# Cascades — Restricted vs Non-Restricted buckets + credentials

**Generated:** 2026-06-04
**Important on passwords:** Microsoft/Entra NEVER lets you read an existing password. The only known passwords are (a) the documented caregiver bulk-creation password and (b) vaulted individual accounts. Unknowns can only be made known by RESETTING them (User Manager app) — say the word and I'll reset to a known temp.

Login-password note: the caregiver bulk password was set with `ChangePasswordAtLogon = $false` + `PasswordNeverExpires = $true`, so it is a **working password, NOT a reset-at-login temp.** It is the actual sign-in password (PHS pushes it to M365/Entra, so it works for Windows login, ALIS SSO, and M365).

---

## A. RESTRICTED bucket (caregivers + medtechs) — SG-Caregivers, inside-network only, devices only

**All 38 bulk-created caregivers share the working password `Cascades2026!`** (not reset-at-login). UPN = sign-in name = required ALIS Email.

| Name | UPN / sign-in | Password |
|---|---|---|
| Agnes McFerren | a.mcferren@cascadestucson.com | Cascades2026! |
| Ashli Atwood | a.atwood@cascadestucson.com | Cascades2026! |
| Barb Johnson | b.johnson@cascadestucson.com | Cascades2026! |
| Bella Mendoza | b.mendoza@cascadestucson.com | Cascades2026! |
| Charity/Bariffa Sika | b.sika@cascadestucson.com | Cascades2026! |
| Cole Johnson | c.johnson@cascadestucson.com | Cascades2026! |
| Corey Tate | c.tate@cascadestucson.com | Cascades2026! |
| Diana Fierros | d.fierros@cascadestucson.com | Cascades2026! |
| Ederick Yuzon | e.yuzon@cascadestucson.com | Cascades2026! |
| Erica Sanchez | e.sanchez@cascadestucson.com | Cascades2026! |
| Espe/Niyonsaba Esperance | e.esperance@cascadestucson.com | Cascades2026! |
| Gina Williams | g.williams@cascadestucson.com | Cascades2026! |
| Gloria Williford | g.williford@cascadestucson.com | Cascades2026! |
| Jahmeka Clarke | j.clarke@cascadestucson.com | Cascades2026! |
| Jen/Jennifer Higdon | j.higdon@cascadestucson.com | Cascades2026! |
| Jinnelle Dittbenner | j.dittbenner@cascadestucson.com | Cascades2026! |
| Juan Andrade | j.andrade@cascadestucson.com | Cascades2026! |
| Karina Aziakpo | k.aziakpo@cascadestucson.com | Cascades2026! |
| Kasey Flores | k.flores@cascadestucson.com | Cascades2026! |
| Katrina Wyzykowski | k.wyzykowski@cascadestucson.com | Cascades2026! |
| Luke Hogan | l.hogan@cascadestucson.com | Cascades2026! |
| Luriz Fuster | l.fuster@cascadestucson.com | Cascades2026! |
| Maia Baker | m.baker@cascadestucson.com | Cascades2026! |
| Marie Kastner | m.kastner@cascadestucson.com | Cascades2026! |
| Mary Kariuki | m.kariuki@cascadestucson.com | Cascades2026! |
| Monique Lopez | m.lopez@cascadestucson.com | Cascades2026! |
| Patricia Camarena Doran | p.doran@cascadestucson.com | Cascades2026! |
| Richard Flores | r.flores@cascadestucson.com | Cascades2026! |
| Rosa Morales | r.morales@cascadestucson.com | Cascades2026! |
| Roseline Cooper | r.cooper@cascadestucson.com | Cascades2026! |
| Samuel Ramirez | s.ramirez@cascadestucson.com | Cascades2026! |
| Sandra Padilla | s.padilla@cascadestucson.com | Cascades2026! |
| Sarah Carroll | s.carroll@cascadestucson.com | Cascades2026! |
| Shontiel Nunn | s.nunn@cascadestucson.com | Cascades2026! |
| Tele Lassey-Assiakoley | t.lassey-assiakoley@cascadestucson.com | Cascades2026! |
| Thelma Abainza | t.abainza@cascadestucson.com | Cascades2026! |
| Whisper Reed | w.reed@cascadestucson.com | Cascades2026! |
| Zeke Huerta | e.huerta@cascadestucson.com | Cascades2026! |

**New adds to restricted (existing accounts — password NOT known, RESET needed):**
| Name | UPN | Password |
|---|---|---|
| Veronica Feller | veronica.feller@cascadestucson.com | UNKNOWN — reset needed (confirm on-site first; inventory shows PA) |
| Christine Nyanzunda | christine.nyanzunda@cascadestucson.com | UNKNOWN — reset needed; also fix directory surname typo "Nyanzuda" |

> Caveat: any of the 38 who voluntarily changed their password (unlikely for shared-phone caregivers) would differ from `Cascades2026!`. If a login fails, reset that one.

---

## B. NON-RESTRICTED bucket (privileged — outside access to ALIS + M365, 2FA offsite)

NOT in SG-Caregivers. Microsoft offsite access already works (all-users-MFA, trusted-location excluded). For outside ALIS they need ALIS Email = UPN + native 2FA off.

| Name | Role | UPN | Password |
|---|---|---|---|
| Lois Lane | Health Services Dir (RN) | Lois.Lane@cascadestucson.com | Imbirowicz1$ |
| Megan Hiatt | Sales/Marketing Dir | megan.hiatt@cascadestucson.com | 4PazCas$07 |
| Ashley Jensen | Asst Exec Dir / CFO | Ashley.Jensen@cascadestucson.com | Fall2025! (local pre-domain: ScarlettSky18*) |
| Front Desk (shared) | Reception | frontdesk@cascadestucson.com | sccssccs#3 |
| Karen Rossini | Health Services Mgr (LPN) | karen.rossini@cascadestucson.com | UNKNOWN — reset if needed (ALIS SSO already working for her) |
| Christina DuPras | Resident Svcs / Admin Asst | christina.dupras@cascadestucson.com | UNKNOWN — reset needed |
| Meredith Kuhn | Executive Director | meredith.kuhn@cascadestucson.com | UNKNOWN |
| Lauren Hasselman | Business Office Mgr | lauren.hasselman@cascadestucson.com | UNKNOWN |
| Crystal Rodriguez | Sales | crystal.rodriguez@cascadestucson.com | UNKNOWN (ALIS SSO already working) |
| Shelby Trozzi | MemCare Director | (verify UPN) | UNKNOWN |
| Susan Hicks | Life Enrichment Dir | Susan.Hicks@cascadestucson.com | UNKNOWN |
| Chris Knight | CFO | chris.knight@cascadestucson.com | UNKNOWN |
| Lupe Sanchez | Housekeeping Dir | (verify UPN) | UNKNOWN |
| Alyssa Shestko | Dining Room Mgr | (verify UPN) | UNKNOWN |

Admin/break-glass (cloud-only, excluded from CA): admin@cascadestucson.com, sysadmin@cascadestucson.com (vaulted).

---

## C. Phased testing — LIVE mechanism
- Group `SG-Caregivers-DeviceTest` (`db5849ec-242d-4b05-9d1b-940a830e7a60`) — members are governed by the **allow-list** (phones + tagged devices) instead of the compliance block.
- Allow-list policy `CSC - Caregivers: allow-listed devices only (TEST GROUP)` (`1b7fd025-...`) = ENABLED, scoped to that group.
- Compliance-block (`ede985e2-...`) now EXCLUDES that group.

**To test one caregiver:** (1) match their ALIS Email = UPN; (2) add them to `SG-Caregivers-DeviceTest`; (3) on a tagged laptop, log into Windows/Edge with their UPN + `Cascades2026!`, open ALIS -> verify silent SSO; (4) verify they still work on a phone. Expand one at a time.

**Full cutover (when confident):** point the allow-list policy back to `SG-Caregivers` (all), disable the compliance block, empty/delete the test group.

Tagged devices so far: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8. Pending (Win11 25H2): LAPTOP-8P7HDSEI, ASSISTNURSE-PC. Hybrid pending: NURSESTATION-PC.