azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-04-22 16:24:58

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-04-22 16:24:58
This commit is contained in:
Howard Enos
2026-04-22 16:24:58 -07:00
parent ce52a62ff1
commit 7bffbfbb89
8 changed files with 1275 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
clients/cascades-tucson/docs/cloud/user-account-rollout-plan.md
View File

@@ -119,14 +119,14 @@ These must be resolved before creating or converting accounts. See also `cascade
| Discrepancy | Status | Action |
|---|---|---|
| **Britney Thompson** — in AD (enabled, Memory Care Nurse), NOT on returned CSV | **Resolved 2026-04-22 (Howard) — still employed. Desktop + maybe Phone.** | Keep existing AD account. Treat as Office-PHI / clinical (D+P, ALIS=Y). Confirm phone tier and Outside posture with Meredith. |
| **Polett Pinazavala** — on 2026-04-18 caregiver roster, NOT on returned CSV | **Resolved 2026-04-22 (Howard) — still employed. Desktop + maybe Phone.** | Keep on caregiver roster. Include in Wave 3 caregiver account creation. Confirm phone tier with Meredith. |
| **Polett Pinazavala** — on 2026-04-18 caregiver roster, NOT on returned CSV | **Resolved 2026-04-22 (Howard) — still employed. Setup declared in email: MedTech — Memory Care (Tue–Sat), D+P, ALIS=Y, Outside=N.** | Keep on caregiver roster. Include in Wave 3 caregiver account creation unless Meredith/John push back on the declared setup. |
| **Christine Nyanzunda** — one person, MC Admin + part-time Sun/Mon MedTech | **Resolved 2026-04-22 (Howard) — one account covers both roles.** | Single account in `OU=Care-MemoryCare`. Default building-only CA policy. When she's covering a MedTech shift she logs into the shared MC phone with her own account. If that sign-in gets blocked by the shared-phone CA, add her to a specific exception group rather than splitting into two accounts. |
| **Alma R Montt** — on CSV (Life Enrichment), NOT in AD, title blank | **Username assigned 2026-04-22 (Howard): `Alma.Montt`.** Title still pending Meredith. | Create AD account at `Alma.Montt` (UPN `alma.montt@cascadestucson.com`). Populate title once Meredith answers. |
| **Kyla Quick Tiffany** — on CSV and in AD "needs account" list | **Username assigned 2026-04-22 (Howard, per Kyla's preference): `Kyla.QuickTiffany`** — last name treated as a single word. | Create AD account at `Kyla.QuickTiffany` (UPN `kyla.quicktiffany@cascadestucson.com`). Persona: Shared-PC Reception. |
| **Ederick Yuzon** — spelling not confirmed | Still pending Meredith. | Block on creation; use `Ederick.Yuzon` tentatively if Meredith confirms. |
| **Matt Brooks** — AD dept = Maintenance, CSV note "works in both departments" | Confirmed (CSV-inline). | Keep in Maintenance OU; add to secondary MC group for access overlap. |
| **37 caregivers** — on CSV, none in AD | Unchanged. | Create all 37 AD accounts (+ M365) in Wave 3. |
| **2 agency placeholders** — on CSV, not in AD | Unchanged. | Decide with Meredith: real accounts or ALIS-only? |
| **2 agency placeholders** — on CSV, not in AD | **Decision 2026-04-22 (Howard, asked Meredith for username preference):** shared agency-login accounts, not per-person. Proposed usernames `reliable1@` and `reliable2@` (fallback to `reliable.agency.caregiver1/2@` if Meredith prefers long form). | Create 2 shared AD/M365 accounts once username preference comes back. Shared accounts = caveat on audit attribution — whoever is on shift uses the shared login, so individual accountability in audit logs is weaker for agency staff. Acceptable tradeoff given we don't have agency-staff names. |
| **Generic AD accounts** (`Culinary`, `RECEPTIONIST`, `saleshare`, `directoryshare`) | Unchanged. | Phase 5 cleanup after named-account coverage. |
**Username convention for new accounts:** TitleCase `First.Last` (e.g., `Alma.Montt`, `Kyla.QuickTiffany`). Existing lowercase exceptions in AD (`britney.thompson`, `karen.rossini`, `lauren.hasselman`) are the known legacy cases — leave as-is, don't rename. All net-new accounts follow TitleCase.
@@ -134,15 +134,14 @@ These must be resolved before creating or converting accounts. See also `cascade
## 7. Rollout sequence
### Wave 0 — Pre-flight (blocks waves 1+)
- Get answers to the 5 follow-up questions (Kyla/Ederick/Christine/Alma/Britney) + the "restrict-everyone or selective" policy decision from Meredith
- Close Polett Pinazavala discrepancy
- Final license decision (Business Premium tenant-wide vs. mixed)
- Get answers to the 4 remaining email questions: Britney flags, Alma title, Ederick spelling, agency short-username preference
- Final license decision (Business Premium tenant-wide vs. mixed) — recommendation is Premium tenant-wide, needs Meredith sign-off
- Purchase license count locked in
### Wave 1 — New office accounts (low blast radius)
- Create AD + M365 for Alma R Montt and Kyla Quick Tiffany (the only new office/reception accounts the CSV produces)
- Create AD + M365 for Alma R Montt (`Alma.Montt`) and Kyla QuickTiffany (`Kyla.QuickTiffany`) — the only new office/reception accounts the CSV produces
- Validate group membership + CA policy assignment on these two before touching anyone else
- Pilot the `CSC - FrontDesk Building-Only` policy with Kyla
- Pilot the `CSC - Building Only (Default)` policy with Kyla
### Wave 2 — Existing office accounts, reassignment only
- Move existing users into new OU layout (no identity changes, just OU move + group membership)
@@ -155,7 +154,7 @@ These must be resolved before creating or converting accounts. See also `cascade
### Wave 4 — Cleanup
- Disable/remove `Culinary`, `RECEPTIONIST`, `saleshare`, `directoryshare` generics once their functions are covered by named accounts + shared mailboxes
- Disable departed accounts (Britney pending answer, Tamra on departure June 2026)
- Disable Tamra's account on her June 2026 departure (other known departures: none as of 2026-04-22)
- Rotate `krbtgt` password (noted stale in AD doc — overdue)
## 8. Account creation template (per new user)
@@ -182,20 +181,20 @@ Applies to Wave 1 + Wave 3 (and any future hire). Precise script will be built l
## 10. Open decisions blocking the rollout
1. **Business Premium tenant-wide vs. mixed SKUs** — Meredith, tied to the upgrade proposal. Building-only-by-default decision reinforces Premium tenant-wide (see §5).
2. **Ederick Yuzon spelling** — Meredith/John, in the 2026-04-22 follow-up email.
3. **Alma R Montt title** — Meredith/John, in the follow-up email.
4. **Britney phone + Outside posture** — Meredith (employment confirmed by Howard; access tier still TBD).
5. **Polett employment confirmation** — Meredith (Howard assumes still employed; formal Meredith confirmation requested in follow-up email).
6. **Agency placeholder accounts — names + ALIS-only vs. real accounts?** — John added two agency rows to the CSV but left Name and Notes blank. Need the actual agency names + whether they need AD/M365 identities or just ALIS web logins.
7. **Drivers: F3 or Business Standard?** — Meredith (cost vs. Office install need). Note: drivers need allow-list membership to sign in off-site, so whichever tier must include P1 for CA coverage (F3 does not; Business Premium or Business Standard + Entra P1 add-on required).
2. **Britney Thompson phone Y/N + Outside Y/N** — Meredith/John, asked in the 2026-04-22 email.
3. **Alma R Montt title** — Meredith/John, asked in the 2026-04-22 email (admin / manager / other in LE?).
4. **Ederick Yuzon spelling** — Meredith/John, asked in the 2026-04-22 email.
5. **Agency shared-login short username** — Meredith/John, asked in the 2026-04-22 email (proposed `reliable1` / `reliable2`).
6. **Drivers: F3 or Business Standard?** — Meredith (cost vs. Office install need). Drivers need allow-list membership to sign in off-site, so whichever tier must include P1 for CA coverage (F3 does not; Business Premium or Business Standard + Entra P1 add-on required).
**Resolved 2026-04-22 (Howard):**
- Restrict-everyone default vs. selective → **building-only by default, allow-list for exceptions** (§5).
- Christine Nyanzunda → one account covers both roles.
- Kyla Quick Tiffany username → `Kyla.QuickTiffany` (her preference — sign-in confirmed by Howard).
- Kyla Quick Tiffany username → `Kyla.QuickTiffany` (her preference — confirmed by Howard).
- Alma R Montt username → `Alma.Montt`.
- Britney Thompson → still employed; stays in AD.
- Polett Pinazavala → still employed (awaiting Meredith formal confirmation via email).
- Britney Thompson → still employed; stays in AD. Access-posture flags still open.
- Polett Pinazavala → still employed. Declared setup (D+P, ALIS=Y, Outside=N, MedTech Memory Care Tue–Sat) announced in 2026-04-22 email; will proceed unless Meredith/John push back.
- Agency placeholders → shared-login accounts (not per-person). Username short-form proposed but preference still open.
## 11. Related docs