# Cascades — Caregiver laptop Intune enrollment prep (devices@ licensed)

**Date:** 2026-06-04
**Client:** Cascades of Tucson (Syncro 20149445, Tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`)

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Resumed the caregiver device allow-list rollout (continued from `2026-06-03-session.md`). The plan: Entra-join the 4 caregiver/medtech laptops so they exist as Entra device objects, then tag them onto the report-only allow-list CA policy created 2026-06-03.

Prepared the enrollment account. The dedicated provisioning account `devices@cascadestucson.com` (Cloud Device Administrator) was unlicensed, which would let a device Entra-join but skip Intune auto-enrollment. Set its `usageLocation` to US and assigned a Microsoft 365 Business Premium (SPB) license via the User Manager app so auto-MDM-enroll fires on join. The license is needed only transiently at enrollment time and can be reclaimed after the batch.

Provided Howard the start-to-finish enrollment runbook: confirm Intune MDM user scope = All (portal), Entra-join each laptop with `devices@`, verify it lands in Intune, then report device names back for tagging (`extensionAttribute1=CSCCaregiverDevice`). Recommended doing one laptop end-to-end first to validate the flow before the rest. NURSESTATION-PC remains the separate Hybrid Entra Join track.

No laptops were enrolled this session — enrollment is the next hands-on step for Howard. No repo changes beyond this log; the license assignment was a live Entra change.

## Key Decisions

- Assigned Business Premium to `devices@` rather than to a user account, keeping a dedicated provisioning identity for device joins; the seat is reclaimable post-enrollment.
- Set `usageLocation=US` on `devices@` (required before any license can be assigned).

## Problems Encountered

- First license-assignment attempt failed (HTTP 404, "Resource '197609' does not exist"). Cause: `UID` is a read-only special variable in bash, so `UID=<guid>` silently failed and `$UID` resolved to the shell's numeric user id. Resolved by renaming the variable (`DEVID`).
- Immediate license read-back showed `Business Premium=false` right after a 200 assignLicense — Entra eventual consistency. Confirmed assigned on re-read after a short delay.

## Configuration Changes

- Live Entra change (no repo files): `devices@cascadestucson.com` — set `usageLocation=US`; assigned license SPB (`cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`) via Graph `POST /users/{id}/assignLicense` (User Manager tier). Verified present.
- Session log created (this file).

## Credentials & Secrets

- `devices@cascadestucson.com` / `Gptf*77ttb!` — Cloud Device Administrator, user ID `aaca80c6-861b-4294-8068-1033c68d7667`. Now licensed Business Premium + usageLocation US. Vault: `clients/cascades-tucson/devices-account.sops.yaml`. Use this account to Entra-join the laptops. Reclaim the Business Premium seat after the enrollment batch.

## Infrastructure & Servers

- Tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`.
- SKU: Business Premium (SPB) `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`.
- Report-only allow-list policy (from 2026-06-03): `CSC - Caregivers: allow-listed devices only (REPORT-ONLY)` id `1b7fd025-1aad-47c8-9274-c32c3e0b163c`; device filter excludes `(displayName -startsWith "CSC-") -or (extensionAttribute1 -eq "CSCCaregiverDevice")`.
- Target laptops (Entra join): Laptop2, LAPTOP-8P7HDSEI (Win10 — upgrade), LAPTOP-DRQ5L558, LAPTOP-E0STJJE8. NURSESTATION-PC = Hybrid join track (stale 2021 Entra record to clean).

## Commands & Outputs

```bash
# Set usageLocation then assign Business Premium (note: do NOT use $UID as a var name in bash)
DEVID=aaca80c6-861b-4294-8068-1033c68d7667
SPB=cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46
TOK=$(bash scripts/get-token.sh $TEN user-manager)
curl -s -X PATCH ... -d '{"usageLocation":"US"}' .../users/$DEVID            # HTTP 204
curl -s -X POST ... -d '{"addLicenses":[{"skuId":"'$SPB'"}],"removeLicenses":[]}' \
  .../users/$DEVID/assignLicense                                             # HTTP 200
# Verify: assignedLicenses includes cbdc14ab-... (after ~6s, eventual consistency)
```

## Pending / Incomplete Tasks

- [ ] Confirm Intune MDM user scope = All (Entra -> Devices -> Mobility (MDM and MAM) -> Microsoft Intune) — not verifiable via API.
- [ ] Entra-join the 4 laptops with `devices@` (do one first, validate end-to-end).
- [ ] Report device names -> tag each `extensionAttribute1=CSCCaregiverDevice`.
- [ ] Confirm which printer(s) each laptop needs -> Intune printer push (FrontDesk Epson ET-5800 192.168.2.147; CopyRoom Canon C478iF 192.168.2.230; MCReception Epson ET-5800).
- [ ] Confirm whether any laptop needs on-prem file shares (would push that one to hybrid).
- [ ] NURSESTATION-PC Hybrid Entra Join (Entra Connect device options on CS-SERVER); clean stale 2021 record.
- [ ] Review report-only sign-in results, then cutover: enable allow-list policy + disable `CSC - Block caregivers on non-compliant device`.
- [ ] Reclaim Business Premium seat from `devices@` after enrollment batch.
- [ ] LAPTOP-8P7HDSEI: upgrade Win10 -> Win11 before PHI use.

## Reference Information

- Prior context: `clients/cascades-tucson/session-logs/2026-06-03-session.md` (admin consent + allow-list policy + join-model decisions).
- Allow-list policy id `1b7fd025-1aad-47c8-9274-c32c3e0b163c`; ALIS admin-consent grant id `reTK4etbykSC1ENMm9g1rTplOyzgVClCofKDVRrn-ds`.
- Tickets: #110680053 (domain migration), #109412123 (Entra setup).

## Update: 21:20 MST — device tagging, roster classifications, ALIS worklist, app shortcuts

Continued the caregiver device rollout and finalized the restricted vs privileged user split for go-live (caregivers using phones start of next week).

### Devices
- 3 of 5 laptops Entra-joined (workgroup -> AzureAd) and tagged `extensionAttribute1=CSCCaregiverDevice`: **Laptop2** (`3ade4bd4-527f-468a-b06b-b1fa304941c8`), **LAPTOP-DRQ5L558** (`eb5f6b98-0077-4c35-b029-ee6f9ada0eef`), **LAPTOP-E0STJJE8** (`4b5ee995-964c-4efc-8960-f1a2a7d6257d`). All Win11 26200.
- Remaining 2 pending Win11 25H2 upgrade then join+tag: **LAPTOP-8P7HDSEI**, **ASSISTNURSE-PC** (both were Win10 19045). User upgraded 3 machines Home->Pro; 2 still need 25H2.
- All 3 joined laptops show `isManaged=null` — auto-MDM-enroll did NOT fire (MDM user scope likely not = All, and devices were only logged into with local accounts so the enroll retry has no Entra user context). DECISION: defer Intune/MDM decision until all devices are on Win11 25H2. Intune is OPTIONAL — the allow-list is tag-based and works on Entra-join alone; Intune only needed for printer-push / Windows compliance policy.
- **NURSESTATION-PC** confirmed as a permanent caregiver/medtech device. It is domain-joined, so it needs **Hybrid Entra Join** (Entra Connect device-options config on CS-SERVER) before it can be tagged — the only device on the hybrid track. Full caregiver device set = phones + Laptop2 + LAPTOP-8P7HDSEI + LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 + ASSISTNURSE-PC + NURSESTATION-PC (6 machines + phones).

### User-to-computer map (resolved a prior gap)
Built the Cascades user<->computer map. Authoritative source = **Syncro `kabuto_information.last_user`** (GuruRMM does not expose logged-in user). Key mappings: DuPras=ALASSIST-PC, Lois Lane=DESKTOP-KQSL232, Karen Rossini=DESKTOP-LPOPV30, shared medtech=ASSISTNURSE-PC (`mc medtechs and care`), shared MemCare reception=MEMRECEPT-PC, the 4 caregiver laptops show generic `\User`. CONTEXT.md GuruRMM roster is stale (27->32 agents) — refresh pending.

### Classifications (restricted = inside-only / SG-Caregivers; privileged = outside access)
- **Privileged/outside** (NOT in SG-Caregivers; ALIS via SSO + offsite MFA): Lois Lane, Karen Rossini (done), Christina DuPras. Nurses ruled OUTSIDE per user. All have Entra accounts.
- **Restricted/inside**: the 38 SG-Caregivers + **Veronica Feller** (caretaker, moving depts later; inventory shows her remote/PA — confirm on-site before locking) + **Christine Nyanzunda** (MC admin asst + PT medtech; uses ASSISTNURSE-PC). Nyanzunda has an M365 account but with a **directory surname typo "Nyanzuda"** to fix; her UPN `christine.nyanzunda@cascadestucson.com`.
- **Zachary Nelson removed** from caregiver consideration — accounting, no ALIS (his ALIS "Caregiver" role is noise).
- **Still pending classification**: Judith Palmer, Patricia Sandoval-Beck, Joey Ty, Alejandra Vallejo, Celia Lassey.
- MEMRECEPT-PC excluded from the caregiver allow-list (receptionist-only; user verifying). Outside users access from home/personal devices — managed laptops/desktops stay onsite, so no device management needed for privileged outside access.

### Phasing decision
Per-user go-live gate = **ALIS email-match + a test sign-in**, done one caregiver at a time as the ALIS sweep proceeds. The CA restriction is already applied to all 38 (in SG-Caregivers, policies enabled). The allow-list cutover is LOW-RISK and can be all-at-once: verified there is no gap (only `CSC-` phones are compliant today, and the allow-list also permits them), so flipping the allow-list ADDS laptop access without removing phone access — nobody on a phone gets locked out.

### Deliverable: caregiver ALIS email-match worklist
Wrote `clients/cascades-tucson/reports/2026-06-04-caregiver-alis-sso-worklist.md` — 40 restricted users (38 + Feller + Nyanzunda) with required ALIS Email = UPN, grouped: 26 clean matches, 4 name-variants (Sika/Esperance/Higdon/Huerta), 8 with no ALIS record, 2 new adds.

### App shortcuts (in progress)
Built a PowerShell script to drop ALIS/LinkRx/HelpAny shortcuts on the Public Desktop, launched in Edge `--app` mode (kiosk-like, preserves SSO device-claim). URLs: ALIS `https://cascadestucson.alisonline.com`, LinkRx `https://pharmcare.linkrxnow.com/`, HelpAny `https://app.safe-living.com/login`. Intune web-link apps only store the Managed Google Play wrapper URL, so the real LinkRx/HelpAny URLs came from the user. Deployment via GuruRMM offered (awaiting go-ahead); targets are the 6 caregiver machines.

### Username-only login question
Answered: Entra/Microsoft sign-in (and ALIS SSO) REQUIRES the full UPN — no tenant setting allows a bare username for cloud accounts. Reduce typing instead via Windows Hello PIN on the laptops + silent ALIS SSO once signed in, and pursue ALIS Login PINs (Medtelligent limited-release). NURSESTATION-PC (domain-joined) Windows login can be short, but ALIS SSO behind it still uses the full UPN.

### Pending (this update)
- [ ] Finish Win11 25H2 on LAPTOP-8P7HDSEI + ASSISTNURSE-PC -> Entra-join -> tag.
- [ ] NURSESTATION-PC Hybrid Entra Join.
- [ ] ALIS email-match sweep (worklist file) — the day-1 gate for phones.
- [ ] Deploy app-shortcut script via GuruRMM to the 6 caregiver machines (awaiting go-ahead).
- [ ] Classify last 5 straddlers; confirm Feller on-site; fix Nyanzunda surname typo.
- [ ] Add Feller + Nyanzunda to SG-Caregivers after their devices ready.
- [ ] Cutover (enable allow-list + disable compliance block); reclaim devices@ license.
- [ ] Windows Hello PIN plan for laptops; ALIS Login PINs support ask.