sync: auto-sync from HOWARD-HOME at 2026-07-22 09:14:19

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-22 09:14:19

clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md

@@ -222,6 +222,24 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
   2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
 - Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
 - Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).
+- **[NEW 2026-07-22] Entra SMS/voice MFA retirement prep** — Microsoft retires native SMS/voice
+  MFA delivery ([announcement](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement)).
+  Timeline: **Sep 1, 2026** passkeys auto-enabled + registration nudge for SMS/voice users;
+  **Feb 1, 2027** Microsoft-provided SMS/voice fully retired (blocking passkey prompt, no opt-out,
+  all tenants enforced). Action items:
+  - **Before Sep 1:** Run Microsoft's [SMS/voice usage analyzer script](https://github.com/microsoft/entra-sms-voice-usage-analyzer)
+    against the Cascades tenant to identify every user still registered for SMS or voice MFA.
+  - **Retire `SG-MFA-Voice-Call-Scoped-sysadmin`** (`304f941e`) and remove voice-call as a method
+    for `sysadmin@cascadestucson.com` — switch to Authenticator or passkey before Sep 1.
+  - **Migrate any admin/director/nurse users still on SMS-only MFA** to Authenticator or passkey.
+  - **Decision: third-party telecom provider needed?** Probably not for a 45-seat tenant where all
+    staff can move to Authenticator — but evaluate after the usage scan. If needed, Security Store
+    providers available Oct 30, 2026.
+  - **Communicate to Ashley Jensen** that admin/director users will see passkey registration prompts
+    at MFA sign-in starting Sep 1.
+  - HIPAA note: passkeys are phishing-resistant (NIST AAL3-capable) — this forced migration
+    strengthens the 164.312(d) person/entity authentication posture. Break-glass accounts already
+    planned with FIDO2/YubiKeys (passkey-compatible, no design change needed).
 
 ---