# Microsoft 365 Tenant Configuration Reference

**Companion doc** — read alongside `cbb-utils/M365/README.md` and `NAMING.md`.
For security posture, operations, and acquisition context see `03_-_Confidential/`.

---

## Tenant Identity

| Property | Value |
|---|---|
| **Initial domain** | `coldboreballistics.onmicrosoft.com` |
| **SharePoint root** | `coldboreballistics.sharepoint.com` |
| **License tier** | Microsoft 365 Business Standard |
| **Migration completed** | 2026-06-02 (migrated off prior typo'd tenant) |
| **Primary admin UPN** | `jschwefel@coldboreballisticsllc.com` |
| **Break-glass GA** | `admin@coldboreballistics.onmicrosoft.com` (cloud-only; never use for day-to-day) |
| **Business phone (CBB Corporate)** | 1-855-COLD-390 (`+18552653390`) — Twilio-provisioned; may route to voicemail |
| **Business phone (ScopeDOPE)** | 1-877-DOPE-707 (`+18773673707`) — Twilio-provisioned; may route to voicemail |

---

## Custom Domains

All custom domains are added as **Authoritative** accepted domains in Exchange Online.

| Domain | Purpose |
|---|---|
| `coldboreballisticsllc.com` | Primary company identity; all Primary SMTP addresses |
| `scope-dope.com` | ScopeDOPE product brand; alias domain only |
| `ballisticcomputer.com` | Trademark/brand domain; alias domain only |
| `ballisticscomputer.com` | Trademark/brand domain; alias domain only |

**Email convention:** Every account uses `<name>@coldboreballisticsllc.com` as its Primary SMTP
address. The same `<name>` on all other owned domains is added as an **alias** on that same account
— never a separate account.

---

## Provisioned Objects

### Shared Mailboxes

All shared mailboxes have Primary SMTP `<name>@coldboreballisticsllc.com` and aliases on all
other owned domains. Access is granted to `jschwefel@coldboreballisticsllc.com`.

| Name | Primary SMTP |
|---|---|
| Admin | `admin@coldboreballisticsllc.com` |
| Developer | `developer@coldboreballisticsllc.com` |
| DMARC | `dmarc@coldboreballisticsllc.com` — receives DMARC aggregate reports |
| Feedback | `feedback@coldboreballisticsllc.com` |
| General | `general@coldboreballisticsllc.com` |
| Info | `info@coldboreballisticsllc.com` |
| Legal | `legal@coldboreballisticsllc.com` |
| Marketing | `marketing@coldboreballisticsllc.com` — `press@` is an alias on this mailbox |
| Phone | `phone@coldboreballisticsllc.com` — receives Twilio IVR voicemail email |
| Privacy | `privacy@coldboreballisticsllc.com` |
| Support | `support@coldboreballisticsllc.com` |

### M365 Groups (grp-)

Departmental M365 Groups with associated SharePoint team sites.
Primary SMTP uses the `grp-` prefix to avoid collision with the function shared mailboxes above.

| Display Name | Primary SMTP |
|---|---|
| grp-Engineering | `grp-engineering@coldboreballisticsllc.com` |
| grp-Marketing | `grp-marketing@coldboreballisticsllc.com` |
| grp-Legal-Compliance | `grp-legal-compliance@coldboreballisticsllc.com` |
| grp-Operations-Finance | `grp-operations-finance@coldboreballisticsllc.com` |
| grp-Leadership | `grp-leadership@coldboreballisticsllc.com` |
| grp-Support | `grp-support@coldboreballisticsllc.com` |
| grp-Product | `grp-product@coldboreballisticsllc.com` |
| grp-IT-Security | `grp-it-security@coldboreballisticsllc.com` |
| Cold Bore Ballistics | `coldboreballistics@coldboreballisticsllc.com` (company-wide) |

### Security Groups (sg-)

Static security groups managed via Microsoft Graph.

#### Cross-cutting org groups

| Display Name | Purpose |
|---|---|
| sg-AllStaff | All employees; general policy scope |
| sg-Admins | M365 administrators |
| sg-Developers | Engineering team |
| sg-Security | Security/IT personnel |

#### Infrastructure access groups

One read/write and one read-only group per infrastructure domain. Naming pattern: `sg-<domain>-rw` / `sg-<domain>-ro`.

| Display Name | Purpose |
|---|---|
| sg-atlassian-rw | Atlassian (Jira/Confluence) — read/write access |
| sg-atlassian-ro | Atlassian (Jira/Confluence) — read-only access |
| sg-azure-admin | Azure infrastructure — Owner at subscription scope; reserved for infrastructure admins |
| sg-azure-rw | Azure infrastructure — Contributor at subscription scope; read/write access |
| sg-azure-ro | Azure infrastructure — Reader at subscription scope; read-only access |
| sg-m365-rw | Microsoft 365 tenant administration — read/write access |
| sg-m365-ro | Microsoft 365 tenant — read-only access |
| sg-slack-rw | Slack workspace administration — read/write access |
| sg-slack-ro | Slack workspace — read-only access |
| sg-twilio-rw | Twilio account — read/write access |
| sg-twilio-ro | Twilio account — read-only access |
| sg-websites-rw | Website repositories and hosting — read/write access |
| sg-websites-ro | Website repositories and hosting — read-only access |

#### CBB_Corporate content groups (SharePoint / Confluence)

Scoped by classification tier. Naming pattern: `sg-corp-<tier>-rw` / `sg-corp-<tier>-ro`.
Maps to SharePoint document library permissions per tier; will double as Confluence space permissions.

| Display Name | Tier | SharePoint path |
|---|---|---|
| sg-corp-public-rw | Public | `CBB_Corporate/01_-_Public/` |
| sg-corp-public-ro | Public | `CBB_Corporate/01_-_Public/` |
| sg-corp-general-rw | General | `CBB_Corporate/02_-_General/` |
| sg-corp-general-ro | General | `CBB_Corporate/02_-_General/` |
| sg-corp-confidential-rw | Confidential | `CBB_Corporate/03_-_Confidential/` |
| sg-corp-confidential-ro | Confidential | `CBB_Corporate/03_-_Confidential/` |
| sg-corp-restricted-rw | Highly Confidential | `CBB_Corporate/04_-_Highly_Confidential/` |
| sg-corp-restricted-ro | Highly Confidential | `CBB_Corporate/04_-_Highly_Confidential/` |

#### ScopeDOPE content groups (SharePoint / Confluence)

Scoped by classification tier. Naming pattern: `sg-dope-<tier>-rw` / `sg-dope-<tier>-ro`.

| Display Name | Tier | SharePoint path |
|---|---|---|
| sg-dope-public-rw | Public | `ScopeDOPE/01_-_Public/` |
| sg-dope-public-ro | Public | `ScopeDOPE/01_-_Public/` |
| sg-dope-general-rw | General | `ScopeDOPE/02_-_General/` |
| sg-dope-general-ro | General | `ScopeDOPE/02_-_General/` |
| sg-dope-confidential-rw | Confidential | `ScopeDOPE/03_-_Confidential/` |
| sg-dope-confidential-ro | Confidential | `ScopeDOPE/03_-_Confidential/` |
| sg-dope-restricted-rw | Highly Confidential | `ScopeDOPE/04_-_Highly_Confidential/` |
| sg-dope-restricted-ro | Highly Confidential | `ScopeDOPE/04_-_Highly_Confidential/` |

### Distribution Lists (dl-)

| Display Name | Primary SMTP |
|---|---|
| dl-Everyone | `dl-everyone@coldboreballisticsllc.com` |

---

## Object Naming Convention

See `cbb-utils/M365/NAMING.md` for the authoritative reference.

| Prefix | Object type |
|---|---|
| `sg-` | Security group |
| `dl-` | Distribution list |
| `grp-` | M365 Group |

No prefix is used for shared mailboxes — they are named by function (`support@`, `legal@`, etc.).

---

## Mail Authentication DNS Records

The following records are set (or will be set by `generate_dns_records.ps1 -Publish`) on each
authoritative custom domain. Records are maintained via `cbb-utils/namecheap/namecheap_dns.sh`.

**Per domain:**

| Record type | Host | Value |
|---|---|---|
| MX | `@` | `<domain-with-hyphens>.mail.protection.outlook.com` (priority 0) |
| TXT (SPF) | `@` | `v=spf1 include:spf.protection.outlook.com -all` |
| CNAME (DKIM) | `selector1._domainkey` | Selector CNAME from Exchange Online |
| CNAME (DKIM) | `selector2._domainkey` | Selector CNAME from Exchange Online |
| CNAME | `autodiscover` | `autodiscover.outlook.com` |
| TXT (DMARC) | `_dmarc` | `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@coldboreballisticsllc.com; fo=1` |

**DMARC ramp:** currently at `p=quarantine`. After ~2 weeks of clean aggregate reports,
graduate to `p=reject`. Aggregate reports are sent to `dmarc@coldboreballisticsllc.com` —
this is a dedicated shared mailbox (see Provisioned Objects above).

---

## SendGrid DNS Records

SendGrid domain authentication records were added to `coldboreballisticsllc.com` and `scope-dope.com`
on 2026-06-06 to support transactional email delivery via SendGrid (account: `u108827327.wl078.sendgrid.net`).
Records are managed via `cbb-utils/namecheap/namecheap_dns.sh`.

**Per authenticated domain (`coldboreballisticsllc.com` and `scope-dope.com`):**

| Record type | Host | Value |
|---|---|---|
| CNAME | `em` | `u108827327.wl078.sendgrid.net` |
| CNAME | `s1._domainkey` | `s1.domainkey.u108827327.wl078.sendgrid.net` |
| CNAME | `s2._domainkey` | `s2.domainkey.u108827327.wl078.sendgrid.net` |

**Verification:** After DNS propagation, trigger domain verification in the SendGrid console under
**Settings → Sender Authentication → Authenticate Your Domain**.

---

## Script Inventory

All scripts live in `cbb-utils/M365/`. See `cbb-utils/M365/README.md` for full details and run order.

### Posture and hardening

| Script | Type | One-line purpose |
|---|---|---|
| `audit_posture.ps1` | Read-only | Posture snapshot — run first and after any changes |
| `generate_dns_records.ps1` | Write (with `-Publish`) | Emit and push mail-auth DNS records to Namecheap |
| `enable_dkim.ps1` | Write (with `-Publish`) | Allocate DKIM selectors and push CNAMEs |
| `harden_eop.ps1` | Write | Tune EOP anti-spam/phishing/malware/outbound policies; add `[EXTERNAL]` banner rule |
| `sharing_policy.ps1` | Write | Restrict SharePoint/OneDrive external sharing to existing guests only |
| `enable_security_defaults.ps1` | Write | Enable Entra ID Security Defaults — enforces MFA and blocks legacy auth |
| `enable_mailbox_audit.ps1` | Write | Enable audit logging on all user and shared mailboxes |
| `configure_alert_policies.ps1` | Write | Set notification recipient on all High/Medium Purview alert policies |
| `enable_ome.ps1` | Write | Enable Office Message Encryption (Encrypt button in Outlook/OWA) |
| `purview_retention_policy.ps1` | Write | Create 3-year email retention policy via Microsoft Purview |
| `exo_auto_replies.ps1` | Write | Set always-on external auto-reply on feedback@, support@, info@, marketing@ |

### Org scaffolding

| Script | Type | One-line purpose |
|---|---|---|
| `provision_security_groups.ps1` | Write | Create `sg-` security groups (static membership) |
| `provision_distribution_lists.ps1` | Write | Create `dl-` distribution lists |
| `provision_m365groups.ps1` | Write | Create `grp-` departmental M365 Groups |
| `exo_shared_mailboxes.ps1` | Write | Bulk-create shared mailboxes with cross-domain aliases and access grants |
| `Add-SharedMailboxAliases.ps1` | Write | Add alias domains to all existing shared mailboxes (run after adding a new alias domain) |
| `provision_user.ps1` | Write | Provision a new user end-to-end: account, license, alias domains, groups, shared mailbox access, admin roles; sends branded HTML welcome email with banner and SharePoint onboarding link |
| `exo_create_group.ps1` | Write | Create an M365 Group with aliases and owner |

### Diagnostics and migration-era

| Script | Type | One-line purpose |
|---|---|---|
| `diagnose.ps1` | Read-only | Tenant diagnostic: SharePoint root, domains, references |
| `get_domains.ps1` | Read-only | List all domains in the tenant |
| `domain_references.ps1` | Read-only | Enumerate every object referencing a given custom domain |
| `exo_diagnose.ps1` | Read-only | Exchange Online: accepted domains, soft-deleted mailboxes, DLs |
| `write_scope_test.ps1` | Read-only | Confirm `Domain.ReadWrite.All` consent and report domain-removal blockers |
| `exo_purge_softdeleted.ps1` | **Destructive** | Permanently purge soft-deleted mailboxes holding a domain |
| `old_tenant_cleanup.ps1` | **Destructive** | Delete role accounts/groups on old tenant, strip aliases, remove domain |

---

## App Registrations

Full governance policy: `Entra_App_Registration_Policy.md`.

| App name | Client ID | Purpose | Scopes | Auth type | Owner | Created |
|---|---|---|---|---|---|---|
| `claude-code-calendar` | `3ceeb937-3527-440a-8852-dd7575f3faa4` | Outlook calendar CRUD via Microsoft Graph | `Calendars.ReadWrite` | Public / device-code | jschwefel | 2026-05 |
| `claude-code-sharepoint` | `38fa190b-c15b-4590-99e1-9c949309b408` | SharePoint List schema and items via Microsoft Graph | `Sites.Manage.All` | Public / device-code | jschwefel | 2026-06-07 |

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/M365/M365_Architecture_Reference.md` |
| **Cross-references** | `M365_Operating_Runbook.md`; `M365_Rebuild_Guide.md`; `Entra_App_Registration_Policy.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-07 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
