session log: cascades — Entra Connect install + pilot account prep (2026-04-24/25)

Comprehensive log of the Entra setup work spanning 4/24 evening through 4/25.
Includes a Resume Point at the top so the next session can pick up cleanly.

Highlights:
- Entra Connect Sync installed in staging mode on CS-SERVER, scope OU=Caregivers
- Pilot AD account howard.enos@cascadestucson.com created
- Master plan v2 with explicit drift log (FIDO2/YubiKey injection caught)
- HIPAA retention remediation: 7 mailboxes restored from soft-delete (4/22 deletes
  violated 164.316(b)(2)); termination procedures policy + IR-2026-04-24-001 documented
- admin@cascadestucson.com re-promoted to Global Admin (Sandra Fish cleanup had
  stripped role); residual profile data cleaned
- Existing Cascades CA architecture discovered (Named Location 72.211.21.217 + all-users
  MFA policy from 2026-02-11) — adjusts plan, no duplicate policies needed
- Syncro ticket #32214 'Entra setup' with hidden private rollup (~40-45 billable hrs)

Released session lock; resume point flagged in PROJECT_STATE.md.

clients/cascades-tucson/PROJECT_STATE.md

@@ -8,12 +8,12 @@
 
 ## Active Session Locks
 
-| Session | Working On | Status | Started |
-|---------|-----------|--------|---------|
-| Howard-Home/Claude (Howard) | Track A phone-SSO pilot — Entra Connect prep, OU creation, WAN IP discovery, ALIS App Registration kickoff | IN_PROGRESS | 2026-04-24 (day) |
+(no active locks)
 
 **How to claim a lock:** Add a row before starting work. Remove it when done. Locks older than 2 hours with no update are considered stale.
 
+**Last session paused:** 2026-04-25 ~15:30 PDT — see `session-logs/2026-04-25-howard-entra-connect-install-and-pilot-prep.md` for resume point. Entra Connect installed in staging mode, pilot account ready, mid-Track-A-Gate-2 prep when paused (existing CA architecture discovered, needs reconciliation before adding 184.191.143.62/32 to Cascades Named Location).
+
 ---
 
 ## Current State