# User Account Rollout Plan — Cascades of Tucson

**Status:** Planning — no account creation or license assignment yet.
**Created:** 2026-04-22 (Howard)
**Inputs:**
- `reports/cascades-staff-2026-04-22.csv` — returned staff-editor questionnaire, 70 rows (source of truth for *who should exist* and *what access posture*)
- `docs/servers/active-directory.md` — current AD state (42 accounts, 40 enabled)
- `docs/cloud/caregiver-m365-p2-rollout.md` — caregiver identity/phone plan (39 caregivers)
- `docs/cloud/p2-staff-candidates.md` — P2 license sizing for the office-staff side
- `docs/cloud/m365.md` — current M365 tenant state

## 1. Scope

Build every person on the 2026-04-22 CSV into a consistent AD + M365 identity, licensed and policy-covered according to the **Access / Outside Access / ALIS** posture columns they returned. This plan covers the identity layer only — device/MDM work is already tracked in `caregiver-m365-p2-rollout.md` and the Intune rollout, and folder redirection continues under the existing GPO workstream.

**Explicitly out of scope here:**
- Device enrollment (Intune flow already designed)
- Folder redirection GPO edits (separate workstream, already validated on DLTAGOI)
- M365 tenant licensing *purchase* decision (decision gated — see §10)

## 2. Personas (derived from CSV access matrix)

| Persona | Access | Outside | ALIS | Count | Examples |
|---|---|---|---|---|---|
| **Office-PHI (external-OK)** | D+P | Y | Y | 18 | Meredith, Megan, Lois, Susan, Alma, JD, John Trozzi, Lupe |
| **Office-PHI (in-building)** | D+P | N | Y | 2 | Allison Reibschied, Sharon Edwards |
| **Office non-PHI (in-building)** | D+P | N | N | 1 | Ramon Castaneda |
| **Maintenance (in-building PHI)** | D+P | N | Y | 1 | Matt Brooks |
| **Courtesy Patrol** | D+P | N | N | 3 | Sebastian Leon, Sheldon Gardfrey, Ray Rai |
| **Shared-PC Reception** | D | N | N | 4 | Cathy, Shontiel, Kyla, Michelle |
| **Caregiver (shared-phone)** | D+P | N | Y | 37 | See caregiver-m365-p2-rollout.md |
| **Agency caregivers (per-person)** | D+P | N | Y | 0 | None created. HIPAA-mandated per-person IDs — Reliable must supply names. No shared logins. |
| **Driver (no IT access)** | — | — | — | 3 | Richard Adams, Julian Crim, Christopher Holick — on roster for tracking, existing AD accounts to be disabled |
| **Departed (disable/remove)** | — | — | — | 2 | Britney Thompson (has AD+M365, must be disabled), Polett Pinazavala (no account, just remove from roster) |

(Identities to create or keep active: **66**. Roster-only-no-account: 3 drivers. Departures: Britney + Polett. No agency accounts created — per-person names required. Christine Nyanzunda sits in one persona — Office-PHI — with her caregiver-shift sign-in handled via exception group if needed.)

## 3. License mapping per persona

**Guiding principles:**
1. Default to **Business Premium** tenant-wide (already the recommendation in `p2-staff-candidates.md` — bundles Intune + P2 + Defender + DLP).
2. Use **F3** only for phone-only users (drivers) where Premium is overkill and F3 covers Exchange/Teams needs.
3. Reception shared PCs get shared *mailboxes* for `Frontdesk@`, but each named receptionist gets her own licensed account so audits attribute individual actions.

| Persona | License | Notes |
|---|---|---|
| Office-PHI (external-OK) | **Business Premium** | CA: compliant device OR trusted location |
| Office-PHI (in-building) | **Business Premium** | CA: trusted location only |
| Office non-PHI (in-building) | Business Standard (or Premium if tenant-wide) | CA: trusted location only |
| Maintenance PHI (Matt Brooks) | **Business Premium** | MC-adjacent role, ALIS=Y |
| Courtesy Patrol | Business Standard | Could be F3 if they don't need full desktop Office; confirm with Meredith |
| Shared-PC Reception | Business Standard | Frontdesk@ stays as shared mailbox, named accounts read it |
| Caregiver | **Business Premium** | Per `caregiver-m365-p2-rollout.md` — P2 is load-bearing for shared-phone CA |
| Agency caregivers (per-person) | **Business Premium** each | Only provisioned when Reliable Agency provides individual names. Zero created as of 2026-04-22. |
| Driver | **None** | No IT access — accounts disabled. License previously used (if any) harvested. |
| Britney Thompson (departing) | **None** (harvest) | Disable account, free Business Standard + Exchange Online Essentials |

Expected license count at full rollout:
- Business Premium: 18 (office PHI ext) + 2 (office PHI int) + 1 (Matt) + 37 caregivers = **58**
- Business Standard: 1 (Ramon) + 3 courtesy + 4 reception = **8**
- F3: 0 (drivers no longer need accounts)
- Per-person agency: +1 each if/when Reliable Agency provides names

**Post-2026-04-22 update:** With the building-only-by-default CA decision confirmed, every licensed user needs Entra P1 coverage (either via Business Premium, or Business Standard + standalone Entra P1). Without P1, CA policies don't apply and the user sidesteps the default-deny. This effectively collapses the mixed-SKU table above into a recommendation for **Business Premium tenant-wide (~68 seats)** — the Business Standard rows stay in the table only as a reference for what we'd buy if budget forces unbundling. Proceed with Premium-tenant-wide unless Meredith pushes back. Britney's harvested Business Standard + Exchange Online Essentials license plus any freed driver licenses go back into the pool to offset the Premium purchase.

## 4. AD OU + group layout (proposed)

Current `cascades.local` OU layout is loose (see `docs/servers/active-directory.md`). Proposed structure to align with the persona matrix and folder-redirection GPOs already in place:

```
OU=Cascades Users
├── OU=Administrative
├── OU=Marketing                (new name for existing Marketing dept)
├── OU=Care-AssistedLiving
├── OU=Care-MemoryCare
├── OU=ResidentServices
│   ├── OU=FrontDesk            (reception shared-PC users)
│   └── OU=CourtesyPatrol
├── OU=LifeEnrichment
├── OU=Culinary
├── OU=Maintenance
├── OU=Housekeeping
├── OU=Transportation           (drivers)
└── OU=Caregivers               (all 37 shift staff)
```

**Security groups (AD-synced, Entra-usable):**
- `SG-Office-PHI-External` — 19 people, drives CA policy + Premium license group
- `SG-Office-PHI-Internal` — 2 people (Allison, Sharon)
- `SG-CourtesyPatrol` — 3
- `SG-FrontDesk` — 4
- `SG-Drivers` — 3
- `SG-Caregivers` — 37 (already exists or needs creating — check against current `Cascades - Shared Phones` Entra group, which may already cover this)

CA policies target groups, not OUs. OUs drive GPO inheritance (folder redirection, local policy) only.

**File-share access groups (created 2026-04-22 by `g1-ad-hygiene.ps1`, memberships populated in Phase 4 per `phase2-file-shares.ps1`):**

| Persona | `SG-Receptionist-RW`<br/>(`\\CS-SERVER\Receptionist`) | `SG-Directory-RW`<br/>(`\\CS-SERVER\directoryshare`) | Other shares | Notes |
|---|---|---|---|---|
| **Shared-PC Reception** (Cathy, Shontiel, Kyla, Michelle) | **Y** | **Y** | — | Reception-desk workflows need the `Receptionist` share (printed directories, sign-in sheets, fax-in scans) **and** the Resident `directoryshare` (resident contact lists). Everything else these users do is in M365 (Frontdesk@ shared mailbox, Teams, SharePoint). No other on-prem share access required. |
| **Courtesy Patrol** (Sebastian, Sheldon, Ray) | **Y** | **Y** | — | Same reception-coverage scope — they back up the front desk after hours. |
| Office-PHI (external-OK) | per-role | Y | per-role (Mgmt, Sales, etc.) | directoryshare is resident-contact data; all office-PHI staff need read at minimum. RW memberships granted per department (e.g., Meredith → SG-Management-RW, Megan → SG-Sales-RW). |
| Office-PHI (in-building) | N | Y | per-role | |
| Maintenance PHI (Matt Brooks) | N | Y | — | directoryshare read access for room-assignment lookups. |
| Caregiver / Agency | N | Y | — | Caregivers need resident contact info — directoryshare is the single canonical source. |
| Drivers | N | N | — | Drivers lose all IT access per 2026-04-22 decision. |

**Operational note — Workgroup (non-domain-joined) reception PCs:** RECEPTIONIST-PC and MEMRECEPT-PC are both WORKGROUP machines. Until they're domain-joined (Phase 3), users must enter `cascades\<username>` explicitly when Windows prompts for the share credential, then tick "Remember my credentials" so File Explorer doesn't silently fall back to the local machine user on next reboot. After Entra Connect + domain join, SSO removes this step.

## 5. Conditional Access policy set

**Decision 2026-04-22 (Howard → Meredith/John):** Default-deny external sign-in for all licensed users. Maintain a small allow-list group for users who legitimately work off-site.

This collapses the earlier per-persona policy matrix into two primary CA policies plus the existing caregiver shared-phone policy:

| Policy | Targets | Grant |
|---|---|---|
| `CSC - Building Only (Default)` | All licensed users **except** `SG-External-Signin-Allowed` and `SG-Caregivers` | Block sign-in unless from the "Cascades Building" named location + MFA |
| `CSC - External Sign-in Allowed` | `SG-External-Signin-Allowed` | Require compliant Intune-enrolled device + MFA for external sign-in; trusted-location sign-in waives the compliance grant |
| `CSC - Caregivers Shared Phone` | `SG-Caregivers` | Already designed per `caregiver-m365-p2-rollout.md` (shared-phone Intune + named location) |
| `CSC - Drivers Phone-Only` | `SG-Drivers` | Require compliant Intune-managed phone; no web fallback. Drivers added to `SG-External-Signin-Allowed` as well if they need off-site phone access. |

**Initial `SG-External-Signin-Allowed` membership** — seed from the CSV's Outside=Y column, post-2026-04-22 updates. All 18 office-PHI staff (including Alma R Montt). Everyone else stays on the default building-only policy until Meredith adds them. Britney is no longer on this list — she departed 2026-04-22.

**Named location "Cascades Building":** Define once, reuse. Use the site's public IP range(s) from pfSense NAT (`clients/cascades-tucson/pfsense-firewall.sops.yaml`).

**Exception-management process:** Adding a user to `SG-External-Signin-Allowed` is a named-access request that should be logged (ideally in the client's Syncro ticketing or a simple note in the client folder). Removal is equally important — e.g., Tamra Matthews comes off the list on her June 2026 departure in addition to her license being deactivated.

**Impact on licensing:** All users covered by either CA policy need at least Entra P1 (bundled with Business Premium). This reinforces the default recommendation of Business Premium tenant-wide — Business Standard users couldn't be covered by the CA default-deny without an add-on, and a mixed tenant is harder to reason about.

## 6. Pre-flight reconciliation (CSV vs current AD)

These must be resolved before creating or converting accounts. See also `cascades-staff-followup-2026-04-22.md`.

| Discrepancy | Status | Action |
|---|---|---|
| **Britney Thompson** — in AD (enabled, Memory Care Nurse) | **RESOLVED 2026-04-22 (John's reply) — DEPARTED.** | Disable AD account `britney.thompson`. Convert mailbox to shared (or archive + delete). Remove Business Standard + Exchange Online Essentials license (harvested). Remove from any security groups. |
| **Polett Pinazavala** — was on 2026-04-18 caregiver roster | **RESOLVED 2026-04-22 (John's reply) — DEPARTED.** | Remove from roster. No existing account — no AD/M365 action needed. |
| **Drivers (Richard Adams, Julian Crim, Christopher Holick)** — all have AD accounts + Transportation@ shared mailbox | **Decision 2026-04-22 (Howard) — drivers no longer get IT access.** | Disable the 3 AD accounts. Keep them on the working roster for employee tracking. Separate decision: keep or retire `Transportation@` shared mailbox — ask Meredith. |
| **Christine Nyanzunda** — one person, MC Admin + part-time Sun/Mon MedTech | **Resolved 2026-04-22 (Howard) — one account covers both roles.** | Single account in `OU=Care-MemoryCare`. Default building-only CA policy. When she's covering a MedTech shift she logs into the shared MC phone with her own account. If that sign-in gets blocked by the shared-phone CA, add her to a specific exception group rather than splitting into two accounts. |
| **Alma R Montt** — on CSV (Life Enrichment), NOT in AD | **RESOLVED 2026-04-22 (John's reply).** Username `Alma.Montt`, title "Memory Care Life Enrichment", D+P, ALIS=Y, Outside=Y. LE staff assigned to Memory Care residents — stays in `OU=Life Enrichment`. | Create AD account `Alma.Montt` (UPN `alma.montt@cascadestucson.com`). Add to SG-External-Signin-Allowed (Outside=Y). |
| **Kyla QuickTiffany** — on CSV and in AD "needs account" list | **Resolved 2026-04-22 (Howard, per Kyla's preference): `Kyla.QuickTiffany`** — last name treated as a single word. | Create AD account `Kyla.QuickTiffany` (UPN `kyla.quicktiffany@cascadestucson.com`). Persona: Shared-PC Reception. Building-only, no outside sign-in. |
| **Ederick Yuzon** — spelling not confirmed | **Still pending Meredith/John.** | Block on creation of his caregiver account only. Everyone else proceeds. Tentative: `Ederick.Yuzon` if needed to unblock Wave 3. |
| **Matt Brooks** — AD dept = Maintenance, CSV note "works in both departments" | Confirmed (CSV-inline). | Keep in Maintenance OU; add to secondary MC group for access overlap. |
| **37 caregivers** — on CSV, none in AD | Unchanged. | Create all 37 AD accounts (+ M365) in Wave 3. |
| **2 agency placeholders** — on CSV, not in AD | **RESOLVED 2026-04-22 (Howard, post-HIPAA-review) — NO shared logins. Per-person accounts only.** | Do NOT create `reliable1`/`reliable2`. Reliable Agency must supply individual names before any caregiver can access PHI. Until then, agency staff work under direct supervision of a Cascades-employed caregiver who is signed in. Rationale documented in `docs/security/hipaa-review-2026-04-22.md`. |
| **Generic AD accounts** (`Culinary`, `RECEPTIONIST`, `saleshare`, `directoryshare`) | Unchanged. | Phase 5 cleanup after named-account coverage. |

**Username convention for new accounts:** TitleCase `First.Last` (e.g., `Alma.Montt`, `Kyla.QuickTiffany`). Existing lowercase exceptions in AD (`britney.thompson`, `karen.rossini`, `lauren.hasselman`) are the known legacy cases — leave as-is, don't rename. All net-new accounts follow TitleCase.

## 7. Rollout sequence

### Wave 0 — HIPAA pre-flight (must complete before any account changes)

Per `docs/security/hipaa-review-2026-04-22.md`. These are compliance blockers, not operational blockers — fix before touching accounts.

- **Sign Microsoft HIPAA BAA** (5 min, free) — M365 Admin Center → Settings → Org Settings → Security & Privacy → HIPAA BAA
- **Verify/sign ALIS BAA** (Meredith-ask)
- **Create break-glass cloud-only admin** (`breakglass@cascadestucson.com`): excluded from all CA, FIDO2 security key, vaulted password, sign-in alerts to Howard + Meredith
- **Enable SMB3 encryption** on `\\CS-SERVER\homes`: `Set-SmbShare -Name homes -EncryptData $true`
- **Extend M365 audit retention** to 6+ years (Purview Audit Premium add-on or retention policy)
- **Put Britney's mailbox on Litigation Hold** with verified archive license — BEFORE her account is disabled
- **Ask Meredith** for the Reliable Agency staffing contract (confirm direct-control language = workforce, not BA)
- **Draft Risk Analysis** `docs/security/risk-analysis-2026-04.md` following NIST 800-66 Rev 2 §3
- **Create Security Rule Implementation Register** `docs/security/implementation-register.md`

### Wave 0.5 — Entra Connect / AD-M365 identity tie-in (before any account creation in Wave 1)

Without Entra Connect, new accounts are cloud-only and create the same AD-vs-M365 drift the tenant already suffers from.

**Staged enablement — each gate must pass before advancing to the next:**

| Gate | What happens | User-visible impact | Pass criteria before advancing |
|---|---|---|---|
| **G1. AD prereq hygiene** | Renames, UPN suffix add, `proxyAddresses` populate, null-password account cleanup, former-employee deletes | None | `Get-ADUser` report shows 0 UPN mismatches vs. the M365 mailbox list; 0 enabled accounts with null `PasswordLastSet` |
| **G2. Role-account → shared mailbox conversions in M365** | Convert `accounting@`, `frontdesk@`, `hr@`, `transportation@`, etc. to shared mailboxes per `docs/cloud/m365.md` | Licensed-user count drops, frees ~11 seats | Every role-based UPN shows as shared mailbox in Exchange Admin; members are assigned |
| **G3. Connect install in STAGING MODE** | Sync engine runs, reads AD, produces preview report. **No writes to Entra.** | None | Preview shows ≥95% clean soft-matches against existing M365 users; zero unintended duplicate-creates |
| **G4. Take out of staging, directory sync ONLY (no Password Hash Sync)** | Hybrid identity appears in Entra. Passwords remain separate between AD and M365. | None — users sign in exactly as today | 48 hours stable with no new support tickets about sign-in |
| **G5. Announce + enable Password Hash Sync** | AD password hash pushes to Entra. Next Outlook / Teams / Edge launch, prompts once for password. Users enter AD password. | **ONE password prompt, once.** After that: one password for everything. | Zero unresolved helpdesk tickets; test user confirms PC + Outlook + OWA work on same password |
| **G6. Conditional Access policies go live in REPORT-ONLY mode** | CA evaluates every sign-in and records what WOULD have been blocked, but doesn't actually block. | None | 7–14 days of logs reviewed — zero "would have been blocked" events for legitimate users. Fix trusted-location / compliance gaps as needed. |
| **G7. CA enforcement flip** | Policy blocks out-of-scope sign-ins for real. | Off-site users unexpectedly on the allow-list see no change; users NOT on allow-list get blocked from outside the building as intended. | Break-glass account confirmed working. Meredith notified. **User comms sent 48h before flip** — see G7a below. |
| **G7a. Pre-enforcement user comms (MUST run before G7)** | Query Entra sign-in logs for any licensed user with >0 off-site sign-ins in last 30 days. Anyone NOT in `SG-External-Signin-Allowed` gets a targeted email: "Starting [date] you will only be able to sign into Cascades email and apps from inside the building. If you work from home / travel / check email on your phone off-site, reply to Meredith by [date-1] to be added to the allow-list." | Users who legitimately work off-site get warned; those who don't get confirmation that silent behavior change is coming. | Report from Entra sign-in logs shows comms sent to every off-site-active user. No silent blocks at G7 cutover. |
| **G8 (separate project). ALIS SSO Enterprise App registration** | "Sign in with Microsoft" option appears on ALIS login. Existing ALIS username/password keeps working during transition. | Optional new sign-in button. | N/A — rollout when ALIS support has provided federation metadata. |

**Rollback points:** G3 through G5 all have clean reverse paths (remove from staging, disable PHS, reset individual passwords). G6/G7 CA policies can be disabled with one click. Only hard-to-reverse step is G1's AD renames — mitigated by the pre-change reg-exports/backups already in the `D:\Backups\pre-entra-connect-*` folder from the 2026-04-22 preflight remediation.

**Original install-order prerequisites (covered by G1):**

1. **AD prereq cleanup** (no user impact — all reversible):
   - Rename `Tamra.Johnson` → `Tamra.Matthews`
   - Rename `strozzi` → `Shelby.Trozzi`
   - Rename `Alyssa.Shestko` → `Alyssa.Brooks` + delete lowercase duplicate `alyssa.brooks`
   - Fix `Christopher.Holik` → `Christopher.Holick`
   - Fix `Matt.Brooks` UPN to `matthew.brooks@` OR update M365 side to `matt.brooks@`
   - Delete confirmed former employees (Anna.Pitzlin, Nela.Durut-Azizi, Jodi.Ramstack, Monica.Ramirez)
   - Disable + remove legacy accounts (Haris.Durut, Nuria.Diaz, Cathy.Reece, Kelly.Wallace, Isabella.Islas, ann.dery)
2. **Add UPN suffix** `cascadestucson.com` in AD Domains and Trusts
3. **Update all synced users' UPN** to `firstname.lastname@cascadestucson.com`
4. **Convert M365 role-based accounts to shared mailboxes** FIRST (accounting@, frontdesk@, hr@, etc. — listed in `docs/cloud/m365.md`) — frees 11 licenses
5. **Delete** `Kristiana Dowse` and `howaed` typo accounts from M365
6. **Reconcile** `nick pavloff` (M365-only) — create AD account if still employed, or delete
7. **CS-SERVER readiness check** (separate task — OS version, .NET, disk, FSMO, conflict with QuickBooks DB listener)
8. **Install Entra Connect in staging mode** on CS-SERVER → Password Hash Sync → Seamless SSO → scope to `OU=Departments`
9. **Review planned sync output** for unexpected matches/duplicates
10. **Take out of staging**, verify users see their cloud mailboxes working on the same password
11. **Communicate to users:** Outlook will prompt once for password; enter your Windows password

User-visible impact: one Outlook password prompt on day-of-cutover. **No impact on AD domain logon.**

### Wave 1 — Departures + new office accounts (ready after Waves 0 and 0.5)
- Disable `britney.thompson` AD account — AFTER Litigation Hold is confirmed, mailbox converted to shared with designated custodian (likely Meredith or Lois), Business Standard + Exchange Online Essentials license harvested
- Disable 3 driver AD accounts (`Richard.Adams`, `Julian.Crim`, `Christopher.Holick`)
- Ask Meredith whether to keep or retire `Transportation@` shared mailbox
- Create AD accounts (and let Entra Connect sync to M365) for:
  - Alma R Montt (`Alma.Montt` — Memory Care Life Enrichment, D+P, ALIS=Y, Outside=Y)
  - Kyla QuickTiffany (`Kyla.QuickTiffany` — Shared-PC Reception, D only, building-only)
- Validate group membership + CA policy assignment on the new accounts before moving to Wave 2
- Pilot the `CSC - Building Only (Default)` policy with Kyla (Report-only mode first)

### Wave 1 — DO NOT DO
- Do NOT create `reliable1@` or `reliable2@` shared agency accounts (HIPAA review 2026-04-22). See §6 reconciliation + `docs/security/hipaa-review-2026-04-22.md`.

### Wave 2 — Existing office accounts, reassignment only
- Move existing users into new OU layout (no identity changes, just OU move + group membership)
- Attach each to the correct `SG-*` group based on CSV persona
- CA policies begin applying; watch for sign-in failures

### Wave 3 — Caregiver bulk creation
- Execute `caregiver-m365-p2-rollout.md` rollout — 37 AD + M365 accounts, SG-Caregivers, shared-phone CA
- Already designed; this plan just sequences it after office wave

### Wave 4 — Cleanup
- Disable/remove `Culinary`, `RECEPTIONIST`, `saleshare`, `directoryshare` generics once their functions are covered by named accounts + shared mailboxes
- Disable Tamra's account on her June 2026 departure (other known departures: none as of 2026-04-22)
- Rotate `krbtgt` password (noted stale in AD doc — overdue)

## 8. Account creation template (per new user)

Applies to Wave 1 + Wave 3 (and any future hire). Precise script will be built later; plan-level checklist:

1. AD account: `First.Last` (consistent with existing convention; note lowercase exceptions for Britney, Karen, Lauren — new accounts use TitleCase)
2. UPN: `first.last@cascadestucson.com`
3. Password: auto-generated, stored in vault (`clients/cascades-tucson/new-user-<name>.sops.yaml`), delivered to Meredith via 1Password share
4. OU placement per persona
5. Group membership: department-appropriate `SG-*`
6. M365 license assignment (group-based if feasible)
7. Mailbox creation (Exchange Online)
8. ALIS account provisioning (separate system — Meredith/Lois handle)
9. MFA registration — push to user first login
10. Confirmation email to Meredith with username + password-share link

## 9. Dependencies on other workstreams

- **Folder redirection GPO rollout** (`CONTEXT.md` §48) — when we move users to new OUs, make sure the FR GPOs are re-linked to the new OU or stay linked to parent `OU=Cascades Users`. Test on one mover before batch.
- **Intune phone rollout** (`PROJECT_STATE.md`) — caregiver accounts must exist before Wave 3 of phone deployment (24 remaining Samsung A15s). Identity-first, device-second.
- **Business Premium purchase proposal** (`docs/proposals/m365-premium-upgrade.md`) — blocks wave 1 if Meredith hasn't approved license spend.
- **File-share migration: Synology → CS-SERVER** (`docs/migration/phase2-server-prep.md` §4c–4d + `docs/migration/phase4-synology.md`) — Synology Drive Client is live-syncing `\\cascadesds\*` → `D:\Shares\Main` on CS-SERVER (confirmed 2026-03-07). Before users are cut over to CS-SERVER-sourced mapped drives, the AD security groups used for NTFS ACLs on CS-SERVER (`SG-Management-RW`, `SG-Sales-RW`, `SG-Culinary-RW`, `SG-Directory-RW`, `SG-IT-RW`, `SG-Receptionist-RW`, `SG-Chat-RW`, `SG-Server-RW`) must:
  1. Exist in AD (created by `scripts/phase2-ad-setup.ps1`)
  2. Have membership that matches the current per-user access on Synology — a **permission-inventory** step (see below) must produce this mapping before `scripts/phase2-file-shares.ps1` runs
  3. Populate from the user rollout waves — the 22 office-PHI users, 4 receptionists, 3 courtesy patrol, 1 Matt Brooks (dual-dept), 1 Ramon Castaneda, plus caregivers as needed all land in the right `SG-*` groups at account creation
  - Additional HIPAA additions to the phase2 script (per `docs/security/hipaa-review-2026-04-22.md`): enable SMB3 encryption (`Set-SmbShare -EncryptData $true` on every share) and enable Object Access auditing for §164.312(b) Audit Controls
  - Drivers off the SG-* lists entirely — they lose file-share access along with their AD accounts

### Permission-inventory prerequisite

A one-time non-destructive read of the live Synology is needed to produce the mapping from Synology local users/groups → AD security groups. Commands (run via SSH to `admin@192.168.0.120`, creds at `clients/cascades-tucson/synology-cascadesds.sops.yaml`):

```bash
sudo synogroup --list                              # Synology local groups
sudo synouser --list                               # Synology local users
sudo cat /etc/synoinfo.conf | grep -i share        # share definitions
for share in homes Management SalesDept Server chat Public Culinary IT Receptionist directoryshare; do
    sudo synoacltool -get /volume1/$share           # ACLs per share
done
sudo synoshare --get homes                         # per-share config incl. SMB encryption state
```

Output goes to `docs/migration/synology-permission-inventory.md`, which is then the reference for populating AD groups and building `phase2-file-shares.ps1` inputs. Discovery is non-destructive and can run any time the Synology is up — does not require a maintenance window.

## 10. Open decisions blocking the rollout

1. **Business Premium tenant-wide vs. mixed SKUs** — Meredith, tied to the upgrade proposal. Building-only-by-default decision reinforces Premium tenant-wide (see §5). **Only remaining BIG decision.**
2. **Ederick Yuzon spelling** — Meredith/John, asked in the 2026-04-22 email and not yet answered. Only blocks Ederick's own account creation, not the rest of Wave 3.
3. **Transportation@ shared mailbox** — keep for dispatch/scheduling emails or retire once driver AD accounts are disabled?

**Resolved 2026-04-22:**
- Restrict-everyone default vs. selective → **building-only by default, allow-list for exceptions** (§5).
- Christine Nyanzunda → one account covers both roles.
- Kyla → `Kyla.QuickTiffany` (her preference).
- Alma R Montt → `Alma.Montt`, title "Memory Care Life Enrichment", D+P, ALIS=Y, Outside=Y (answered by John).
- Britney Thompson → **departed (John)**. Disable AD + harvest license.
- Polett Pinazavala → **departed (John)**. Remove from roster.
- Agency shared logins → **NOT CREATED** (HIPAA review supersedes John's confirmation — §164.312(a)(2)(i) prohibits shared PHI-access log-ons). Per-person accounts only when Reliable Agency provides names.
- Drivers → no IT access per Howard. Disable 3 AD accounts. Stay on roster for tracking.

## 11. Related docs

- `reports/cascades-staff-2026-04-22.csv`
- `docs/cloud/cascades-staff-followup-2026-04-22.md`
- `docs/cloud/p2-staff-candidates.md`
- `docs/cloud/caregiver-m365-p2-rollout.md`
- `docs/cloud/m365.md`
- `docs/servers/active-directory.md`
- `docs/proposals/m365-premium-upgrade.md`
- `docs/security/hipaa.md`
