azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-06-04 21:22:05

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-04 21:22:05
This commit is contained in:
Howard Enos
2026-06-04 21:22:13 -07:00
parent 4ab272faab
commit a87cb66b32
3 changed files with 136 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
clients/cascades-tucson/session-logs/2026-06-04-howard-caregiver-laptop-enrollment.md
View File

@@ -74,3 +74,45 @@ curl -s -X POST ... -d '{"addLicenses":[{"skuId":"'$SPB'"}],"removeLicenses":[]}
- Prior context: `clients/cascades-tucson/session-logs/2026-06-03-session.md` (admin consent + allow-list policy + join-model decisions).
- Allow-list policy id `1b7fd025-1aad-47c8-9274-c32c3e0b163c`; ALIS admin-consent grant id `reTK4etbykSC1ENMm9g1rTplOyzgVClCofKDVRrn-ds`.
- Tickets: #110680053 (domain migration), #109412123 (Entra setup).
## Update: 21:20 MST — device tagging, roster classifications, ALIS worklist, app shortcuts
Continued the caregiver device rollout and finalized the restricted vs privileged user split for go-live (caregivers using phones start of next week).
### Devices
- 3 of 5 laptops Entra-joined (workgroup -> AzureAd) and tagged `extensionAttribute1=CSCCaregiverDevice`: **Laptop2** (`3ade4bd4-527f-468a-b06b-b1fa304941c8`), **LAPTOP-DRQ5L558** (`eb5f6b98-0077-4c35-b029-ee6f9ada0eef`), **LAPTOP-E0STJJE8** (`4b5ee995-964c-4efc-8960-f1a2a7d6257d`). All Win11 26200.
- Remaining 2 pending Win11 25H2 upgrade then join+tag: **LAPTOP-8P7HDSEI**, **ASSISTNURSE-PC** (both were Win10 19045). User upgraded 3 machines Home->Pro; 2 still need 25H2.
- All 3 joined laptops show `isManaged=null` — auto-MDM-enroll did NOT fire (MDM user scope likely not = All, and devices were only logged into with local accounts so the enroll retry has no Entra user context). DECISION: defer Intune/MDM decision until all devices are on Win11 25H2. Intune is OPTIONAL — the allow-list is tag-based and works on Entra-join alone; Intune only needed for printer-push / Windows compliance policy.
- **NURSESTATION-PC** confirmed as a permanent caregiver/medtech device. It is domain-joined, so it needs **Hybrid Entra Join** (Entra Connect device-options config on CS-SERVER) before it can be tagged — the only device on the hybrid track. Full caregiver device set = phones + Laptop2 + LAPTOP-8P7HDSEI + LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 + ASSISTNURSE-PC + NURSESTATION-PC (6 machines + phones).
### User-to-computer map (resolved a prior gap)
Built the Cascades user<->computer map. Authoritative source = **Syncro `kabuto_information.last_user`** (GuruRMM does not expose logged-in user). Key mappings: DuPras=ALASSIST-PC, Lois Lane=DESKTOP-KQSL232, Karen Rossini=DESKTOP-LPOPV30, shared medtech=ASSISTNURSE-PC (`mc medtechs and care`), shared MemCare reception=MEMRECEPT-PC, the 4 caregiver laptops show generic `\User`. CONTEXT.md GuruRMM roster is stale (27->32 agents) — refresh pending.
### Classifications (restricted = inside-only / SG-Caregivers; privileged = outside access)
- **Privileged/outside** (NOT in SG-Caregivers; ALIS via SSO + offsite MFA): Lois Lane, Karen Rossini (done), Christina DuPras. Nurses ruled OUTSIDE per user. All have Entra accounts.
- **Restricted/inside**: the 38 SG-Caregivers + **Veronica Feller** (caretaker, moving depts later; inventory shows her remote/PA — confirm on-site before locking) + **Christine Nyanzunda** (MC admin asst + PT medtech; uses ASSISTNURSE-PC). Nyanzunda has an M365 account but with a **directory surname typo "Nyanzuda"** to fix; her UPN `christine.nyanzunda@cascadestucson.com`.
- **Zachary Nelson removed** from caregiver consideration — accounting, no ALIS (his ALIS "Caregiver" role is noise).
- **Still pending classification**: Judith Palmer, Patricia Sandoval-Beck, Joey Ty, Alejandra Vallejo, Celia Lassey.
- MEMRECEPT-PC excluded from the caregiver allow-list (receptionist-only; user verifying). Outside users access from home/personal devices — managed laptops/desktops stay onsite, so no device management needed for privileged outside access.
### Phasing decision
Per-user go-live gate = **ALIS email-match + a test sign-in**, done one caregiver at a time as the ALIS sweep proceeds. The CA restriction is already applied to all 38 (in SG-Caregivers, policies enabled). The allow-list cutover is LOW-RISK and can be all-at-once: verified there is no gap (only `CSC-` phones are compliant today, and the allow-list also permits them), so flipping the allow-list ADDS laptop access without removing phone access — nobody on a phone gets locked out.
### Deliverable: caregiver ALIS email-match worklist
Wrote `clients/cascades-tucson/reports/2026-06-04-caregiver-alis-sso-worklist.md` — 40 restricted users (38 + Feller + Nyanzunda) with required ALIS Email = UPN, grouped: 26 clean matches, 4 name-variants (Sika/Esperance/Higdon/Huerta), 8 with no ALIS record, 2 new adds.
### App shortcuts (in progress)
Built a PowerShell script to drop ALIS/LinkRx/HelpAny shortcuts on the Public Desktop, launched in Edge `--app` mode (kiosk-like, preserves SSO device-claim). URLs: ALIS `https://cascadestucson.alisonline.com`, LinkRx `https://pharmcare.linkrxnow.com/`, HelpAny `https://app.safe-living.com/login`. Intune web-link apps only store the Managed Google Play wrapper URL, so the real LinkRx/HelpAny URLs came from the user. Deployment via GuruRMM offered (awaiting go-ahead); targets are the 6 caregiver machines.
### Username-only login question
Answered: Entra/Microsoft sign-in (and ALIS SSO) REQUIRES the full UPN — no tenant setting allows a bare username for cloud accounts. Reduce typing instead via Windows Hello PIN on the laptops + silent ALIS SSO once signed in, and pursue ALIS Login PINs (Medtelligent limited-release). NURSESTATION-PC (domain-joined) Windows login can be short, but ALIS SSO behind it still uses the full UPN.
### Pending (this update)
- [ ] Finish Win11 25H2 on LAPTOP-8P7HDSEI + ASSISTNURSE-PC -> Entra-join -> tag.
- [ ] NURSESTATION-PC Hybrid Entra Join.
- [ ] ALIS email-match sweep (worklist file) — the day-1 gate for phones.
- [ ] Deploy app-shortcut script via GuruRMM to the 6 caregiver machines (awaiting go-ahead).
- [ ] Classify last 5 straddlers; confirm Feller on-site; fix Nyanzunda surname typo.
- [ ] Add Feller + Nyanzunda to SG-Caregivers after their devices ready.
- [ ] Cutover (enable allow-list + disable compliance block); reclaim devices@ license.
- [ ] Windows Hello PIN plan for laptops; ALIS Login PINs support ask.