# Cascades — Caregiver/MedTech restricted-bucket ALIS SSO worklist

**Generated:** 2026-06-04
**Purpose:** Every person in the restricted (caregiver/medtech) bucket must have their **ALIS staff-record Email = their Entra UPN** for SSO to resolve them. This is the per-user gate for phone (and laptop) ALIS sign-in.
**Source:** live `SG-Caregivers` membership (38) + 2 adds (Feller, Nyanzunda). Tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`.

How to use: in ALIS admin -> Staff -> each record, set Email to the UPN below. Then test that user's "Sign in with Microsoft" on a phone before moving to the next. Native ALIS 2FA stays off for this bucket.

## Restricted device set (the only devices these users may sign in from, on-network only)
Phones (`CSC-*`, SDM) + Laptop2 + LAPTOP-8P7HDSEI + LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 + ASSISTNURSE-PC + NURSESTATION-PC (hybrid-join pending).

---

## A. Clean matches — confirm ALIS Email = UPN (26)

| Name | ALIS Email (= UPN) | Done |
|---|---|---|
| Agnes McFerren | a.mcferren@cascadestucson.com | [ ] |
| Ashli Atwood | a.atwood@cascadestucson.com | [ ] |
| Barb Johnson | b.johnson@cascadestucson.com | [ ] |
| Cole Johnson | c.johnson@cascadestucson.com | [ ] |
| Ederick Yuzon | e.yuzon@cascadestucson.com | [ ] |
| Erica Sanchez | e.sanchez@cascadestucson.com | [ ] |
| Gina Williams | g.williams@cascadestucson.com | [ ] |
| Jahmeka Clarke | j.clarke@cascadestucson.com | [ ] |
| Jinnelle Dittbenner | j.dittbenner@cascadestucson.com | [ ] |
| Juan Andrade | j.andrade@cascadestucson.com | [ ] |
| Karina Aziakpo | k.aziakpo@cascadestucson.com | [ ] |
| Katrina Wyzykowski | k.wyzykowski@cascadestucson.com | [ ] |
| Luke Hogan | l.hogan@cascadestucson.com | [ ] |
| Luriz Fuster | l.fuster@cascadestucson.com | [ ] |
| Marie Kastner | m.kastner@cascadestucson.com | [ ] |
| Monique Lopez | m.lopez@cascadestucson.com | [ ] |
| Patricia Camarena Doran | p.doran@cascadestucson.com | [ ] |
| Richard Flores | r.flores@cascadestucson.com | [ ] |
| Rosa Morales | r.morales@cascadestucson.com | [ ] |
| Roseline Cooper | r.cooper@cascadestucson.com | [ ] |
| Samuel Ramirez | s.ramirez@cascadestucson.com | [ ] |
| Sandra Padilla | s.padilla@cascadestucson.com | [ ] |
| Sarah Carroll | s.carroll@cascadestucson.com | [ ] |
| Shontiel Nunn | s.nunn@cascadestucson.com | [ ] |
| Thelma Abainza | t.abainza@cascadestucson.com | [ ] |
| Whisper Reed | w.reed@cascadestucson.com | [ ] |

## B. ALIS name differs from UPN — verify carefully (4)

| ALIS staff name | ALIS Email (= UPN) | Done |
|---|---|---|
| Sika, Bariffa | b.sika@cascadestucson.com | [ ] |
| Esperance, Niyonsaba | e.esperance@cascadestucson.com | [ ] |
| Higdon, Jennifer | j.higdon@cascadestucson.com | [ ] |
| Huerta, Zeke (confirm first initial = E / Ezekiel) | e.huerta@cascadestucson.com | [ ] |

## C. No ALIS record found — create record (Email = UPN) or confirm not a day-1 ALIS user (8)

| Name | ALIS Email (= UPN) | Note | Done |
|---|---|---|---|
| Maia Baker | m.baker@cascadestucson.com | | [ ] |
| Diana Fierros | d.fierros@cascadestucson.com | | [ ] |
| Kasey Flores | k.flores@cascadestucson.com | ALIS only has Richard Flores | [ ] |
| Mary Kariuki | m.kariuki@cascadestucson.com | | [ ] |
| Bella Mendoza | b.mendoza@cascadestucson.com | | [ ] |
| Corey Tate | c.tate@cascadestucson.com | | [ ] |
| Gloria Williford | g.williford@cascadestucson.com | | [ ] |
| Tele Lassey-Assiakoley | t.lassey-assiakoley@cascadestucson.com | ALIS has "Celia Lassey" — confirm same person | [ ] |

## D. New adds to the restricted bucket (office-format UPN)

| Person | ALIS Email (= UPN) | Action | Done |
|---|---|---|---|
| Veronica Feller | veronica.feller@cascadestucson.com | add to SG-Caregivers after her device is enrolled; confirm she is on-site (inventory shows remote/PA) | [ ] |
| Christine Nyanzunda | christine.nyanzunda@cascadestucson.com | FIX directory surname typo "Nyanzuda"->"Nyanzunda" first; uses ASSISTNURSE-PC | [ ] |

## E. Pending classification (ALIS caregiver/medtech role, not yet bucketed)
Decide inside (restricted) or outside (privileged): Judith Palmer, Patricia Sandoval-Beck, Joey Ty, Alejandra Vallejo, Celia Lassey.

---

## Prerequisites already done
- Tenant-wide admin consent for ALIS app (2026-06-03) — SSO works for everyone matched.
- Native ALIS 2FA off for caregivers/medtechs (blanket).
- CA: off-network block + compliance block enforced on SG-Caregivers; allow-list policy staged (report-only).

## After the sweep
- Enroll/tag remaining devices (LAPTOP-8P7HDSEI + ASSISTNURSE-PC after Win11 25H2; NURSESTATION-PC via hybrid join).
- Cutover: enable allow-list policy + disable `CSC - Block caregivers on non-compliant device`.
- Add Feller + Nyanzunda to SG-Caregivers (after their device enrolled).
- Reclaim devices@ Business Premium seat.