4.7 KiB
Cascades — Caregiver/MedTech restricted-bucket ALIS SSO worklist
Generated: 2026-06-04
Purpose: Every person in the restricted (caregiver/medtech) bucket must have their ALIS staff-record Email = their Entra UPN for SSO to resolve them. This is the per-user gate for phone (and laptop) ALIS sign-in.
Source: live SG-Caregivers membership (38) + 2 adds (Feller, Nyanzunda). Tenant 207fa277-e9d8-4eb7-ada1-1064d2221498.
How to use: in ALIS admin -> Staff -> each record, set Email to the UPN below. Then test that user's "Sign in with Microsoft" on a phone before moving to the next. Native ALIS 2FA stays off for this bucket.
Restricted device set (the only devices these users may sign in from, on-network only)
Phones (CSC-*, SDM) + Laptop2 + LAPTOP-8P7HDSEI + LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 + ASSISTNURSE-PC + NURSESTATION-PC (hybrid-join pending).
A. Clean matches — confirm ALIS Email = UPN (26)
B. ALIS name differs from UPN — verify carefully (4)
| ALIS staff name | ALIS Email (= UPN) | Done |
|---|---|---|
| Sika, Bariffa | b.sika@cascadestucson.com | [ ] |
| Esperance, Niyonsaba | e.esperance@cascadestucson.com | [ ] |
| Higdon, Jennifer | j.higdon@cascadestucson.com | [ ] |
| Huerta, Zeke (confirm first initial = E / Ezekiel) | e.huerta@cascadestucson.com | [ ] |
C. No ALIS record found — create record (Email = UPN) or confirm not a day-1 ALIS user (8)
| Name | ALIS Email (= UPN) | Note | Done |
|---|---|---|---|
| Maia Baker | m.baker@cascadestucson.com | [ ] | |
| Diana Fierros | d.fierros@cascadestucson.com | [ ] | |
| Kasey Flores | k.flores@cascadestucson.com | ALIS only has Richard Flores | [ ] |
| Mary Kariuki | m.kariuki@cascadestucson.com | [ ] | |
| Bella Mendoza | b.mendoza@cascadestucson.com | [ ] | |
| Corey Tate | c.tate@cascadestucson.com | [ ] | |
| Gloria Williford | g.williford@cascadestucson.com | [ ] | |
| Tele Lassey-Assiakoley | t.lassey-assiakoley@cascadestucson.com | ALIS has "Celia Lassey" — confirm same person | [ ] |
D. New adds to the restricted bucket (office-format UPN)
| Person | ALIS Email (= UPN) | Action | Done |
|---|---|---|---|
| Veronica Feller | veronica.feller@cascadestucson.com | add to SG-Caregivers after her device is enrolled; confirm she is on-site (inventory shows remote/PA) | [ ] |
| Christine Nyanzunda | christine.nyanzunda@cascadestucson.com | FIX directory surname typo "Nyanzuda"->"Nyanzunda" first; uses ASSISTNURSE-PC | [ ] |
E. Pending classification (ALIS caregiver/medtech role, not yet bucketed)
Decide inside (restricted) or outside (privileged): Judith Palmer, Patricia Sandoval-Beck, Joey Ty, Alejandra Vallejo, Celia Lassey.
Prerequisites already done
- Tenant-wide admin consent for ALIS app (2026-06-03) — SSO works for everyone matched.
- Native ALIS 2FA off for caregivers/medtechs (blanket).
- CA: off-network block + compliance block enforced on SG-Caregivers; allow-list policy staged (report-only).
After the sweep
- Enroll/tag remaining devices (LAPTOP-8P7HDSEI + ASSISTNURSE-PC after Win11 25H2; NURSESTATION-PC via hybrid join).
- Cutover: enable allow-list policy + disable
CSC - Block caregivers on non-compliant device. - Add Feller + Nyanzunda to SG-Caregivers (after their device enrolled).
- Reclaim devices@ Business Premium seat.