GoDaddy DomainControl (NS03/NS04.DOMAINCONTROL.COM) — no DNSSEC
|
|
- **Mail routing:** Intermedia hosted Exchange — `exch090.serverdata.net` cluster (east/west)
|
|
- IP: `64.78.25.106` (Intermedia data center)
|
|
- Autodiscover: `ar-east.exch090.serverdata.net`
|
|
- This is Exchange Server software hosted by Intermedia, NOT Exchange Online
|
|
- **Intermedia setup:** Appears hybrid on-premises Exchange — carries full Exchange Server CVE exposure
|
|
|
|
### DNS / Email Security Gaps (CRITICAL)
|
|
|
|
| Record | Status | Impact |
|
|
|---|---|---|
|
|
| DMARC | **MISSING** | Anyone can spoof @quantumwms.com with no enforcement |
|
|
| SPF | **TWO RECORDS** (misconfiguration) | RFC 7208 allows only one; causes unpredictable SPF evaluation and deliverability failures |
|
|
| DKIM | Not found on standard selectors | Outbound mail not cryptographically signed |
|
|
| DNSSEC | Not signed | Domain hijack risk |
|
|
|
|
SPF records found (conflict):
|
|
1. `v=spf1 include:spf.intermedia.net -all`
|
|
2. `v=spf1 include:_spf-usg1.ppe-hosted.com include:secureserver.net ~all`
|
|
|
|
## M365 Tenant (GoDaddy/johnvelez.com)
|
|
|
|
- **Tenant created:** 2016-12-05 (GoDaddy-provisioned)
|
|
- **onmicrosoft domain:** `NETORGFT2570783.onmicrosoft.com`
|
|
- **quantumwms.com** is NOT a verified domain in this tenant — email runs entirely through Intermedia
|
|
- **Remediation app consent:** Tenant Admin tier consented by John (plan@johnvelez.com) 2026-05-26
|
|
|
|
### Users
|
|
|
|
| UPN | Display | Licenses | Notes |
|
|
|---|---|---|---|
|
|
| `plan@johnvelez.com` | John Velez | O365 Business Essentials + Flow Free | Active — no desktop Office apps |
|
|
| `admin@NETORGFT2570783.onmicrosoft.com` | johnvelez.com | None | GoDaddy admin account |
|
|
| `john__quantumwms.com@NETORGFT2570783.onmicrosoft.com` | john@quantumwms.com | None | Shell account, no mailbox, created 2026-03-16 |
|
|
| `migrationapp@NETORGFT2570783.onmicrosoft.com` | SkyKick Inc. | None | Old 2016 migration app account |
|
|
|
|
### Consent URL (Tenant Admin tier)
|
|
|
|
```
|
|
https://login.microsoftonline.com/8f7eaff4-f913-4d3f-b8b9-92e695d987c6/adminconsent?client_id=709e6eed-0711-4875-9c44-2d3518c47063&redirect_uri=https://azcomputerguru.com&prompt=consent
|
|
```
|
|
|
|
Post-consent onboard command:
|
|
```bash
|
|
bash onboard-tenant.sh 8f7eaff4-f913-4d3f-b8b9-92e695d987c6
|
|
```
|
|
|
|
## Compliance Context: Broker/Dealer Requirements
|
|
|
|
John and Sheila believe Intermedia is mandated by their Broker/Dealer. **This is almost certainly incorrect.**
|
|
|
|
### What SEC Rule 17a-4 / FINRA Rule 4511 actually require
|
|
|
|
- Electronic communication retention (3 years accessible, 6 years total for most records)
|
|
- Non-rewritable, non-erasable (WORM-compliant) archiving
|
|
- Supervisory review capability
|
|
- Ability to produce records on regulatory demand
|
|
|
|
### What they do NOT require
|
|
|
|
- Intermedia specifically
|
|
- Any named third-party vendor
|
|
- Exchange Server or hosted Exchange
|
|
|
|
### Microsoft 365 satisfies all FINRA/17a-4 requirements
|
|
|
|
Microsoft Purview (included in Business Premium) provides WORM-compliant archiving with a CFTC/SEC 17a-4 compliance attestation from Cohasset Associates. The majority of FINRA-registered broker/dealers run on Exchange Online. FINRA has published guidance explicitly endorsing cloud-based recordkeeping.
|
|
|
|
### Action item (BLOCKER)
|
|
|
|
Sheila has been asked to produce **written policy from the Broker/Dealer that explicitly names Intermedia** as the required platform. This policy is expected not to exist — the B/D policy will require compliant archiving, not a specific vendor. Resolution expected before meeting 2026-05-27 14:00.
|
|
|
|
## Recommended Architecture: M365 Business Premium + Mailprotector
|
|
|
|
### License Plan
|
|
|
|
| Account | License | Domain |
|
|
|---|---|---|
|
|
| John (firm) | M365 Business Premium | quantumwms.com |
|
|
| Sheila (firm) | M365 Business Premium | quantumwms.com |
|
|
| Sheila (personal) | Exchange Online Plan 1 | sheilaperess.com |
|
|
| Others TBD | Exchange Online Plan 1 | TBD |
|
|
|
|
### What Business Premium provides over Intermedia
|
|
|
|
| Capability | Intermedia Hosted Exchange | M365 Business Premium |
|
|
|---|---|---|
|
|
| Email | Exchange Server (hosted) | Exchange Online (Microsoft cloud) |
|
|
| Exchange CVE exposure | YES — full Server CVE surface | No — Microsoft patches same-day |
|
|
| Spam/malware filtering | Basic | Defender for Office 365 Plan 1 (Safe Links, Safe Attachments) |
|
|
| Frontend filtering | None | Mailprotector (ACG-managed) |
|
|
| MFA enforcement | Manual | Entra ID P1 — Conditional Access |
|
|
| FINRA archiving | Intermedia archiver (extra cost) | Microsoft Purview — included |
|
|
| Desktop Office apps | No | Yes (Word, Excel, Outlook, etc.) |
|
|
| Mobile device management | No | Intune — included |
|
|
| DMARC/DKIM setup | Not managed | ACG-managed during migration |
|
|
|
|
### Migration Steps
|
|
|
|
1. [DONE] Get consent from John (2026-05-26)
|
|
2. Obtain written B/D compliance policy from Sheila — confirm no Intermedia mandate
|
|
3. Add quantumwms.com as verified domain to johnvelez.com tenant
|
|
4. Purchase 2x Business Premium (direct or ACG CSP)
|
|
5. Create firm mailboxes (john@quantumwms.com, sheila@quantumwms.com)
|
|
6. Assign Business Premium licenses
|
|
7. Set up Mailprotector frontend for quantumwms.com
|
|
8. Configure DMARC, fix SPF (single record), configure DKIM
|
|
9. Cut MX from Intermedia → Exchange Online
|
|
10. Migrate existing mail from Intermedia → Exchange Online
|
|
11. Activate Office apps on their machines
|
|
12. Cancel Intermedia after cutover confirmed
|
|
13. Move DNS (quantumwms.com + sheilaperess.com) to Cloudflare
|
|
14. Purchase Exchange Online Plan 1 for personal domain accounts
|
|
15. Cancel GoDaddy email hosting per account as each migrates
|
|
|
|
### GoDaddy Decoupling Plan
|
|
|
|
- DNS: move both domains to Cloudflare (transfer locks must be removed in GoDaddy first)
|
|
- M365 licensing: swap GoDaddy-resold O365 Business Essentials → Business Premium
|
|
- Intermedia: cancel after mail cutover confirmed
|
|
|
|
## Open Items
|
|
|
|
- [ ] **BLOCKER:** Sheila to produce B/D written policy on email compliance requirements (due 2026-05-27 14:00)
|
|
- [ ] Sheila to confirm: sheilaperess.com Exchange Online Plan 1 only vs. Business Basic upgrade
|
|
- [ ] Determine additional personal domain accounts beyond sheilaperess.com
|
|
- [ ] DNS cutover timing for both domains
|
|
- [ ] Confirm whether SkyKick migration app account (2016) can be deleted
|