Howard Enos
18e5a467d2
Cascades caregiver shared-phone bypass pilot — 2026-04-29 evening into 2026-04-30 early morning continuation. Major work: - Adopted phased per-group CA rollout (corrects original tenant-wide §5 design that would have blocked off-site office users) - Step A: backfilled admin@ into excludeUsers on all 8 existing Cascades CA policies (mirrors sysadmin@ exclusion posture; Option 1 break-glass) - Outlook + Helpany + LinkRx assigned to Cascades - Shared Phones group and added to MHS kiosk app list (final dashboard: 5 caregiver apps) - Created cloud-only pilot user pilot.test@cascadestucson.com, SG-Caregivers-Pilot group, Business Premium license, vault entry pushed to Gitea vault repo - Built 4 CA changes: PATCH legacy all-users-MFA to exclude pilot group, CREATE 3 new Report-only policies (block off-network, block non-compliant, 8h sign-in frequency) with both admins excluded - Pilot phone wipe + re-enroll after first attempt stuck; PIN set, awaiting MHS to take over launcher and SDM sign-in prompt 6 new project/feedback memories. Resume point at top of new session log. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1.4 KiB
1.4 KiB
name, description, type
| name | description | type |
|---|---|---|
| Cascades caregiver pilot — cleanup obligations | Pilot accounts (pilot.test@, howard.enos@ once synced) at Cascades must be removed at end of caregiver bypass pilot. | project |
The Cascades caregiver shared-phone bypass pilot (Path B, cloud-only) is using a temporary pilot identity. Howard explicitly flagged on 2026-04-29 that all pilot artifacts must be cleaned up when the pilot wraps:
pilot.test@cascadestucson.com— cloud-only test user created for the pilot. Delete (or disable + remove license) post-pilot.howard.enos@cascadestucson.com— Howard's eventual synced identity (won't exist as a cloud user until Entra Connect exits staging). If used during pilot validation, also clean up after.SG-Caregivers-Pilotcloud Entra group — superseded by syncedSG-Caregiversgroup post-staging-exit. Remove pilot group from CA policy targets at that point; group itself can be deleted after.
Why: Howard explicitly flagged on 2026-04-29 that pilot accounts must not stick around — clean tenant hygiene + license recovery (Business Premium seat returned to the 34-spare pool).
How to apply: When the pilot validates and we transition to production rollout (synced SG-Caregivers), the cleanup of pilot.test, howard.enos pilot usage, and SG-Caregivers-Pilot is part of the cutover, not a separate task to forget. Surface this checklist when we get to the "flip pilot CA policies to production" step.