Files

Howard Enos d4fd71baab sync: auto-sync from HOWARD-HOME at 2026-06-25 12:53:21

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-25 12:53:21

2026-06-25 12:54:04 -07:00

3.2 KiB

Raw Blame History

Offboarding Record — Alma Montt

Date: 2026-06-25 · Performed by: Howard Enos (ClaudeTools session) · Authorized by: Howard Enos Separation type: Termination (no longer with Cascades) · Role: Memory Care Life Enrichment / MC Reception Runbook: docs/security/termination-procedures.md

Identities handled

M365 (cloud-only): Alma.Montt@cascadestucson.com — id b2fb546e-687a-4647-b286-9c8edd3d989f
On-prem AD: Alma.Montt (was OU=Administrative,OU=Departments,DC=cascades,DC=local — separate object, NOT Entra-synced)
ALIS: N/A — Alma had no ALIS access (Life Enrichment role, not clinical/caregiver; confirmed Howard 2026-06-25)

Actions completed (M365)

#	Action	Result
1	Revoke active sign-in sessions	HTTP 200
2	Block sign-in (`accountEnabled=false`)	confirmed false
3	Reset password (random, vaulted)	OK (via JIT PAA — see follow-up)
4	Grant `Shelby.Trozzi` FullAccess + AutoMapping to mailbox	confirmed (auto-attaches in Shelby's Outlook)
5	Convert mailbox → SharedMailbox	confirmed (78 MB / 198 items)
6	Remove Business Premium (SPB) license	confirmed 0 licenses — frees 1 SPB seat
7	Hide from GAL	confirmed
8	Remove from `SG-SSPR-Eligible`	HTTP 204

Actions completed (on-prem AD, CS-SERVER)

Disable-ADAccount Alma.Montt → Enabled=False
Group memberships stripped → groupCount=0
Moved to OU=Excluded-From-Sync,DC=cascades,DC=local

Retention / compliance

No Litigation Hold applied. Decision (Howard, 2026-06-25): Alma had no PHI / medical-data access in her role, so the 7-yr litigation hold is not required. Mailbox is preserved via shared-mailbox conversion + zero-deletion posture (no mailbox deleted). Revisit only if her PHI-access determination changes.
Password stored for emergency recovery/audit only: vault clients/cascades-tucson/alma-montt. Do NOT re-enable without authorization.

Open follow-ups

~~ALIS staff profile~~ — N/A, no ALIS access (Howard 2026-06-25).
SECURITY — needs Global Admin / portal: the password reset required a JIT elevation of the ComputerGuru – Tenant Admin service principal to Privileged Authentication Administrator, and the automatic role removal was blocked by Graph ("removing self from built-in role is not allowed"). The PAA role is still assigned to the SP and must be removed manually in Entra (Roles & admins → Privileged Authentication Administrator → remove ComputerGuru - Tenant Admin). Its standing Conditional Access Administrator role is intentional — leave that.
Reconcile: Alma removed from the proposed share rosters (docs/migration/share-group-roster-proposed-2026-06-25.md) and all other active plans (2026-06-25): docs/servers/active-directory.md, docs/printers.md, docs/cloud/user-account-rollout-plan.md, docs/cloud/p2-staff-candidates.md, PLAN-AND-QUESTIONS-2026-04-24.md, docs/migration/share-access-matrix-2026-04-23.md, docs/migration/scripts/phase2-print-server.ps1. Dated April/May questionnaires, CSVs, reports, and the archived plan left as historical record.

3.2 KiB Raw Blame History Unescape Escape