June 2026 Decommission Pre-Destroy Checklist

Target: complete all destruction by end of June 2026. This document tracks pre-destroy verification for each decommission-bound resource group.

CiriusSvcsVNET resources are excluded — tracked separately due to ongoing dependency mapping (NET-005/007).

---

Pre-Destroy Criteria (must pass ALL before destroying any resource in a group)

For each resource group below, verify:

• [ ] No active network traffic — PA firewall logs show zero hits for the resource IP(s) in the last 30 days. Run: PA Dashboard → Traffic → Source/Dest IP filter → 30-day range
• [ ] No DNS records — No A/CNAME records in DNS zones point to the resource. Check both ciriusgroup.com and ciriusdde.com zones in Azure DNS + any on-prem DNS zones.
• [ ] No Veeam replication target — Confirm the VM is not listed as a replication target in the Veeam console.
• [ ] Backup exists (data-bearing only) — RSV has at least one recovery point, or data has been migrated to the replacement resource. Not required for empty/test VMs.
• [ ] Entra app registrations decommissioned — Any app registration or service principal associated with the resource has been deleted from both PROD and DDE Entra tenants.
• [ ] Monitoring exclusions removed — Any known-good suppression rules in SecOps that reference this resource have been removed (ask Rory before removing).
• [ ] Terraform state clean — terraform state list shows no resources in this group after destroy, or the destroy plan shows only the expected resources.

---

Resource Groups for Destruction

1. Legacy AD Servers — ACTDIRAP04 / ACTDIRAP05

Replacement: ACTDIRAZP01 / ACTDIRAZP02 (Azure-hosted DCs, live)

Item	Check	Notes
Traffic	[ ]	IPs: TBD — check from TF state
DNS	[ ]	May have DC-related SRV records
Backup	[ ]	Not data-bearing (no independent data, domain replicated)
Entra	[ ]	No app registrations for these VMs
Monitoring	[ ]	Check for known-good rules referencing AP04/AP05
TF state	[ ]	Files: firewall/decommission-ad_e182ebbc.tf

Destroy command (from azure-infra CI):

# Remove decommission-ad_e182ebbc.tf and let terraform plan show the destroy
# Then merge the PR — CI applies the destroy

---

2. Legacy Workstations — WRKBIZAP21 through WRKBIZAP28

Status: Stale computer accounts / disks only (VMs deallocated or already removed from Intune)

Item	Check	Notes
Traffic	[ ]	These are workstations — should have zero PA traffic
DNS	[ ]	Likely no DNS records (DHCP leases expire)
Backup	[ ]	No business data — user data migrated to OneDrive/SharePoint
Entra	[ ]	Check Entra computer objects / Intune device records
Monitoring	[ ]	WRKBIZAP27 flagged in SecOps #557 (NTLM flood) — resolve first
TF state	[ ]	Files: firewall/decommission-desktopsrebuild_5b8ac9b5.tf

Pre-requisites:

• Close SecOps issue #557 (WRKBIZAP27 decommission — NTLM flood against ACTDIRAZP01)
• Close SecOps issue #558 (WRKBIZAP21$/25$/26$ decommission — stale computer accounts)
• Remove Intune device records before destroying managed disks

---

3. Legacy Log Analytics Workspace — LogWorkSpace / Automate-2447672-WUS

Replacement: cirius-logging-law-central (5d76d1f2)

Item	Check	Notes
Traffic	[ ]	N/A — not network-addressable
DNS	[ ]	No DNS records
Backup	[ ]	6-year archive already migrated to blob storage
Entra	[ ]	Check if any app has this workspace as a data source
Monitoring	[ ]	Confirm no active data collection rules pointing here
TF state	[ ]	Files: firewall/decommission-rg_firewall_logs_09d52031.tf

Pre-requisites:

• Confirm all DCRs have been migrated to law-central
• Confirm Sentinel is NOT pointing to this workspace

---

4. Legacy Networking Resources — CiriusSvcsVNET-adjacent (non-SVCS)

Includes: CIRIUS-SVCS-PANORAMA, old firewall NICs, legacy NSGs, old ASR vaults.

Note: CiriusSvcsVNET itself is tracked separately. This covers orphaned networking resources that were part of the old architecture.

Item	Check	Notes
Traffic	[ ]	Old firewall resources — should show zero recent traffic
DNS	[ ]	Check for old Panorama management FQDN
Backup	[ ]	Not data-bearing
Entra	[ ]	CIRIUS-SVCS-FW may have a service principal — check
Monitoring	[ ]	Sentinel alert rule ag-secops-critical excludes some IPs — update if needed
TF state	[ ]	Files: firewall/decommission-rg_firewall_networking_f1b62e44.tf, decommission-networking_a5fa5746.tf, decommission-networking-asr.tf

---

5. Legacy Snapshot Resources

Old VM snapshots and disk images captured during migrations.

Item	Check	Notes
Traffic	[ ]	N/A
DNS	[ ]	N/A
Backup	[ ]	These ARE backups — confirm the production VM is healthy before deleting
Entra	[ ]	N/A
TF state	[ ]	Files: firewall/decommission-snapshot_attack_7c14eced.tf

---

6. Network Watcher Resources

Azure auto-creates NetworkWatcherRG in every region where resources exist. Stale regions should be cleaned up.

Item	Check	Notes
Traffic	[ ]	N/A
DNS	[ ]	N/A
Backup	[ ]	N/A
Active flow logs	[ ]	Confirm no NSG flow logs are configured in this region before destroying
TF state	[ ]	Files: firewall/decommission-networkwatcherrg_3c4d5e6f.tf

---

Destruction Order

Destroy in this order to minimize dependency errors:

1. Snapshots and disk images (no deps)
2. VMs (ACTDIRAP04/05, WRKBIZAPxx) — detach NICs/disks first
3. Managed disks (orphaned after VM destroy)
4. NICs (orphaned after VM destroy)
5. NSGs (after NICs detached)
6. Log Analytics workspace + Automation Account (after DCRs migrated)
7. ASR vaults (after replication disabled)
8. Network Watcher resources (last — used for flow logs)
9. Old CIRIUS-SVCS-PANORAMA and firewall resources

---

Verification After Destruction

After each group is destroyed:

# Confirm no orphaned resources
az resource list --resource-group <rg-name> -o table

# Confirm TF state is clean
cd azure-infra/firewall && terraform state list | grep <resource-prefix>

# Run drift verification
# See ops-automation/scripts/nsg-east-west-audit.py and aztfexport-quarterly.yml

---

Timeline

Week	Task
May 2026	Complete pre-requisites (SecOps issues #557, #558)
May 2026	Complete all checklist verifications
June 1-15	Execute destruction (Phase 1: workstations + snapshots)
June 15-30	Execute destruction (Phase 2: legacy servers + networking)
June 30	Post-cleanup drift verification (DECOMM-006)