Home»Time Entries Audit loading ... generated 8/7/2026 at 5:27:09 pm took 0.63 seconds version: 5436fa4 helpers: v2
Territory: BMS Dates: 7/1/26 to 7/31/26 Company: IC [x] Ticket: all User: all Type: all Role: all Bill: Billable [x] Timesheet: all 6/29 7/6 7/13 7/20 7/27 Board: all Entry Status: Open [x] Ticket Status: all Issue: all [reset] Progress: 100% (2 of 2)
| row | id | Terr | Company | User | Date | Day | Start | End | Actual | Billed | Deduct | Inv Amt | Work Type | Work Role | Bill | Timesheet | Board | Entry Status | Ticket Status | Ticket # | Ticket Summary | Int Notes | Audit Done | Audit Notes | Notes | # issues | all issues | errors | warnings | notices |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 42361 | BMS | IC | rclingan | 7/6 | 11:30 am | 12:20 pm | 0.83 | 1.00 | 0 | 125.00 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 68298 | Server & User Cal | 0 | grabbed server license key from business center on courtneys account. | 0 | |||||||
| 2 | 42358 | BMS | IC | rclingan | 7/6 | 7:30 pm | 8:00 pm | 0.50 | 0.50 | 0 | 62.50 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 78900 | Fraud Email | 0 | remediation on another email breach. same datacenter ip addresses for logins, user breached had MFA enabled Token/aitm attack pattern consistent across breached accounts. we will need to setup conditional access policies to prevent these attacks. | 0 | |||||||
| 3 | 42354 | BMS | IC | rclingan | 7/6 | 8:00 pm | 10:00 pm | 2.00 | 2.00 | 0 | 250.00 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 78900 | Fraud Email | 1 | 8/6 CS long notes ok | TICKET NOTES — M365 Licensing Audit & Identity Security Scoping WORK PERFORMED: - Exported tenant license assignments via Graph PowerShell \(Get-MgSubscribedSku / Get-MgUser\); built SKU GUID-to-name map - Analyzed 179 accounts: 82 unlicensed \(shared mailboxes/service accts\), 68 Business Basic, 24 Business Standard, 3 Office 365 E3 - FINDING: Zero Entra ID P1 in tenant. Conditional Access not possible on current licensing. Note: O365\_BUSINESS\_PREMIUM SKU = Business Standard \(legacy naming\), not Business Premium - Exported per-user mailbox sizes via ExchangeOnlineManagement \(Get-EXOMailboxStatistics\). Resolved module install + WAM broker auth failure \(-DisableWAM\) - Cross-referenced mailbox sizes against license tiers to build three-tier licensing recommendation ENVIRONMENT NOTES: - On-prem AD \(no Entra Connect sync currently\), ESXi host w/ Sage server + DC, NAS, 2 sites w/ S2S VPN - ~24 desktop users on AD accounts; ~12 field laptops on LOCAL accounts \(unmanaged\) - NinjaRMM on all PCs incl. field laptops; Huntress EDR + ITDR \(retain\); Inky Phish Fence \(displace w/ Defender for O365 P1 — client wants off Inky post-Kaseya acquisition\) RECOMMENDATION SUMMARY: - Phase 1 \(38 hrs\): AD prep/IdFix/UPN alignment, Entra Connect w/ PHS + hybrid join, Intune auto-enroll GPO, CA policy set \(report-only -> enforce\), MFA/passkey rollout - Phase 2 \(20 hrs\): Field laptop migration remote via Ninja — Autopilot hash collection, ProfWiz local-to-Entra profile migration, no device collection needed - Phase 3 \(50 hrs, modular\): Intune foundation, Autopilot, app deployment, Defender for Business as AV layer under Huntress, Defender for O365 P1 + Inky cutover, MAM - Licensing: 38x Business Premium \(24 Standard upgrades, 3 E3 swaps, 11 Basic w/ mailboxes >F3 2GB limit\), 57x F3 + DfO add-on \(phone-profile field users\). Est. delta ~+$632/mo, partially offset by Inky cancellation - Pending: laptop-to-user mapping from Ninja inventory — any F3-slated user w/ company laptop moves to Premium DELIVERABLES: - One-page proposal doc \(scope/hours/licensing\) - Per-user license recommendation CSV \(95 users w/ rationale\) NEXT STEPS: - Pull device-to-user assignments from NinjaRMM - Client decision on Huntress Managed SAT \(no conflict w/ BP licensing — attack sim requires DfO P2, not included\) | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 4 | 42356 | BMS | IC | rclingan | 7/7 | 10:28 am | 10:45 am | 0.28 | 1.00 | 0 | 25.00 | Travel | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 78900 | Fraud Email | 1 | 8/6 CS fixed travel entered as remote | travel for onsite visit | 0 | ||||||
| 5 | 42355 | BMS | IC | rclingan | 7/7 | 10:45 am | 11:06 am | 0.35 | 1.00 | 0 | 125.00 | Onsite | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 78900 | Fraud Email | 0 | Onsite visit to discuss Identity and licensing upgrade to prevent continued email breaches and reduce the amount of remediations needed. | 0 | |||||||
| 6 | 43358 | BMS | IC | rclingan | 7/31 | 1:15 pm | 2:00 pm | 0.75 | 0.75 | 0 | 93.75 | Remote | Standard Technician | Billable | 7/27 | Help Desk 2.1 | Open | In Progress | 80158 | Backup A-4924 | 0 | investigate backup status of machine and begin backup after creating backup agent | 0 |
Legend:
(hover over fields for details)
Notices
| Field | Message | Count |
|---|---|---|
| Notes | Notes longer than 500 characters | 1 |
| Total | 1 | |