New County Onboarding: Backend Access Provisioning Process

 Important Notes

Streamline must use Tom Remisoski's tool to provision these accounts. When Streamline sets up backend access for a new county environment, they need to use Tom Remisoski's permissions tool to grant access — not a manual/ad hoc process. Permissions must match what's configured for the other CalMHSA county environments. This is called out again in both Zendesk ticket templates below.

Alert IT/CalHelp when new environments are stood up. Oasis will need to be updated to allow access to the server for both non-prod and prod environments. Notify IT/CalHelp as soon as each environment is stood up so this update isn't missed.

Scope

This process covers backend access provisioning for a new county's SmartCare environment across:

• SQL (non-prod and prod)
• SFTP
• Report Server
• OpenVPN

Key Timing Note

Not all environments are available at the same time:

• Available immediately at environment setup: Test, Train, Setup, QA (non-prod)
• Available later: Production — access must be requested as a follow-up once prod is stood up

Because of this, onboarding access happens in two phases. Don't wait on prod to request non-prod access, and don't let the prod request get lost — track it as an open follow-up item tied to the county's go-live timeline.

Standard Access Baseline (apply to every new county)

The following accounts get provisioned by default any time a new county environment is set up. Permission levels below must be replicated exactly — matching the baseline already in place for other counties.

Only will.bunin.admin and andrew.wagner.admin get full read/write in production. Everyone else is read-only in prod, read/write in non-prod (Haylea Hannah, Taylor Davis, and Vanessa Pan are read-only in both).

Reason for Access

Process Steps

Phase 1 — At Environment Setup (Non-Prod)

1. Confirm environment names for the new county (test, train, setup, QA) once Streamline has stood them up.
2. Alert IT/CalHelp that the non-prod environment is stood up so Oasis can be updated to allow server access.
3. Fill out the SCARF (SmartCare Access Request Form) using the account/permission table below and attach it to the Zendesk ticket.
4. Submit Zendesk ticket (Template 1) requesting SQL non-prod, SFTP, Report Server, and OpenVPN access for the full account list.
5. Explicitly note in the ticket that Streamline must use Tom Remisoski's tool to provision, and that permissions should mirror the existing county baseline.
6. Verify access once Streamline confirms provisioning — spot-check at least one full-access account (will.bunin.admin or andrew.wagner.admin) and one read/write non-prod account.
7. Log the prod request as a follow-up — don't close this out as done, since prod access is still pending.

Phase 2 — Once Production Is Available

1. Confirm with Streamline/internal team that the prod environment is live and ready for access provisioning.
2. Alert IT/CalHelp that the prod environment is stood up so Oasis can be updated to allow server access.
3. Fill out the SCARF for production using the account/permission table below and attach it to the Zendesk ticket.
4. Submit Zendesk ticket (Template 2) requesting SQL prod, SFTP, Report Server, and OpenVPN production access, again referencing Tom Remisoski's tool and the same permission levels.
5. Verify prod access — confirm the two admin accounts have full read/write, and spot-check that the read-only accounts are correctly restricted (not accidentally granted write).
6. Close out onboarding once both phases are confirmed complete.

Zendesk Ticket Templates

Template 1 — Non-Prod Access Request (Test/Train/Setup/QA)

Subject: New County Backend Access Setup — [County Name] — Non-Prod

Note to Streamline: Please use Tom Remisoski's tool to provision this access. Permissions must match the existing baseline used for other CalMHSA county environments.

Requesting backend access provisioning for the new [County Name] environment across the following systems: SQL (non-prod), SFTP, Report Server, and OpenVPN.

This covers the Test, Train, Setup, and QA environments only — production is not yet available and will be requested separately once it's stood up.

Accounts and permission levels:

SCARF (SmartCare Access Request Form) is attached with the full name/permission detail — see table below. Reason for access for each account is listed in the Reason for Access section above.

Please confirm once provisioning is complete. Let us know if anything is needed from our end.

SCARF — Non-Prod

Template 2 — Production Access Request (Follow-Up)

Subject: New County Backend Access Setup — [County Name] — Production

Note to Streamline: Please use Tom Remisoski's tool to provision this access. Permissions must match the existing baseline used for other CalMHSA county production environments.

Following up on the earlier non-prod access request for [County Name] (ticket #[___]). Production is now available — requesting backend access provisioning for SQL (prod), SFTP, Report Server, and OpenVPN.

Accounts and permission levels:

SCARF (SmartCare Access Request Form) is attached with the full name/permission detail — see table below. Reason for access for each account is listed in the Reason for Access section above.

Please confirm once provisioning is complete.

SCARF — Production

Quick Checklist

• Non-prod environments confirmed live (Test/Train/Setup/QA)
• IT/CalHelp alerted to update Oasis for non-prod server access
• SCARF filled out and attached (non-prod)
• Zendesk ticket #1 submitted (non-prod) with Tom Remisoski's tool noted
• Non-prod access verified
• Prod go-live confirmed
• IT/CalHelp alerted to update Oasis for prod server access
• SCARF filled out and attached (prod)
• Zendesk ticket #2 submitted (prod) with Tom Remisoski's tool noted
• Prod access verified (admin accounts R/W, others read-only)
• Onboarding closed out