Howard Enos
18e5a467d2
Cascades caregiver shared-phone bypass pilot — 2026-04-29 evening into 2026-04-30 early morning continuation. Major work: - Adopted phased per-group CA rollout (corrects original tenant-wide §5 design that would have blocked off-site office users) - Step A: backfilled admin@ into excludeUsers on all 8 existing Cascades CA policies (mirrors sysadmin@ exclusion posture; Option 1 break-glass) - Outlook + Helpany + LinkRx assigned to Cascades - Shared Phones group and added to MHS kiosk app list (final dashboard: 5 caregiver apps) - Created cloud-only pilot user pilot.test@cascadestucson.com, SG-Caregivers-Pilot group, Business Premium license, vault entry pushed to Gitea vault repo - Built 4 CA changes: PATCH legacy all-users-MFA to exclude pilot group, CREATE 3 new Report-only policies (block off-network, block non-compliant, 8h sign-in frequency) with both admins excluded - Pilot phone wipe + re-enroll after first attempt stuck; PIN set, awaiting MHS to take over launcher and SDM sign-in prompt 6 new project/feedback memories. Resume point at top of new session log. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
16 lines
1.4 KiB
Markdown
16 lines
1.4 KiB
Markdown
---
|
|
name: Cascades caregiver pilot — cleanup obligations
|
|
description: Pilot accounts (pilot.test@, howard.enos@ once synced) at Cascades must be removed at end of caregiver bypass pilot.
|
|
type: project
|
|
---
|
|
|
|
The Cascades caregiver shared-phone bypass pilot (Path B, cloud-only) is using a temporary pilot identity. Howard explicitly flagged on 2026-04-29 that **all pilot artifacts must be cleaned up** when the pilot wraps:
|
|
|
|
- **`pilot.test@cascadestucson.com`** — cloud-only test user created for the pilot. Delete (or disable + remove license) post-pilot.
|
|
- **`howard.enos@cascadestucson.com`** — Howard's eventual synced identity (won't exist as a cloud user until Entra Connect exits staging). If used during pilot validation, also clean up after.
|
|
- `SG-Caregivers-Pilot` cloud Entra group — superseded by synced `SG-Caregivers` group post-staging-exit. Remove pilot group from CA policy targets at that point; group itself can be deleted after.
|
|
|
|
**Why:** Howard explicitly flagged on 2026-04-29 that pilot accounts must not stick around — clean tenant hygiene + license recovery (Business Premium seat returned to the 34-spare pool).
|
|
|
|
**How to apply:** When the pilot validates and we transition to production rollout (synced `SG-Caregivers`), the cleanup of pilot.test, howard.enos pilot usage, and SG-Caregivers-Pilot is part of the cutover, not a separate task to forget. Surface this checklist when we get to the "flip pilot CA policies to production" step.
|