azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
da6567ffe07ed3fc6ad3bd52e5a7635d1b962886
claudetools/clients/cascades-tucson/session-logs/2026-06-04-howard-caregiver-laptop-enrollment.md
Howard Enos f4da4a56c4 sync: auto-sync from HOWARD-HOME at 2026-06-04 21:22:05 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-04 21:22:05
2026-06-04 21:22:16 -07:00

11 KiB
Raw Blame History

Cascades — Caregiver laptop Intune enrollment prep (devices@ licensed)

Date: 2026-06-04 Client: Cascades of Tucson (Syncro 20149445, Tenant 207fa277-e9d8-4eb7-ada1-1064d2221498)

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Resumed the caregiver device allow-list rollout (continued from 2026-06-03-session.md). The plan: Entra-join the 4 caregiver/medtech laptops so they exist as Entra device objects, then tag them onto the report-only allow-list CA policy created 2026-06-03.

Prepared the enrollment account. The dedicated provisioning account devices@cascadestucson.com (Cloud Device Administrator) was unlicensed, which would let a device Entra-join but skip Intune auto-enrollment. Set its usageLocation to US and assigned a Microsoft 365 Business Premium (SPB) license via the User Manager app so auto-MDM-enroll fires on join. The license is needed only transiently at enrollment time and can be reclaimed after the batch.

Provided Howard the start-to-finish enrollment runbook: confirm Intune MDM user scope = All (portal), Entra-join each laptop with devices@, verify it lands in Intune, then report device names back for tagging (extensionAttribute1=CSCCaregiverDevice). Recommended doing one laptop end-to-end first to validate the flow before the rest. NURSESTATION-PC remains the separate Hybrid Entra Join track.

No laptops were enrolled this session — enrollment is the next hands-on step for Howard. No repo changes beyond this log; the license assignment was a live Entra change.

Key Decisions

  • Assigned Business Premium to devices@ rather than to a user account, keeping a dedicated provisioning identity for device joins; the seat is reclaimable post-enrollment.
  • Set usageLocation=US on devices@ (required before any license can be assigned).

Problems Encountered

  • First license-assignment attempt failed (HTTP 404, "Resource '197609' does not exist"). Cause: UID is a read-only special variable in bash, so UID=<guid> silently failed and $UID resolved to the shell's numeric user id. Resolved by renaming the variable (DEVID).
  • Immediate license read-back showed Business Premium=false right after a 200 assignLicense — Entra eventual consistency. Confirmed assigned on re-read after a short delay.

Configuration Changes

  • Live Entra change (no repo files): devices@cascadestucson.com — set usageLocation=US; assigned license SPB (cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46) via Graph POST /users/{id}/assignLicense (User Manager tier). Verified present.
  • Session log created (this file).

Credentials & Secrets

  • devices@cascadestucson.com / Gptf*77ttb! — Cloud Device Administrator, user ID aaca80c6-861b-4294-8068-1033c68d7667. Now licensed Business Premium + usageLocation US. Vault: clients/cascades-tucson/devices-account.sops.yaml. Use this account to Entra-join the laptops. Reclaim the Business Premium seat after the enrollment batch.

Infrastructure & Servers

  • Tenant 207fa277-e9d8-4eb7-ada1-1064d2221498.
  • SKU: Business Premium (SPB) cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46.
  • Report-only allow-list policy (from 2026-06-03): CSC - Caregivers: allow-listed devices only (REPORT-ONLY) id 1b7fd025-1aad-47c8-9274-c32c3e0b163c; device filter excludes (displayName -startsWith "CSC-") -or (extensionAttribute1 -eq "CSCCaregiverDevice").
  • Target laptops (Entra join): Laptop2, LAPTOP-8P7HDSEI (Win10 — upgrade), LAPTOP-DRQ5L558, LAPTOP-E0STJJE8. NURSESTATION-PC = Hybrid join track (stale 2021 Entra record to clean).

Commands & Outputs

# Set usageLocation then assign Business Premium (note: do NOT use $UID as a var name in bash)
DEVID=aaca80c6-861b-4294-8068-1033c68d7667
SPB=cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46
TOK=$(bash scripts/get-token.sh $TEN user-manager)
curl -s -X PATCH ... -d '{"usageLocation":"US"}' .../users/$DEVID            # HTTP 204
curl -s -X POST ... -d '{"addLicenses":[{"skuId":"'$SPB'"}],"removeLicenses":[]}' \
  .../users/$DEVID/assignLicense                                             # HTTP 200
# Verify: assignedLicenses includes cbdc14ab-... (after ~6s, eventual consistency)

Pending / Incomplete Tasks

  • Confirm Intune MDM user scope = All (Entra -> Devices -> Mobility (MDM and MAM) -> Microsoft Intune) — not verifiable via API.
  • Entra-join the 4 laptops with devices@ (do one first, validate end-to-end).
  • Report device names -> tag each extensionAttribute1=CSCCaregiverDevice.
  • Confirm which printer(s) each laptop needs -> Intune printer push (FrontDesk Epson ET-5800 192.168.2.147; CopyRoom Canon C478iF 192.168.2.230; MCReception Epson ET-5800).
  • Confirm whether any laptop needs on-prem file shares (would push that one to hybrid).
  • NURSESTATION-PC Hybrid Entra Join (Entra Connect device options on CS-SERVER); clean stale 2021 record.
  • Review report-only sign-in results, then cutover: enable allow-list policy + disable CSC - Block caregivers on non-compliant device.
  • Reclaim Business Premium seat from devices@ after enrollment batch.
  • LAPTOP-8P7HDSEI: upgrade Win10 -> Win11 before PHI use.

Reference Information

  • Prior context: clients/cascades-tucson/session-logs/2026-06-03-session.md (admin consent + allow-list policy + join-model decisions).
  • Allow-list policy id 1b7fd025-1aad-47c8-9274-c32c3e0b163c; ALIS admin-consent grant id reTK4etbykSC1ENMm9g1rTplOyzgVClCofKDVRrn-ds.
  • Tickets: #110680053 (domain migration), #109412123 (Entra setup).

Update: 21:20 MST — device tagging, roster classifications, ALIS worklist, app shortcuts

Continued the caregiver device rollout and finalized the restricted vs privileged user split for go-live (caregivers using phones start of next week).

Devices

  • 3 of 5 laptops Entra-joined (workgroup -> AzureAd) and tagged extensionAttribute1=CSCCaregiverDevice: Laptop2 (3ade4bd4-527f-468a-b06b-b1fa304941c8), LAPTOP-DRQ5L558 (eb5f6b98-0077-4c35-b029-ee6f9ada0eef), LAPTOP-E0STJJE8 (4b5ee995-964c-4efc-8960-f1a2a7d6257d). All Win11 26200.
  • Remaining 2 pending Win11 25H2 upgrade then join+tag: LAPTOP-8P7HDSEI, ASSISTNURSE-PC (both were Win10 19045). User upgraded 3 machines Home->Pro; 2 still need 25H2.
  • All 3 joined laptops show isManaged=null — auto-MDM-enroll did NOT fire (MDM user scope likely not = All, and devices were only logged into with local accounts so the enroll retry has no Entra user context). DECISION: defer Intune/MDM decision until all devices are on Win11 25H2. Intune is OPTIONAL — the allow-list is tag-based and works on Entra-join alone; Intune only needed for printer-push / Windows compliance policy.
  • NURSESTATION-PC confirmed as a permanent caregiver/medtech device. It is domain-joined, so it needs Hybrid Entra Join (Entra Connect device-options config on CS-SERVER) before it can be tagged — the only device on the hybrid track. Full caregiver device set = phones + Laptop2 + LAPTOP-8P7HDSEI + LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 + ASSISTNURSE-PC + NURSESTATION-PC (6 machines + phones).

User-to-computer map (resolved a prior gap)

Built the Cascades user<->computer map. Authoritative source = Syncro kabuto_information.last_user (GuruRMM does not expose logged-in user). Key mappings: DuPras=ALASSIST-PC, Lois Lane=DESKTOP-KQSL232, Karen Rossini=DESKTOP-LPOPV30, shared medtech=ASSISTNURSE-PC (mc medtechs and care), shared MemCare reception=MEMRECEPT-PC, the 4 caregiver laptops show generic \User. CONTEXT.md GuruRMM roster is stale (27->32 agents) — refresh pending.

Classifications (restricted = inside-only / SG-Caregivers; privileged = outside access)

  • Privileged/outside (NOT in SG-Caregivers; ALIS via SSO + offsite MFA): Lois Lane, Karen Rossini (done), Christina DuPras. Nurses ruled OUTSIDE per user. All have Entra accounts.
  • Restricted/inside: the 38 SG-Caregivers + Veronica Feller (caretaker, moving depts later; inventory shows her remote/PA — confirm on-site before locking) + Christine Nyanzunda (MC admin asst + PT medtech; uses ASSISTNURSE-PC). Nyanzunda has an M365 account but with a directory surname typo "Nyanzuda" to fix; her UPN christine.nyanzunda@cascadestucson.com.
  • Zachary Nelson removed from caregiver consideration — accounting, no ALIS (his ALIS "Caregiver" role is noise).
  • Still pending classification: Judith Palmer, Patricia Sandoval-Beck, Joey Ty, Alejandra Vallejo, Celia Lassey.
  • MEMRECEPT-PC excluded from the caregiver allow-list (receptionist-only; user verifying). Outside users access from home/personal devices — managed laptops/desktops stay onsite, so no device management needed for privileged outside access.

Phasing decision

Per-user go-live gate = ALIS email-match + a test sign-in, done one caregiver at a time as the ALIS sweep proceeds. The CA restriction is already applied to all 38 (in SG-Caregivers, policies enabled). The allow-list cutover is LOW-RISK and can be all-at-once: verified there is no gap (only CSC- phones are compliant today, and the allow-list also permits them), so flipping the allow-list ADDS laptop access without removing phone access — nobody on a phone gets locked out.

Deliverable: caregiver ALIS email-match worklist

Wrote clients/cascades-tucson/reports/2026-06-04-caregiver-alis-sso-worklist.md — 40 restricted users (38 + Feller + Nyanzunda) with required ALIS Email = UPN, grouped: 26 clean matches, 4 name-variants (Sika/Esperance/Higdon/Huerta), 8 with no ALIS record, 2 new adds.

App shortcuts (in progress)

Built a PowerShell script to drop ALIS/LinkRx/HelpAny shortcuts on the Public Desktop, launched in Edge --app mode (kiosk-like, preserves SSO device-claim). URLs: ALIS https://cascadestucson.alisonline.com, LinkRx https://pharmcare.linkrxnow.com/, HelpAny https://app.safe-living.com/login. Intune web-link apps only store the Managed Google Play wrapper URL, so the real LinkRx/HelpAny URLs came from the user. Deployment via GuruRMM offered (awaiting go-ahead); targets are the 6 caregiver machines.

Username-only login question

Answered: Entra/Microsoft sign-in (and ALIS SSO) REQUIRES the full UPN — no tenant setting allows a bare username for cloud accounts. Reduce typing instead via Windows Hello PIN on the laptops + silent ALIS SSO once signed in, and pursue ALIS Login PINs (Medtelligent limited-release). NURSESTATION-PC (domain-joined) Windows login can be short, but ALIS SSO behind it still uses the full UPN.

Pending (this update)

  • Finish Win11 25H2 on LAPTOP-8P7HDSEI + ASSISTNURSE-PC -> Entra-join -> tag.
  • NURSESTATION-PC Hybrid Entra Join.
  • ALIS email-match sweep (worklist file) — the day-1 gate for phones.
  • Deploy app-shortcut script via GuruRMM to the 6 caregiver machines (awaiting go-ahead).
  • Classify last 5 straddlers; confirm Feller on-site; fix Nyanzunda surname typo.
  • Add Feller + Nyanzunda to SG-Caregivers after their devices ready.
  • Cutover (enable allow-list + disable compliance block); reclaim devices@ license.
  • Windows Hello PIN plan for laptops; ALIS Login PINs support ask.
Reference in New Issue View Git Blame Copy Permalink