Howard Enos
3e513d3db4
Meredith/John returned the staff-editor questionnaire (70 people, 11 departments). CSV ingested to reports/; p2-staff-candidates.md updated with real persona breakdown. Wrote full AD/M365 user rollout plan (8 personas, license mapping, OU/group layout, CA policies, 4-wave sequence, 8 open decisions). Drafted follow-up email for remaining open items — Howard will edit and send. Britney Thompson and Polett Pinazavala confirmed still employed (were absent from the CSV return). Christine Nyanzunda confirmed as one person with two roles. Usernames locked for new accounts: Alma.Montt, Kyla.QuickTiffany. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
9.0 KiB
Staff Entra P2 Candidates — Cascades
Status: List received from Meredith/John (2026-04-22) via staff-editor CSV. Ready for licensing + CA policy design. No license purchase or policy activation yet.
Last updated: 2026-04-22 (Howard)
Source of truth: reports/cascades-staff-2026-04-22.csv (70 people, 11 departments, access/outside/ALIS flagged per person)
Related (different population): docs/cloud/caregiver-m365-p2-rollout.md — caregiver phone rollout (overlaps with the 39 shift-staff rows in the CSV).
Why this list is separate
Two different problems both use P2 features, and conflating them makes the license math fuzzy:
- Caregiver rollout (covered elsewhere): ~39 hourly staff, shared Android phones, goal is location-locked mobile access during shifts.
- This list — office staff whose risk is:
- Receives / sends PHI (new resident intake forms, doctor-supplied medical info)
- Works from home or checks email on a personal phone, which is where we need either Conditional Access compliance enforcement or just a targeted location restriction
- Or — should be restricted to in-building sign-in only
The Conditional Access policies will likely differ between the two groups (office staff need "work from home or from trusted device with compliance", caregivers need strict "on-prem network + managed shared phone only"), so tracking them separately keeps the policy design clean.
Criteria (from Howard → leadership email, 2026-04-16)
A staff member needs P2 if they match one or more:
- Signs in on a phone or tablet at Cascades (skip-MFA-in-building story)
- Should only sign in from the building (enforce location restriction)
- Handles sensitive / medical information via email (PHI — need to enforce encryption + DLP policies that P2-tier features back)
Candidates confirmed so far
From Crystal Rodriguez (2026-04-16 reply)
| Name | Role | Reason P2 is needed | Notes |
|---|---|---|---|
| Megan Hiatt | Sales Director | Handles new-resident intake forms (PHI from doctors); works from home; email on personal cell | Already a protected user for anti-impersonation |
| Crystal Rodriguez | Sales Associate | Same as Megan — intake forms, home + cell access | Already a protected user |
| Tamra Matthews | Move-In Coordinator | Same — intake forms | Leaving in June 2026 — license can be re-harvested on exit. Value of buying P2 for ~2 months is a call for Meredith (short-term HIPAA coverage vs. one-off cost). |
Full list received 2026-04-22 (via staff-editor CSV)
The CSV encodes access posture per person with three columns: Access (D / P / D+P), Outside Access (Y/N — i.e. work from home / personal device), ALIS (Y/N — resident management system).
P2-needed office staff (D+P, Outside=Y, ALIS=Y — meets criteria 2 and/or 3 above):
| Department | Name | Title |
|---|---|---|
| Administrative | Meredith Kuhn | Executive Director |
| Administrative | Ashley Jensen | Assistant Executive Director |
| Administrative | Lauren Hasselman | Business Office Director |
| Marketing / Sales | Megan Hiatt | Sales Director (PHI — resident intake) |
| Marketing / Sales | Crystal Rodriguez | Sales Associate (PHI — resident intake) |
| Marketing / Sales | Tamra Matthews | Move-In Coordinator (PHI — leaving June 2026, confirmed) |
| AL Nursing | Lois Lane | Health Services Director |
| AL Nursing | Karen Rossini | Health Services Manager |
| AL Nursing | Veronica Feller | Care, AL Aide |
| Memory Care | Shelby Trozzi | Memory Care Director |
| Memory Care | Christine Nyanzunda | MC Admin Assistant |
| Resident Services | Christina DuPras | Resident Services Director |
| Life Enrichment | Susan Hicks | Life Enrichment Director |
| Life Enrichment | Alma R Montt | (title blank in CSV — follow-up) |
| Culinary | JD Martin | Culinary Director |
| Culinary | Alyssa Brooks | Dining Manager |
| Maintenance | John Trozzi | Facilities Director |
| Maintenance | Matt Brooks | MC Receptionist / Maintenance (dual-department) |
| Housekeeping | Lupe Sanchez | Housekeeping Director (aka Guadalupe Sanchez) |
Subtotal: 19 office-staff P2 licenses.
Outside=N, ALIS=Y staff (D+P, in-building only — criteria 1 may apply if they use a personal phone on-site):
| Department | Name | Notes |
|---|---|---|
| Administrative | Allison Reibschied | Accounting Assistant |
| AL Nursing / none | — | — |
| Life Enrichment | Sharon Edwards | LE Assistant (Outside=N but ALIS=Y) |
| Culinary | Ramon Castaneda | Kitchen Manager (Outside=N, ALIS=N — actually no P2 need unless we go building-only-restrict-everyone) |
Allison + Sharon are borderline — ALIS handling alone doesn't mandate P2, but if we go the "enforce building-only sign-in for anyone with ALIS access" route, they'd need P2 to carry the CA policy. Wait for the "restrict everyone or just some" decision before deciding.
Note on Britney Thompson: Previously predicted as a likely P2 candidate, absent from the 2026-04-22 CSV return. Confirmed 2026-04-22 (Howard) — still an employee; needs Desktop + possibly Phone access. Treated as Office-PHI (external-OK) clinical staff for license math until Meredith specifies a different posture. Add to purchase count.
Note on Polett Pinazavala: On the original 2026-04-18 caregiver roster, absent from the 2026-04-22 CSV return. Confirmed 2026-04-22 (Howard) — still an employee; needs Desktop + possibly Phone. Treated as Caregiver for license math (included in the caregiver rollout count, not in the office P2 count).
Shared-PC receptionists (D only, no Outside, no ALIS): Cathy Kingston, Shontiel Nunn, Kyla Quick Tiffany, Michelle Shestko — four people on shared front-desk PCs. No individual P2 needed; their story is shared-account vs individual-account, not P2.
Courtesy Patrol (D+P, no Outside, no ALIS): Sebastian Leon, Sheldon Gardfrey, Ray Rai — in-building only, no ALIS. No P2 need.
Drivers (P only): Richard Adams, Julian Crim, Christopher Holick — phone-only access. Covered by the caregiver/mobile rollout if we treat them the same, otherwise simpler F-SKU / Exchange-Online-only licensing.
Caregivers (39 rows including 2 "Reliable Agency" placeholders): covered by docs/cloud/caregiver-m365-p2-rollout.md, not this list.
Decision still open (from Howard's 2026-04-16 email to leadership)
"Do you want all staff restricted to signing in only from the building, or just certain roles/users (like front desk, kitchen, clinical)?"
No answer yet. This decision directly changes the license count and the CA policy design:
- If all staff restricted to building-only → every AD-synced user needs P2 and a matching CA policy. Larger spend.
- If only some restricted → P2 only for those users; cheaper, but requires ongoing judgment on who gets which policy.
Intersection with other rollouts
- Anti-impersonation protection (
docs/cloud/m365-impersonation-protection.md) — same top-tier users are the protected users there. Keep the lists in sync. - Business Premium upgrade (
docs/proposals/m365-premium-upgrade.md) — Business Premium bundles P2-equivalent CA features, so if we go Premium tenant-wide, standalone P2 purchases go away. Default recommendation: bundle everything into Business Premium, only buy standalone P2 if budget forces staying on Business Standard for some users. - Caregiver rollout (
docs/cloud/caregiver-m365-p2-rollout.md) — ~39 additional licenses. Combined target ~61 Premium licenses for the whole org.
Rough license math (staff side only)
| Scenario | Qty | Notes |
|---|---|---|
| Confirmed P2-needed (Outside=Y + ALIS=Y office staff from CSV) | 19 | See table above |
| + Britney Thompson (confirmed 2026-04-22, CSV-omitted, clinical PHI) | 20 | Office-PHI tier |
| Add borderline (Outside=N + ALIS=Y: Allison + Sharon) | 22 | Only if we pick "restrict-everyone-with-ALIS" posture |
| All staff (if "restrict everyone" decision) | ~32 office + 40 caregivers (incl. Polett) | Full headcount including the two CSV-omitted returnees |
Action items
Follow up with John Trozzi on the gathering — he owes us the list(received 2026-04-22 via CSV)- Push Meredith for the "restrict everyone or just some" decision — still unanswered as of 2026-04-22
- Resolve open CSV questions (see
clients/cascades-tucson/docs/cloud/cascades-staff-followup-2026-04-22.md): Kyla Quick Tiffany spelling, Ederick Yuzon spelling, Christine Nyanzunda caregiver-overlap, Alma R Montt title, Britney Thompson status - Decide: standalone P2 add-on for the 19 OR move those users to Business Premium OR move whole tenant to Business Premium (default recommendation: Premium tenant-wide)
- Build CA policy
CSC - Office Staff PHI Accessseparate from the caregiver mobile policy - Remember to REMOVE Tamra's license + CA exclusion on her departure date (June 2026 — confirmed)
Related docs
docs/cloud/m365.mddocs/cloud/m365-impersonation-protection.mddocs/cloud/caregiver-m365-p2-rollout.mddocs/proposals/m365-premium-upgrade.mddocs/security/hipaa.md