# Cascades — Caretaker roster update (client list received 2026-07-01)

**Source:** updated caretaker list from the client, reconciled against live AD
(CS-SERVER, `OU=Caregivers,OU=Departments,DC=cascades,DC=local` + `SG-Caregivers`)
pulled 2026-07-01 via RMM (cmd `bf80962c`).

**Live state:** OU holds 42 objects = 40 enabled caregivers + `pilot.test` (test
artifact) + `n.castro` (disabled). `SG-Caregivers` = the same 40. All 40 were
Business Premium-licensed + temp-passworded 2026-06-30. The client's 40-entry list
maps 1:1 onto the 40 enabled accounts — no unknowns in either direction.

## Departures — 7 marked "no longer with us" (all have live enabled accounts)

| Person | Account | Notes |
|---|---|---|
| Bella Mendoza | b.mendoza | ALIS: already Discharged |
| Corey Tate | c.tate | ALIS: already Discharged |
| Diana Fierros | d.fierros | no ALIS record |
| Gloria Williford | g.williford | ALIS: already Discharged |
| Kasey Flores | k.flores | ALIS: already Discharged |
| Maia Baker | m.baker | ALIS: already Discharged |
| Mary Kariuki | m.kariuki | ALIS: Discharged, DUP records 429856/429858 |

These are exactly the 7 flagged 2026-06-29/30 as ALIS-Discharged / no-ALIS-record —
consistent with them having already left. None ever logged in (accounts bulk-created
May, passwords never used). Offboarding = disable AD account + remove from
SG-Caregivers + remove Business Premium license (frees 7 of 45 seats).

## Additions — 5 requested

| Person | Proposed account | Status |
|---|---|---|
| Christine Nyanzunda | christine.nyanzunda (EXISTS, OU=Care-Memorycare) | Was explicitly EXCLUDED from SG-Caregivers 2026-06-30 (Howard: frontline only; she is admin-adjacent, Health Admin Assistant roles in ALIS). Client now lists her as a caretaker — needs decision. |
| Alejandra Vallejo | a.vallejo (new) | Already in ALIS as caregiver; no AD account (known gap from 6/30). |
| Jeanpabtiste Munezero | j.munezero (new) | New hire; no AD or ALIS record found. |
| Nicole Cota | n.cota (new) | New hire. No conflict with disabled n.castro. |
| Katlyn Robinson | k.robinson (new) | New hire. |

New accounts follow the `f.lastname@cascadestucson.com` caregiver convention.
Full onboarding per 6/30 pattern: AD account in OU=Caregivers, SG-Caregivers add
(on-prem only — cloud adds fail), usageLocation=US + Business Premium, temp password
forced-change, vault, ALIS staff record Email=UPN.

## Flags from the client's annotations

- **Tele Sepopo Lassey Assiakoley = Cecilia/Celia Lassey (client-confirmed).**
  BOTH `c.lassey` and `t.lassey-assiakoley` exist enabled, licensed, and in
  SG-Caregivers — one person, two accounts, two licenses. Consolidate: pick one,
  disable the other, reclaim a seat. (Resolves the 6/4 worklist open question.)
- **Zeke Huerta (e.huerta) now works the front desk.** He is in SG-Caregivers →
  subject to the caregiver CA lockdown (on-network + allow-listed devices only,
  no MFA). Front desk may need the privileged bucket instead (email from anywhere,
  MFA offsite) and different ALIS roles. Decision needed. UPN stays e.huerta
  (Howard 6/30: do not "correct" to z.huerta).
- **Charity Sika = b.sika** — client list ties the name Charity to b.sika@,
  consistent with ALIS "Bariffa Sika" (staffId 309045). Treat as same person.

## License math (SPB, 45 seats, 45 consumed as of 6/30)

Disable 7 leavers + 1 Lassey dup = 8 seats freed; 4-5 new hires need seats
(Nyanzunda may already be licensed) → net 3-4 seats free after the update.

## Status (executed 2026-07-01, Howard's decisions via session prompts)

- [x] Disabled 7 departed accounts + removed from SG-Caregivers + reclaimed licenses (RMM cmd b5329b71)
- [x] Lassey duplicate: KEEP c.lassey; t.lassey-assiakoley disabled + license reclaimed
- [x] Huerta: removed from SG-Caregivers (front desk -> privileged bucket). Account stays
      enabled in OU=Caregivers — sync scope is ONLY OU=Caregivers/Groups/Caregiver Devices,
      so an OU move would delete his cloud object. Move deferred until Administrative OU
      enters sync scope. **He needs MFA (Authenticator) registration** — now under the
      MFA-for-all-users policy with no caregiver-block policies.
- [x] Nyanzunda: LEFT OUT of SG-Caregivers (frontline-only rule stands; she keeps her
      existing christine.nyanzunda account with broader access)
- [x] Created 4 new accounts (a.vallejo, j.munezero, n.cota, k.robinson): OU=Caregivers,
      SG-Caregivers, usageLocation=US, Business Premium, forced-change temp passwords.
      Vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`.
      Passwords DM'd to Howard (Discord msg 1521981205443117116).
- [x] Verified: 8 offboarded = accountEnabled=false + 0 licenses; 4 new = SPB licensed.
      SG-Caregivers = 35 members. SPB pool: 45 enabled / 41 consumed (4 free).
- [x] **Phone-login verification + CA cutover (2026-07-01, Howard's go):** all 35
      SG-Caregivers members verified enabled/unlocked in AD and enabled/licensed in
      Entra (cloud group synced, 4 new hires present). Root cause of would-be login
      failure found and fixed: (1) `Require MFA for all users` excluded only the stale
      pilot group — added `SG-Caregivers` (8b8d9222) to excludeGroups, break-glass
      preserved; (2) `CSC - Block caregivers on non-compliant device` DISABLED (phones
      are Intune-noncompliant; interim posture = caretakers on desktops + phones,
      on-network only). Allow-list policy left test-scoped. Phones-only lockdown
      deferred — tracking list: `docs/cloud/caretaker-phones-only-list.md`.
- [ ] ALIS: create staff records for Munezero/Cota/Robinson (need job roles:
      Certified vs Resident Caregiver); Vallejo exists — set Email=a.vallejo@ (UPN).
      Import .xls via `alis` skill `build-import`.
- [ ] Huerta MFA registration (Authenticator) — first time he's onsite.
- [ ] Optional: notify client that Nyanzunda already has an account (not added to
      caregiver group by design).
