sync: auto-sync from ACG-TECH03L at 2026-04-18 10:17:42

Author: Howard Enos Machine: ACG-TECH03L Timestamp: 2026-04-18 10:17:42
2026-04-18 10:17:43 -07:00
parent 6a135ac111
commit d2e375df8a
7 changed files with 697 additions and 0 deletions
--- a/clients/cascades-tucson/docs/cloud/caregiver-m365-p2-rollout.md
+++ b/clients/cascades-tucson/docs/cloud/caregiver-m365-p2-rollout.md
@@ -0,0 +1,183 @@
+# Caregiver M365 + Entra P2 Rollout Plan (Cascades of Tucson)
+
+**Status:** Documentation only — do NOT create accounts or assign licenses yet.
+**Created:** 2026-04-18 (Howard)
+**Source:** `C:\Users\howar\OneDrive\Documents\Caregiver Scheduled shifts and phone #.xlsx` (as of 2026-04-17)
+
+## Goal / why this matters
+
+Cascades is deploying 25 shared Android phones plus 9 kitchen iPads to get caregivers off shared workstations and into their own authenticated sessions (ALIS EHR, Outlook, Edge). For that to actually improve HIPAA posture, every caregiver needs:
+
+1. Their own identity (AD user + M365 mailbox) so actions are attributable per-person rather than to a shared "Caregiver" login
+2. **Entra P2** so we can apply Conditional Access policies that restrict mobile email + ALIS access to:
+   - Managed (Intune-enrolled) shared phones, AND
+   - The Cascades physical network / trusted location (IP ranges or named location)
+3. Policy block on personal-device access to Exchange + ALIS (HIPAA §164.312 access control)
+
+Today none of these caregivers exist in AD or M365 — they use shared workstation logins and don't have email at all. That is the gap this rollout closes.
+
+**Also noted (explicit call-out to add to the proposal):** we did not previously frame the Business Premium proposal as "we're adding phones AND licenses to reach HIPAA compliance." The proposal currently lists 23 licensed users post-cleanup; with caregivers included it is closer to 62. The cost delta + HIPAA rationale should be surfaced in `docs/proposals/m365-premium-upgrade.md` before re-presenting to Meredith.
+
+## Caregiver roster (39 people)
+
+Location codes: **Tower** = assisted living tower, **MC** = Memory Care.
+Role flags: **CCG** = certified caregiver, **MedTech / MED TECH** = medication tech, **PRN** = as-needed/float, **NOC** = overnight.
+
+### Tuesday–Saturday (14)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 1 | Thelma Abainza | thelma.abainza@ | AM | Tower | Caregiver | 520-867-2579 |
+| 2 | Niel Castro | niel.castro@ | AM | Tower | MedTech / CCG | 520-697-4644 |
+| 3 | Espe Esperance | espe.esperance@ | PM | Tower | MedTech | 520-788-9558 |
+| 4 | Barbara Johnson | barbara.johnson@ | PM | Tower | Caregiver | 520-204-3449 |
+| 5 | Kasey Flores | kasey.flores@ | AM | MC | Caregiver | 520-250-1451 |
+| 6 | Richard Flores | richard.flores@ | AM | MC | Caregiver | 520-873-7727 |
+| 7 | Marie Kastner | marie.kastner@ | PM | MC | Caregiver | 714-576-9858 |
+| 8 | Bella Mendoza | bella.mendoza@ | PM | MC | Caregiver | 520-358-2000 |
+| 9 | Rosa Morales | rosa.morales@ | PM | MC | MedTech | 312-213-8780 |
+| 10 | Sandra Padilla | sandra.padilla@ | AM | Tower | MedTech / CCG | 520-585-3317 |
+| 11 | Polett Pinazavala | polett.pinazavala@ | AM | MC | MedTech | 520-449-5533 |
+| 12 | Whisper Reed | whisper.reed@ | Overnight | Tower | MedTech | 520-312-7575 |
+| 13 | Patricia Sandoval-Beck | patricia.sandoval-beck@ | AM | Tower | MedTech | 520-343-8093 |
+| 14 | Charity Sika | charity.sika@ | AM | MC | Caregiver | 623-251-8032 |
+| 15 | Ederick Yuzon | ederick.yuzon@ | PM | Tower | Caregiver | 520-603-8816 |
+
+### Sunday–Thursday (10)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 16 | Juan Andrade | juan.andrade@ | PM | MC | Caregiver | 520-528-4078 |
+| 17 | Jahmeka Clarke | jahmeka.clarke@ | PM | MC | MedTech | 520-649-7034 |
+| 18 | Karina Aziakpo | karina.aziakpo@ | Overnight | MC | MedTech / CCG | 520-392-6859 |
+| 19 | Jinnelle Dittbenner | jinnelle.dittbenner@ | PM | Tower | Caregiver | 520-499-9996 |
+| 20 | Christine Nyanzunda | christine.nyanzunda@ | AM (Sun/Mon only) | MC | MedTech | 520-304-4251 |
+| 21 | Agnes McFerren | agnes.mcferren@ | AM | Tower | Caregiver | 520-406-3063 |
+| 22 | Samuel Ramirez | samuel.ramirez@ | PM | Tower | Caregiver | 520-488-5798 |
+| 23 | Erica Sanchez | erica.sanchez@ | AM | MC | Caregiver | 520-528-3387 |
+| 24 | Katrina Wyzykowski | katrina.wyzykowski@ | AM | MC | MedTech | 520-347-1448 |
+| 25 | Corey Tate | corey.tate@ | NOC | Tower | Caregiver only (no MedTech) | 520-535-7821 |
+
+### Friday–Monday / weekend (5)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 26 | Ashli Atwood | ashli.atwood@ | Overnight | MC | MedTech / CCG | 715-200-1295 |
+| 27 | Cole Johnson | cole.johnson@ | PM | Tower | MedTech | 818-970-0890 |
+| 28 | Roseline Cooper | roseline.cooper@ | Overnight | MC | Caregiver | 520-278-6817 |
+| 29 | Monique Lopez | monique.lopez@ | Doubles (Fri & Sat) | Tower | Caregiver | 520-596-0969 |
+| 30 | Gloria Williford | gloria.williford@ | Doubles (Fri & Sat 5:45a–10p) | MC | MedTech | 928-551-1682 |
+
+### Thursday–Monday (3)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 31 | Sarah Carroll | sarah.carroll@ | PM | Tower | Caregiver | 520-409-2341 |
+| 32 | Luke Hogan | luke.hogan@ | AM | Tower | Caregiver | 520-312-0141 |
+| 33 | Gina Williams | gina.williams@ | AM | Tower | Caregiver | 520-612-5075 |
+
+### Split / other patterns (3)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 34 | Jen Higdon | jen.higdon@ | Mon/Wed/Fri AM | Tower | Caregiver | 520-730-3548 |
+| 35 | Mary Kariuki | mary.kariuki@ | Sat–Mon + Wed PM | Tower | Caregiver | 520-309-1247 |
+| 36 | CeCe Lassey | cece.lassey@ | Sun/Mon doubles + Tue PM | Tower | Caregiver | 520-248-5982 |
+
+### Sunday & Monday only (1)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 37 | Paty Doran | paty.doran@ | AM | Tower | MedTech / CCG | 520-591-7368 |
+
+### PRN / float (2)
+
+| # | Name | Proposed UPN | Shift | Location | Role | Phone |
+|---|------|--------------|-------|----------|------|-------|
+| 38 | Ezekiel Huerta | ezekiel.huerta@ | PRN | Tower | Caregiver | 520-591-6113 |
+| 39 | Maia Baker | maia.baker@ | PRN | MC | MedTech | TBD — not on shift list, only on Sheet2 |
+
+All UPNs above use the `@cascadestucson.com` suffix (standard).
+
+## Conflict / verify before creating
+
+- **Christine Nyanzunda** already exists in AD as **Memory Care Admin Assistant** (`Christine.Nyanzunda`, susan.hicks@ department peer — see `docs/servers/active-directory.md` and existing M365 match in `docs/cloud/m365.md`). The caregiver list entry `Christine Nyanzunda-AM shift/MC MED TECH` is likely the same person picking up clinical shifts, not a second identity. **Do not create a second account.** Confirm with Shelby Trozzi / Meredith that her caregiver shifts should use the existing `christine.nyanzunda@` mailbox.
+- **Paty Doran** — spelling could be Patricia / Paty / Patti. Confirm with HR before creating.
+- **Polett Pinazavala** — unusual spelling, verify with HR.
+- **Patricia Sandoval-Beck** — hyphenated last name; SamAccountName may need to be `Patricia.SandovalBeck` if hyphens are disallowed in downstream tools (ALIS, MDM).
+- **Ederick Yuzon** — verify spelling.
+- **Maia Baker** — name on Sheet2 only, no shift/phone data. Confirm employment status with HR.
+
+## Licensing plan (when ready — NOT now)
+
+**Current licensing (per `docs/cloud/m365.md`):**
+- Business Standard: 34 purchased, all assigned (need to free via shared-mailbox conversion first)
+- Entra P2: 1 unassigned (was Sandra Fish)
+
+**Target for caregiver rollout:**
+
+| License | Who gets it | Qty | Rationale |
+|---|---|---|---|
+| M365 Business Premium (replaces Standard) | All 23 existing licensed staff + 38 net-new caregivers (Christine Nyanzunda already counted as existing staff) | **61** | Includes Intune Shared Device Mode + Defender + DLP + the P2-equivalent Conditional Access features — this is the SKU the proposal already describes |
+| Entra ID P2 (standalone, IF we stay on Business Standard instead) | Same 61 | 61 | Only needed if we do NOT upgrade to Business Premium. Premium already bundles the CA features we need; avoid double-paying |
+
+**Recommended:** upgrade everyone to Business Premium, **don't** buy standalone P2. P2 is only listed here as the fallback if budget forces staying on Standard.
+
+### Quick cost math (order-of-magnitude, double-check in proposal)
+
+| Scenario | Licenses | Rate (monthly) | Monthly total |
+|---|---|---|---|
+| Today (actual) | 34 × Standard | $12.50 | $425 |
+| After shared-mailbox cleanup (no caregivers) | 23 × Premium | $22.00 | $506 |
+| After caregiver rollout (this doc) | 61 × Premium | $22.00 | **$1,342** |
+| Delta vs today | +$917/mo | | — |
+
+That is a meaningful jump and needs to be in the proposal conversation with Meredith explicitly — it was missing from the 2026-04-14 version.
+
+## Conditional Access policy plan (rough)
+
+When licenses are in place and accounts exist:
+
+1. **Named Location** in Entra = Cascades public IP(s) from pfSense WAN + VPN exit IP. Name it `CascadesTrustedLocation`.
+2. **Compliant Device** definition in Intune = corporate-enrolled Android (the 25 shared phones) + corporate-enrolled iPad (the 9 kitchen iPads) + domain-joined Windows PCs.
+3. **CA Policy: Caregivers — Mobile Email / ALIS access**
+   - Assignment: Entra group `SG-Caregivers` (populated from AD group once accounts exist)
+   - Cloud apps: Exchange Online, `ALIS` (once registered as Entra app), Outlook Mobile
+   - Conditions: Device Platforms = Android, iOS; Locations = Any
+   - Grant: Require compliant device **AND** require location `CascadesTrustedLocation` (combined grant, both required)
+   - Block everything else (personal phones off-network → blocked)
+4. **CA Policy: Caregivers — Web/browser block off-network**
+   - Same group + cloud apps
+   - Platforms: browser (desktop)
+   - Conditions: not in `CascadesTrustedLocation`
+   - Grant: Block
+5. **Exclusion group** `SG-CA-BreakGlass` for Meredith + sysadmin so we can't lock ourselves out.
+
+CA policies should be deployed in **Report-only** mode for at least 7 days, reviewed against Sign-in logs, then switched to On.
+
+## AD placement (when accounts are created)
+
+Put caregivers in the existing `OU=Departments,OU=...` department OUs:
+
+- Tower/MC caregivers → `OU=Care-Assisted Living,OU=Departments` (or create `OU=Caregivers` sub-OU if we want finer GPO targeting)
+- MedTech-flagged staff → same OU; group membership (SG-MedTech) controls ALIS licensing tier
+- CCG-flagged staff → same OU; group membership (SG-CCG) controls higher-privilege ALIS rights if any
+
+Group-policy impact: the `CSC - Folder Redirection (LE)` work done for Life Enrichment does NOT apply here. Care-Assisted Living GPO pattern needs to be cloned from the finalized LE GPO once that's proven on Susan Hicks' machine (DESKTOP-ROK7VNM).
+
+## Open items / decisions needed from client
+
+- [ ] Confirm Christine Nyanzunda is one person, not two (existing M365 account keeps working for caregiver shifts)
+- [ ] HR spelling confirmation on Paty Doran, Polett Pinazavala, Patricia Sandoval-Beck, Ederick Yuzon, Maia Baker
+- [ ] Will caregivers use ALIS on the shared phones (need ALIS accounts + Entra SSO) or only email?
+- [ ] Does Cascades want to purchase 39 additional Business Premium licenses up-front, or roll out in waves (e.g., MedTechs first, then CCGs, then Caregivers)?
+- [ ] Confirm pfSense WAN IP(s) are static enough to rely on in a CA Named Location policy
+- [ ] Timeline expectations — tying this to the phone deployment, the MDM rollout (7-phase plan in `docs/security/mdm.md`), and the Business Premium purchase
+
+## Related docs
+
+- Proposal: `docs/proposals/m365-premium-upgrade.md` — currently sized for 23 users; needs updating
+- MDM plan: `docs/security/mdm.md` — 25 phones + 9 iPads, ManageEngine; Intune Shared Device Mode is flagged as future
+- M365 current state: `docs/cloud/m365.md`
+- AD roster: `docs/servers/active-directory.md`
+- HIPAA program: `docs/security/hipaa.md`