sync: auto-sync from HOWARD-HOME at 2026-07-22 09:14:19

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-22 09:14:19

wiki/clients/cascades-tucson.md

@@ -100,7 +100,7 @@ Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710
 - **Shared mailbox conversions (2026-07-17):** 10 functional/role-based accounts converted to shared mailboxes (accounting@, accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@, fax@). Freed 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses. frontdesk@ and memcarereceptionist@ left as licensed user mailboxes (active daily sign-ins).
 - **On-prem AD domain:** cascades.local | UPN suffix: cascadestucson.com
 - **MX / mail flow:** Exchange Online (EOP direct MX). SPF: `-all`. DKIM: both M365 selectors published. DMARC: `p=quarantine; pct=100` (verified live 2026-07-15). Reports to `info@cascadestucson.com` (unmonitored). No third-party gateway.
-- **MFA:** CA policy "Require MFA for all users" (`7e87a1c7`) enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth + device restriction). Voice-call MFA disabled tenant-wide; exception: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`, single member `sysadmin@`).
+- **MFA:** CA policy "Require MFA for all users" (`7e87a1c7`) enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth + device restriction). Voice-call MFA disabled tenant-wide; exception: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`, single member `sysadmin@`). **[ACTION REQUIRED by Sep 1, 2026]** Microsoft retires native SMS/voice MFA — passkeys auto-enabled Sep 1; SMS/voice fully retired Feb 1, 2027 (blocking, no opt-out). Run usage analyzer, retire the voice-call exception for sysadmin@, migrate any SMS-only users to Authenticator/passkey. See REMAINING-WORK-PLAN.md WS4.
 - **Entra Connect:** Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. `OU=Administrative` not yet in scope. **Cloud/Graph group adds to `SG-Caregivers` fail (HTTP 400) — all membership writes on CS-SERVER via RMM.**
 - **Break-glass accounts:** `breakglass1-csc@cascadestucson.com`, `breakglass2-csc@cascadestucson.com`. **Not yet created as of 2026-07-17.** Must exist + FIDO2 keys enrolled before the final CA allow-list flip (WS3). This is the top prerequisite blocking the caregiver lockdown go-live.
 - **Admin accounts:**
@@ -403,6 +403,7 @@ Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-creat
 - **[SECURITY] Remove standing PAA role from Tenant Admin SP.** Needs Global Admin. Pending Mike.
 - **[SECURITY] Rotate exposed Synology Cloud Signin Portal credential** (vault commit 1fbc0e1).
 - **[PENDING] Zeke Huerta MFA (Authenticator) registration.** No registered method since front-desk move (2026-07-01).
+- **[ACTION — before Sep 1, 2026] Entra SMS/voice MFA retirement prep.** Run usage analyzer script; retire `SG-MFA-Voice-Call-Scoped-sysadmin` + voice-call method for sysadmin@; migrate any SMS-only users to Authenticator/passkey. Feb 1, 2027 hard cutoff (blocking, no opt-out). Detail: REMAINING-WORK-PLAN.md WS4.
 - **[PENDING] ASSISTNURSE-PC nurse station kiosk config** (OU move + printers + gpupdate).
 - **[PENDING] NURSESTATION-PC PRT/SSO verification** (confirm AzureAdPrt: YES + ALIS SSO silent after reboot).
 - **[PENDING] MEMCARE-STATION rename not applied** (pending reboot on MemCare RECEPTIONIST-PC box, S/N MJ0KQH4R).