claudetools/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md

Cascades of Tucson — Nurse Station Kiosk GPO Build (NURSESTATION-PC)

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Continued from the earlier 7/17 session (roadmap refresh + Juan Andrade offboard). This session built and iteratively debugged the nurse-station kiosk configuration for NURSESTATION-PC, delivering on WS3 step 3b: shared caregiver desktops with phone-parity lockdown.

The kiosk GPO (CSC - Nurse Station Kiosk, GUID 32d76052-4d92-446c-95fb-614653f84742) was built with Edge policies for caregivers: BrowserSignin=2 (force OS account sign-in for SSO), EdgeDefaultProfileEnabled=1 (auto-profile from PRT, no picker), ClearBrowsingDataOnExit=1, PasswordManagerEnabled=0, AutofillAddressEnabled=0, AutofillCreditCardEnabled=0, SyncDisabled=1, HideFirstRunExperience=1, AutoImportAtFirstRun=4, BrowserGuestModeEnabled=0, BrowserAddProfileEnabled=0, SignInCtaOnNtpEnabled=0, RoamingProfileSupportEnabled=0, UserDataSnapshotRetentionLimit=0. The GPO is linked to OU=Caregiver Devices,OU=Staff PCs,OU=Workstations with GpoApply filtered to SG-Caregivers only; non-caregivers log in with no lockdown via the loopback merge (UserPolicyMode=1) on the CSC - Caregiver Device Lockdown GPO.

GPP Shortcuts (ALIS, PharmCare, Helpany) were deployed via the kiosk GPO after multiple rounds of debugging. The root cause of non-delivery was wrong CSE GUIDs: the correct CSE for GP Preferences Shortcuts is {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} (verified from client registry), not {BC75B1ED-...} (Printers) or {42B5FAAE-...} (Scripts). Shortcuts target %DesktopDir% (per-user desktop), deployed at logon via loopback. The original CSC - Caregiver Workstation GPO shortcuts (in the user OU, filtered to SG-Caregivers-Test) were moved to the kiosk GPO and removed from the original to prevent duplication.

Additional configurations: DontDisplayLastUserName=1 + dontdisplaylockeduser=3 on the lockdown GPO (hides previous usernames on the login screen); both nurse printers (\\CS-SERVER\Nurses - Brother MFC-L8900CDW and \\CS-SERVER\Health Services - Konica Minolta C368) added as machine-level connections via rundll32 printui.dll /ga; UI restrictions (NoRun, NoControlPanel, NoSetFolders, DisableCMD, DisableRegistryTools, DisableTaskMgr, DisableUserInstalls, NoNetHood, NoRecentDocsHistory, ClearRecentDocsOnExit) applied via the kiosk GPO; Microsoft Store blocked via RemoveWindowsStore=1.

Session ended with app restriction still incomplete. The UI restrictions (no CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store) are in place, but user-facing Store apps (Camera, Netflix, Xbox, Spotify, etc.) are still launchable from the Start menu. Howard rejected removing the apps from the machine because non-caregiver users need access. AppLocker with group-specific Deny rules for SG-Caregivers is the correct next step, but was not completed this session.

Key Decisions

• BrowserSignin=2 + EdgeDefaultProfileEnabled=1 chosen to force Edge SSO via PRT, eliminating the need for caregivers to enter credentials in the browser after Windows login. BrowserSignin=0 (original setting) was blocking PRT passthrough entirely.
• GPP shortcuts placed in the kiosk GPO (machine OU, SG-Caregivers filter) rather than the Caregiver Workstation GPO (user OU, SG-Caregivers-Test filter) so all SG-Caregivers members get shortcuts on any caregiver device, not just test-group members.
• Shortcuts use %DesktopDir% (per-user desktop) not %CommonDesktopDir% (Public Desktop) because GPP user preferences targeting CommonDesktopDir require a user logon to process but the chicken-and-egg problem means the first login has no shortcuts.
• Printers added as machine-level connections (/ga flag) rather than per-user connections so every user gets them automatically without GPO printer deployment complexity.
• DontDisplayLastUserName placed in the CSC - Caregiver Device Lockdown GPO (not the kiosk GPO) because it's a computer-level policy (HKLM) and must apply regardless of which user is at the login screen.
• App removal rejected by Howard (non-caregivers need the apps) — AppLocker with SG-Caregivers Deny rules is the planned approach for the next session.
• pilot.test AD account (from June) used as the test identity instead of creating a new test.caregiver account. A duplicate test.caregiver was created by mistake and deleted same session. pilot.test was added to SG-Caregivers (kiosk GPO filter) in addition to existing SG-Caregivers-Test membership. Password reset to CareTest2026!.

Problems Encountered

• PRT not issuing (AzureAdPrt : NO): NURSESTATION-PC was hybrid-joined but PRT acquisition failed. Root cause: stale PRT attempt cached for sysadmin@cascadestucson.com with AADSTS50126 (invalid credentials). Fixed by clearing WAM token broker cache (Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker) for all users + reboot.
• Edge showing sync/profile picker: BrowserSignin=0 blocked Edge from using the PRT entirely. Changed to BrowserSignin=2 (force OS account) + EdgeDefaultProfileEnabled=1 (auto-profile, no picker). Also needed to clear stale Edge profile data (C:\Users\pilot.test\AppData\Local\Microsoft\Edge\User Data).
• Duplicate desktop shortcuts: Three sources stacking: (1) Public Desktop (manually placed), (2) per-user desktop from Default profile (copied at first login), (3) GPP shortcuts from CSC - Caregiver Workstation GPO (action="R" to %DesktopDir%). Fixed by cleaning Default profile desktop, removing manual Public Desktop shortcuts, and consolidating all shortcuts into the kiosk GPO GPP only.
• GPP shortcuts not deploying (multiple rounds): Wrong CSE GUIDs on the GPO AD object and GPT.INI. Tried {42B5FAAE-...} (Scripts) and {BC75B1ED-...} (Printers) before discovering the correct Shortcuts CSE is {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} via HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions on the client machine. Also discovered the original CSC - Caregiver Workstation GPO was filtered to SG-Caregivers-Test (not SG-Caregivers), so a.vallejo (in SG-Caregivers only) never received those shortcuts.
• CMD window popup at logon: Caused by a .bat logon script configured in the kiosk GPO (created as a shortcut deployment workaround before GPP was fixed). Removed the scripts.ini, Scripts directory, and GPO registry entries for the logon script.
• Duplicate AD test account: test.caregiver created, then discovered pilot.test already existed from June with ALIS staff email mapping and Business Premium license. Deleted test.caregiver, added pilot.test to SG-Caregivers, reset password.

Configuration Changes

On CS-SERVER (via RMM):

• GPO CSC - Nurse Station Kiosk (32d76052-4d92-446c-95fb-614653f84742): 15 Edge HKCU policies, GPP Shortcuts.xml (ALIS/PharmCare/Helpany to %DesktopDir%), CSE GUIDs [{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}{0F6B957D-509E-11D1-A7CC-0000F87571E3}], UI restrictions (NoRun, NoControlPanel, DisableCMD, DisableRegistryTools, DisableTaskMgr, DisableUserInstalls, NoNetHood, NoRecentDocsHistory, ClearRecentDocsOnExit, NoSetFolders, NoSMHelp), RemoveWindowsStore=1
• GPO CSC - Caregiver Device Lockdown: added DontDisplayLastUserName=1 + dontdisplaylockeduser=3 (HKLM)
• GPO CSC - Caregiver Workstation (3B5CD9A6-A278-4676-A9FD-9396D21A8261): GPP Shortcuts.xml removed (moved to kiosk GPO)
• AD: pilot.test added to SG-Caregivers, password reset; duplicate test.caregiver account created then deleted

On NURSESTATION-PC (via RMM):

• WAM token broker cache cleared for all user profiles
• Edge profile data cleared for pilot.test
• Per-user + Default profile desktop shortcuts cleaned (Public Desktop cleared, GPO handles deployment)
• Machine-level printer connections: \\CS-SERVER\Nurses - Brother MFC-L8900CDW + \\CS-SERVER\Health Services - Konica Minolta C368 via rundll32 printui.dll /ga
• Multiple gpupdate /force cycles

Local scripts created:

• clients/cascades-tucson/scripts/: create-test-caregiver.ps1, align-test-pilot-upn.ps1, audit-test-accounts.ps1, fix-pilot-test-accounts.ps1, kiosk-gpo-firstrun.ps1, fix-edge-sso.ps1, fix-edge-auto-profile.ps1, clear-prt-cache.ps1, check-hybrid-join.ps1, check-printers.ps1, add-nurse-printer.ps1, find-all-shortcuts.ps1, dedup-shortcuts-final.ps1, find-shortcut-source.ps1, identify-gpo-and-fix.ps1, restore-gpp-shortcuts-public.ps1, fix-shortcut-target.ps1, move-shortcuts-to-kiosk-gpo.ps1, cleanup-and-gpupdate.ps1, check-gpp-apply.ps1, debug-gpp-shortcuts.ps1, debug-gpp-2.ps1, check-cse-client.ps1, fix-cse-final.ps1, fix-cse-correct.ps1, fix-gpo-cse-guids.ps1, verify-kiosk-config.ps1, verify-kiosk-2.ps1, caregiver-app-restrictions.ps1, app-restrict-1.ps1, app-restrict-2.ps1, fix-cmd-popup.ps1, list-packaged-apps.ps1, remove-unwanted-apps.ps1, hide-last-user-gpupdate.ps1, clear-edge-profiles-gpupdate.ps1, check-avallejo.ps1

Credentials & Secrets

• pilot.test AD account: cascades\pilot.test / CareTest2026! (password reset this session; vault: clients/cascades-tucson/pilot-test-ad.sops.yaml)
• a.vallejo caregiver account: cascades\a.vallejo / Sunrise4827 (from vault: clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml)
• Duplicate test.caregiver account created with password KioskTest-7492!, then DELETED same session. Vault entry test-caregiver-ad.sops.yaml also deleted.

Infrastructure & Servers

• NURSESTATION-PC: RMM agent f5a89784-834f-47b1-82e2-7e3e9dd337ff, hybrid-joined (AzureAdJoined=YES, DomainJoined=YES), DeviceId d3bf931f-f128-4261-8398-b46c34a4b342, TenantId 207fa277-e9d8-4eb7-ada1-1064d2221498, DN CN=NURSESTATION-PC,OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local
• CS-SERVER: RMM agent c39f1de7-d5b6-45ae-b132-e06977ab1713
• Kiosk GPO: CSC - Nurse Station Kiosk, GUID 32d76052-4d92-446c-95fb-614653f84742, linked to OU=Caregiver Devices, GpoApply=SG-Caregivers
• Lockdown GPO: CSC - Caregiver Device Lockdown, UserPolicyMode=1 (loopback merge)
• Caregiver Workstation GPO: CSC - Caregiver Workstation, GUID 3B5CD9A6-A278-4676-A9FD-9396D21A8261, linked to OU=Caregivers,OU=Departments, GpoApply=SG-Caregivers-Test
• Reception GPO CSC - Reception Workstation Policy also applies to NURSESTATION-PC (pre-existing, flagged)
• Printers: \\CS-SERVER\Nurses - Brother MFC-L8900CDW (TCP_192.168.2.75), \\CS-SERVER\Health Services - Konica Minolta C368 (TCP_192.168.1.138)
• GP Preferences Shortcuts CSE GUID: {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} (verified from client HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions)

Commands & Outputs

• dsregcmd /status on NURSESTATION-PC: AzureAdJoined: YES, DomainJoined: YES, AzureAdPrt: NO (initially), DeviceAuthStatus: SUCCESS; PRT failure was AADSTS50126 for stale sysadmin@ credential
• rundll32 printui.dll,PrintUIEntry /ga /n \\CS-SERVER\Nurses - Brother MFC-L8900CDW — added machine-level printer
• GPP Shortcuts CSE discovery: Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" revealed {C418DD9D-...} = "Group Policy Shortcuts"
• gpresult /scope computer /r confirmed applied GPOs: CSC - Caregiver Device Lockdown, CSC - Always Wait For Network, CSC - Reception Workstation Policy, CSC - Point and Print

Pending / Incomplete Tasks

1. App restriction for caregivers (INCOMPLETE): UI restrictions block CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store, but Store apps (Camera, Netflix, Xbox, Spotify) are still launchable. Howard rejected removing apps from the machine (non-caregivers need them). Next step: AppLocker with Packaged App Deny rules scoped to SG-Caregivers — Allow Domain Users: * (baseline) + Deny SG-Caregivers: [Netflix, Camera, Xbox, etc.]. Needs AppIdentity service enabled + AppLocker XML policy in the Lockdown GPO (Computer Configuration).
2. ASSISTNURSE-PC: Second nurse station not yet configured. Needs: move from CN=Computers to OU=Caregiver Devices + deploy machine-level printers + gpupdate. GPO settings will apply automatically.
3. PRT verification: After token cache clear + reboot, need to confirm AzureAdPrt: YES on next caregiver login and verify ALIS SSO is fully silent (no password prompt in browser).
4. CSC - Reception Workstation Policy: Still applies to NURSESTATION-PC (pre-existing, flagged to Howard, unresolved).
5. Cleanup after pilot: Delete pilot.test AD account + delta sync when WS3 caregiver go-live is complete.
6. Carried from earlier session: break-glass accounts + FIDO2, caregiver allow-list flip, relicense 29 suspended-Standard, image backup repair, domain-join tail, network tail, WS8 SharePoint/Teams, WS9 Medtelligent scoping, ticket-verify pass.

Reference Information

• Session log (earlier today): clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md
• Kiosk GPO SYSVOL: \\cascades.local\SYSVOL\cascades.local\Policies\{32d76052-4d92-446c-95fb-614653f84742}
• Shortcuts XML: ...\User\Preferences\Shortcuts\Shortcuts.xml (3 entries: ALIS, PharmCare, Helpany)
• Vault pilot.test: clients/cascades-tucson/pilot-test-ad.sops.yaml
• Vault (superseded cloud-only): clients/cascades-tucson/pilot-test-user.sops.yaml
• Phone kiosk config (Intune): CSC - Android Shared Phones Restrictions id 070a76c2-a8c3-4f7f-9ba7-1f4ac5084184
• Caregiver controls doc: clients/cascades-tucson/docs/security/hipaa-caregiver-controls.md
• ALIS SSO app: d5108493-cba8-4f08-90b6-1bb0bc09eb2a
• Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15)

Update: 14:34 PT — AppLocker app restriction completed

Session Summary

Completed the app restriction for caregivers on NURSESTATION-PC using AppLocker, the built-in GPO-based application control. Howard directed that the solution must use proper domain tools (not hacks like app removal) so that non-caregiver users retain full access and the configuration survives machine replacement.

AppLocker Packaged App Rules were built with an Allow Everyone: * baseline (all users get all apps by default) plus 10 Deny rules scoped to SG-Caregivers (SID S-1-5-21-388235164-2207693853-3666415804-1183) blocking non-essential user-facing apps: Edge GameAssist, Paint, Photos, Store, Wallet, Cortana, Intel Graphics/Experience/Optane, and Realtek Audio. The Executable/MSI/Script/DLL rule collections are set to NotConfigured (no restriction on Win32 apps — the existing UI restrictions via the kiosk GPO handle CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store blocking).

The policy XML was written to \\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml, applied locally on NURSESTATION-PC via Set-AppLockerPolicy, and also written into the CSC - Caregiver Device Lockdown GPO (Computer Configuration, HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx) with individual rules as registry values. The Application Identity service (AppIDSvc) was set to Automatic start both locally and via GPO. Howard confirmed the restrictions are working — blocked apps show the administrator block message for caregivers while non-caregivers are unaffected.

Key Decisions

• AppLocker chosen over app removal because non-caregiver users need access to all apps and the config must survive machine replacement. AppLocker is the proper GPO-based tool for group-specific app whitelisting.
• Packaged App Rules only (not Executable Rules) — Win32 app access is controlled by the existing UI restrictions (DisableCMD, NoRun, NoControlPanel, etc.) in the kiosk GPO. AppLocker Executable Rules would affect all users on the machine and can't be scoped to a group without complex workarounds.
• Allow Everyone: * + Deny SG-Caregivers: [specific apps] pattern — the only AppLocker approach that restricts one group while leaving everyone else unrestricted. Deny rules override Allow rules, so caregivers are blocked from the listed apps despite the baseline Allow.
• Most bloatware (Netflix, Xbox, Camera, Spotify, etc.) was already absent from the machine — the deny list focused on what was actually installed.
• Confirmed caregiver accounts are standard domain users (not admin) — no local admin, no Domain Admins membership, only SG-Caregivers group membership.

Problems Encountered

• RMM agent body-size limit (~7KB encoded) repeatedly hit when building AppLocker XML inline in PowerShell scripts. Resolved by writing the XML generation script to SYSVOL on CS-SERVER first, then applying from NURSESTATION-PC with a simple one-liner referencing the SYSVOL path.
• Initial Get-AppxPackage -AllUsers -Name $name returned NOT_INSTALLED for most apps despite earlier full listing showing them — likely a timing issue with package registration state after profile operations. Re-enumerated with a filtered full listing to get accurate installed app inventory.

Configuration Changes

• \\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml — NEW: AppLocker policy XML (5282 chars, 11 rules: 1 Allow Everyone + 10 Deny SG-Caregivers)
• GPO CSC - Caregiver Device Lockdown: AppLocker Appx rules added (HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx), AppIDSvc Start=2 (Automatic)
• NURSESTATION-PC: AppIDSvc enabled and running, AppLocker local policy applied
• Local scripts created: applocker-step1-enable.ps1, applocker-recheck-apps.ps1, applocker-apply-simple.ps1, applocker-write-xml.ps1, applocker-to-gpo.ps1, applocker-stage.ps1, build-applocker-policy.ps1, get-applocker-sids.ps1

Infrastructure

• SG-Caregivers SID: S-1-5-21-388235164-2207693853-3666415804-1183
• Domain Users SID: S-1-5-21-388235164-2207693853-3666415804-513
• AppLocker policy path: \\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml
• GPO: CSC - Caregiver Device Lockdown, AppLocker rules in HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx

Pending / Incomplete Tasks

1. ASSISTNURSE-PC: Move from CN=Computers to OU=Caregiver Devices + deploy machine-level printers + gpupdate. All GPO settings (kiosk Edge policies, shortcuts, AppLocker, UI restrictions, DontDisplayLastUserName) apply automatically via OU membership.
2. Test as non-caregiver: Verify Howard's own login is completely unrestricted (no AppLocker blocks, no UI restrictions, full Start menu).
3. PRT/SSO verification: Confirm ALIS SSO is fully silent after the PRT cache clear + reboot.
4. Remaining roadmap items carried forward from earlier session.

Update: 15:05 PT — M365 license audit + shared mailbox conversions

Session Summary

Audited the full Cascades M365 license inventory via Graph API. Discovered two distinct SKUs both named "Microsoft 365 Business Premium": the active SPB (cbdc14ab-..., 45 seats, 40 consumed) and a legacy suspended O365_BUSINESS_PREMIUM (f245ecc8-..., 37 seats suspended, 23 users still assigned). The key difference: SPB includes the security stack (Intune, MDE, Entra P1, MFA Premium, AIP, Purview, Windows Business) while the legacy SKU does not. Also found 5 users on a suspended Exchange Essentials SKU.

Identified 12 functional/role-based accounts (accounting@, accountingassistant@, boadmin@, frontdesk@, hr@, memcarereceptionist@, security@, Training@, fax@, medtech@, nurse@, transportation@) as shared mailbox conversion candidates. Checked sign-in audit logs for all 12: frontdesk@ and memcarereceptionist@ are actively used (daily sign-ins from on-site workstations); the other 10 had zero sign-ins in the last 30 days.

With Howard's approval, converted 8 user mailboxes to shared mailboxes (accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@) via Exchange Online Set-Mailbox -Type Shared; accounting@ and fax@ were already shared. Removed licenses from all 10: 6x O365_BUSINESS_PREMIUM and 4x EXCHANGE_S_ESSENTIALS. medtech@ forwarding to nurses@cascadestucson.com was preserved. Post-conversion: O365BP suspended consumed dropped from 29 to 23; EXCH-ESS suspended consumed dropped from 5 to 1.

Produced the full tenant license roster for Howard to cross-reference with Pax8 billing. The 23 remaining users on the suspended O365BP need to be swapped to SPB seats. SPB has 5 free seats, so 18 more are needed through Pax8 (either a subscription swap from the old SKU or a seat increase). Howard is checking Pax8 for what's currently being billed.

Key Decisions

• Converted 10 inactive functional accounts to shared mailboxes rather than keeping them licensed. Shared mailboxes receive/send email identically but don't consume a paid license (up to 50GB). Zero workflow impact since nobody signs into them.
• Left frontdesk@ and memcarereceptionist@ as licensed user mailboxes — both have active daily sign-ins from on-site workstations.
• Identified the two-SKU situation as a Pax8 billing question, not a net-new-cost question — Howard may already be paying for the old SKU seats through Pax8, in which case it's a subscription swap.

Configuration Changes

• Exchange Online: 8 mailboxes converted UserMailbox -> SharedMailbox (accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@)
• Licenses removed: 6x O365_BUSINESS_PREMIUM (f245ecc8) from accounting@, accountingassistant@, boadmin@, hr@, security@, Training@; 4x EXCHANGE_S_ESSENTIALS (e8f81a67) from fax@, medtech@, nurse@, transportation@

Infrastructure

• Tenant: 207fa277-e9d8-4eb7-ada1-1064d2221498
• SPB SKU: cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46 (45 enabled, 40 consumed, 5 free)
• O365_BUSINESS_PREMIUM SKU: f245ecc8-75af-4f8e-b61f-27d8114de5f3 (SUSPENDED, 23 consumed post-conversion)
• EXCHANGE_S_ESSENTIALS SKU: e8f81a67-bd96-4074-b108-cf193eb9433b (SUSPENDED, 1 consumed post-conversion — Shelby Trozzi)
• SPB service plans include: INTUNE_A, MDE_SMB, AAD_PREMIUM, MFA_PREMIUM, RMS_S_ENTERPRISE, RMS_S_PREMIUM, PURVIEW_DISCOVERY, WINBIZ, OFFICE_SHARED_COMPUTER_ACTIVATION
• O365BP service plans do NOT include: Intune, MDE, AAD Premium, MFA Premium, AIP, Purview, Windows Business

Pending / Incomplete Tasks

1. Howard checking Pax8 — verify what's being billed for the old O365_BUSINESS_PREMIUM SKU; determine if it's a subscription swap or seat increase to move the 23 users to SPB.
2. 23 users still on suspended O365BP — need SPB license assignment once seats are available (5 free today, need 18 more).
3. Shelby Trozzi — on BOTH suspended O365BP AND suspended EXCH-ESS; needs both removed and SPB assigned.
4. pilot.test@ — consuming 1 SPB seat; reclaim when WS3 pilot is complete.
5. devices@ and MDMS@ — service accounts consuming SPB seats; evaluate if they truly need full Business Premium.