This register lists the decisions behind the workbook, from the repository’s first pull request on, one entry each. Each entry gives the question, the options that were considered, the choice, the reason for it, its basis, its sources and the pages it shaped. The Reviewers’ Guide explains how to check an entry and how to tell us you agree or disagree with it. Use the entry’s ID when you do.
Each decision
WD-001: Should material about the original source system stay on the public site?
| Options considered |
Keep it published; Take it off the site and neutralize names, hosts and paths |
| Choice |
Source-system runbooks, specs and security-package stubs come off the site. Branding, internal host names and personal paths are replaced with neutral placeholders such as example.internal. |
| Rationale |
The folders describe the source system itself, not a modernization project, and the security-package pages were empty stubs. A neutral template set can be written later. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
CONTRIBUTING.md, How This Workbook Knows What It Says |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#7, #8 |
Agree, disagree or send evidence on WD-001
WD-002: How are Word downloads produced?
| Options considered |
Commit hand-built DOCX files; Convert rendered pages back to Markdown and join them; Build every bundle from the source Markdown with one manifest-driven builder |
| Choice |
No DOCX files are committed. One builder reads an ordered manifest, fails on a missing page or image, and fills the table of contents so it shows when the file opens in Protected View. |
| Rationale |
The convert-back pipeline produced chopped text and broken figures, and committed copies duplicated what CI builds (about 51 MB removed). An empty table of contents never updates in Protected View. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/build_bundles.py, scripts/bundle-filter.lua, Downloads |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#9, #10, #12, #16, #44 |
Agree, disagree or send evidence on WD-002
WD-003: Should the earlier organizational-attribute model (OrgPath, LocPath) and the governance-suite content stay in the workbook?
| Options considered |
Keep and rename the concept; Delete pages that are mainly about it and reword the rest with generic terms |
| Choice |
Pages mainly about the model are deleted. Elsewhere only the affected sections are cut and reworded as plain attributes and dynamic groups. No replacement concept is invented. |
| Rationale |
Stated as a change of plan. The PRs give the rule for deciding (delete pages that are mainly about it, cut sections elsewhere) but not a deeper reason. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Workbook Books, HR-Driven Identity |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#11, #13, #15, #25 |
Agree, disagree or send evidence on WD-003
WD-004: Which cloud environments and platforms does each guidance set claim to cover?
| Options considered |
Claim general coverage; State scope up front and list what is out of scope with fallbacks |
| Choice |
Each series gets an Applicability page stamped with a date. Commercial cloud including GCC-Moderate is in scope. GCC High, DoD, air-gapped networks and some platform configurations are out of scope as written, each with what still applies. |
| Rationale |
Several features differ by cloud, for example GCC-Moderate uses the worldwide Graph endpoint and Arc SQL in Azure Government lacks Entra authentication. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Microsoft Graph national cloud deployments; Microsoft Learn, SQL Server enabled by Azure Arc overview |
| Pages affected |
Appendix B — Applicability, Data Platform: SQL Server Identity, DNS, DHCP and IPAM |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#17, #21, #23, #35, #40, #61 |
Agree, disagree or send evidence on WD-004
WD-006: How are figures produced?
| Options considered |
Keep the AI-generated or dark-themed rasters; Redraw from text sources in one house style |
| Choice |
Figures are drawn from YAML sources by one shared renderer on a white background, at most 800 px wide, each with a caption and alt text. Word bundles embed the PNG versions. |
| Rationale |
The old rasters had unreadable text, vendor logos and factual errors such as wrong dates and labels. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
docs/images/diagrams/README.md, scripts/diagrams/render.py |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#18, #29, #32, #35, #37 |
Agree, disagree or send evidence on WD-006
WD-009: Does the workbook pick a platform vendor in its platform-selection chapters?
| Options considered |
Give a verdict per vendor; Give a decision framework with the evidence to request |
| Choice |
Platform selection is a set of dimensions (for example migration effort, HA/DR fit, licensing exposure, switching cost), each paired with the evidence to ask for. The stated goal is fewer authoritative platforms, not one vendor. |
| Rationale |
The earlier tables mixed non-equivalent cells such as Low/High cost ratings and unsupported claims, so they were removed. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Data Platform: SQL Server Identity, DNS, DHCP and IPAM |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#24, #41, #65 |
Agree, disagree or send evidence on WD-009
WD-010: How do chapters describe the order of migration work?
| Options considered |
Each chapter describes its own order; One canonical dependency chain used in every chapter |
| Choice |
Each series states one chain (for example Inventory, Rationalize, Audit, Enable substrate, Introduce principals, Move applications, Remove legacy, Enforce retirement, Prove steady state). Chapters mark their place on it, and the arrows are dependencies, not a calendar. |
| Rationale |
Pass 3 was about architecture consistency across chapters. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Transformation Arc, DNS, DHCP and IPAM |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#24, #28, #41 |
Agree, disagree or send evidence on WD-010
WD-011: How long are the closing takeaway lists?
| Options considered |
Open-ended lists; Exactly three numbered claims per chapter |
| Choice |
Each chapter closes with at most three numbered claims. Overclaims found while rewriting were removed. |
| Rationale |
Stated as part of the consistency pass; no further reason given. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Transformation Arc, DNS, DHCP and IPAM |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#24, #28, #41 |
Agree, disagree or send evidence on WD-011
WD-012: What happens to a page that is merged, replaced or deprecated?
| Options considered |
Delete it; Keep it with a deprecation banner; Archive the source and redirect the old address |
| Choice |
Duplicates are removed with a forwarding page at each old address. Replaced source pages move to an archive folder that is not built, with a README mapping old pages to new chapters. A page that must stay live gets a Deprecated banner and leaves navigation and search. |
| Rationale |
Old links keep working and nothing is cut without a trace. The architecture landing page was kept with its body intact because content is not cut. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/redirects.yml, Identity and Directory, PKI and Certificates |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#25, #54, #56, #58 |
Agree, disagree or send evidence on WD-012
WD-013: How are the long series shortened?
| Options considered |
Leave them as drafted; Cut repetition but keep every cited claim |
| Choice |
Repeated explanations are replaced with short ‘Established in’ callouts. Cuts of roughly 17 to 18 percent were made while all footnoted claims, tables and key callouts stayed. |
| Rationale |
Not stated beyond the word counts. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Transformation Arc, Data Platform: SQL Server Identity |
| Date |
2026-10-18 |
| Status |
settled |
| Defined in |
#31, #36 |
Agree, disagree or send evidence on WD-013
WD-014: How does the workbook describe Microsoft’s position on on-premises Active Directory?
| Options considered |
AD DS is being deprecated or retired by Microsoft; AD DS is supported; cloud-first guidance makes retirement an agency decision |
| Choice |
No page says Microsoft is deprecating or forcing a move off AD DS. Pages say AD DS is supported in Windows Server 2025 and that retiring it is an agency decision driven by cloud-first investment, NTLM deprecation and protocol hardening. |
| Rationale |
AD DS is supported in Windows Server 2025, which added new functional levels. The argument is kept where it rests on real drivers. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, What’s new in Windows Server 2025 |
| Pages affected |
The Transformation Arc, Identity and Directory, DNS, DHCP and IPAM |
| Date |
2026-10-19 |
| Status |
settled |
| Defined in |
#23, #26, #39, #75 |
Agree, disagree or send evidence on WD-014
WD-015: In what order does a leaver’s access end?
| Options considered |
Disable and clean up in one pass; Block first, then revoke, reconcile and dispose |
| Choice |
Disable the account, revoke sessions, then revoke PIV, device and access in parallel, reconcile, then dispose. Privileged leavers get their own block path. Revoking sessions stops new tokens only; issued tokens last until they expire. |
| Rationale |
Not stated in the PRs beyond the ordering and the token-lifetime correction. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, Revoke user access in Microsoft Entra ID; Microsoft Learn, Lifecycle Workflows tasks and definitions |
| Pages affected |
Chapter 08 — Joiner, Mover, Leaver, Appendix A — Lifecycle Rules |
| Date |
2026-10-19 |
| Status |
settled |
| Defined in |
#33, #43, #58 |
Agree, disagree or send evidence on WD-015
WD-016: Which attribute anchors a person across systems?
| Options considered |
employeeId is the immutable anchor; A layered identifier model with an explicit enterprise identifier decision |
| Choice |
Identity uses layers: enterprise person, source, affiliation, directory and credential keys. The enterprise key is an explicit decision, and an existing enterprise ID is reused where one exists. |
| Rationale |
Stated as replacing the single-anchor claim with a layered model. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 06 — The Canonical Workforce Identity Model, HR-Driven Identity |
| Date |
2026-10-19 |
| Status |
settled |
| Defined in |
#43, #49, #53 |
Agree, disagree or send evidence on WD-016
WD-018: How are statements of different certainty shown?
| Options considered |
Write all statements as fact; Label each as verified, observation, proposal or assumption |
| Choice |
Claims in decks and the HR-driven identity book are labelled as verified public information, an observation, a proposal, or a planning assumption to validate with the data owners. Numeric gates are called proposed starting criteria. |
| Rationale |
Not stated beyond the review passes that applied the labels. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity, Appendix C — Acceptance and Cutover |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#43, #62, #64, #66 |
Agree, disagree or send evidence on WD-018
WD-019: Where does contractor identity data come from?
| Options considered |
Pull from several sources and merge; Give each contractor fact one authority |
| Choice |
Each contractor fact has one source. Access ends at the earliest of contract end, suitability withdrawn, PIV revoked, sponsor leaving or a missed recertification. A suitability register becomes an authority only after six questions are settled with its owner, starting with read-only reconciliation. |
| Rationale |
Contractors are not covered by the federal HR system, so their sources must be named explicitly. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity, Chapter 04 — Attribute Authority |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#45, #53, #55 |
Agree, disagree or send evidence on WD-019
WD-020: Does the public repository carry agency-specific material?
| Options considered |
Publish an agency-specific edition and an agency-neutral edition; Publish only the agency-neutral edition |
| Choice |
Public pages and decks never name an agency. Agency-specific decks, drafts and build kits were removed and kept in a private repository. Examples are generic, such as a ‘Mainframe PIN’ standing in for an enterprise ID. |
| Rationale |
The public bundle stays agency-agnostic. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
CONTRIBUTING.md, Presentations, HR-Driven Identity |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#49, #52, #58 |
Agree, disagree or send evidence on WD-020
WD-021: Should the interview presentation set ship an agency-specific edition beside the neutral one?
| Options considered |
Both editions in the public repository |
| Choice |
Both editions were added together (status quo at the time). |
| Rationale |
The PR called the agency-specific edition the internal interview version. It was removed the next day. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-20 |
| Status |
superseded |
| Defined in |
#51 |
| Superseded by |
WD-020: Does the public repository carry agency-specific material? |
Agree, disagree or send evidence on WD-021
WD-022: How are book chapters verified before they publish?
| Options considered |
Trust the source pages; Re-check every external claim and keep a record |
| Choice |
Every external claim is re-checked against Microsoft Learn or a primary federal source on a stated date and footnoted. Each chapter keeps a claims log and a carry-forward ledger in a _verification folder. Wrong claims in the source pages are corrected, not carried forward. |
| Rationale |
The PRs list many corrections found this way, for example a deadline that did not exist and tools that do not exist. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
How This Workbook Knows What It Says, Access and Privilege, Devices and Endpoints |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#56, #58, #59, #60, #61, #63, #65, #71, #75 |
Agree, disagree or send evidence on WD-022
WD-023: How are topic pages organized into books?
| Options considered |
Keep separate guides and whitepapers; Consolidate each topic into one ordered book |
| Choice |
Each book answers one question and follows Why, What, Who, How, then appendices. Most books get a new Who chapter on ownership and decision rights. Source pages are archived and replaced by chapters. |
| Rationale |
Not stated in the PRs beyond the plan for an 18-book workbook; the books index holds the plan. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Workbook Books, Identity and Directory, Network and Transport, Orientation and Program |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#56, #58, #59, #60, #61, #63, #65, #71, #75, #79, #80, #85 |
Agree, disagree or send evidence on WD-023
WD-025: Do the books reproduce the earlier PowerShell assessment modules?
| Options considered |
Reproduce them in the book; Keep them in the archive until a technical review |
| Choice |
Chapters are written governance-only or as detect-and-fix checklists. Read-only enumeration and AD CS assessment modules stay in the archive until they have had a technical review. |
| Rationale |
Pending technical review. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 07 — Read-Only Discovery, Chapter 03 — Hardening What Stays |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#56, #63 |
Agree, disagree or send evidence on WD-025
WD-027: Is there an external deadline that drives NTLM retirement in 2027?
| Options considered |
Cite a federal notice with an NTLM deadline; Treat 2027-04-01 as the program’s own backstop |
| Choice |
The books say no external NTLM deadline exists. The date 2027-04-01 is the program’s own backstop. The real 2027 dates are product support dates. |
| Rationale |
The cited federal notice does not exist. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Data Platform: SQL Server Identity, Devices and Endpoints |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#60, #61 |
Agree, disagree or send evidence on WD-027
WD-029: How many certificate-lifecycle platforms does the PKI book recommend?
| Options considered |
Add a second lifecycle vendor; One lifecycle platform |
| Choice |
One vendor platform is the single lifecycle platform. No second certificate-lifecycle vendor is added. |
| Rationale |
Not stated in the PR. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
PKI and Certificates, Appendix C — Anatomy of the CLM Platform |
| Date |
2026-10-20 |
| Status |
settled |
| Defined in |
#63 |
Agree, disagree or send evidence on WD-029
WD-030: How does the site present its standing relative to the government?
| Options considered |
No statement; A disclaimer on every page and every Word edition |
| Choice |
The site is named the Federal Modernization Workbook. A banner on every page, the footer and each Word title page say it is not an official federal publication and is independent technical analysis. |
| Rationale |
Not stated in the PR beyond the wording of the disclaimer. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Workbook Books, Presentations |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#5, #68, #69, #85 |
Agree, disagree or send evidence on WD-030
WD-031: What does the public site publish while the books are still being built?
| Options considered |
Publish every page; Publish only finished books, Presentations, site map and 404 |
| Choice |
Only completed books plus a Presentations page and a new home page are rendered. Everything else stays in the repository, unpublished, until the book that absorbs it exists. |
| Rationale |
Not stated in the PR. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
The Workbook Books, Presentations |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#67 |
Agree, disagree or send evidence on WD-031
WD-032: Which logging requirement do the books cite?
| Options considered |
OMB M-21-31 tiers and retention table; OMB M-26-14 requirements |
| Choice |
Books cite M-26-14 (May 22, 2026), which rescinded M-21-31. Tier and retention claims the new memo does not make were removed. Logs must be searchable for 6 months and retrievable for 1 year. |
| Rationale |
M-26-14 rescinded M-21-31 effective immediately, and the books still presented the old tiers as current. |
| Basis |
External requirement |
| Sources |
OMB, M-26-14 agency logging and network visibility; OMB, M-21-31 investigative and remediation capabilities |
| Pages affected |
DNS, DHCP and IPAM, Network and Transport, Identity and Directory |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#70, #71, #75 |
Agree, disagree or send evidence on WD-032
WD-033: What accessibility standard do presentations meet?
| Options considered |
No stated standard; Section 508 and WCAG 2.1 AA with captions on every narrated deck |
| Choice |
All decks pass an automated accessibility check run on every build (alt text, table headers, reading order, contrast, language). Narrated decks carry embedded closed captions plus a separate caption file. |
| Rationale |
Stated target: Section 508 and WCAG 2.1 AA. |
| Basis |
External requirement |
| Sources |
GSA, Section508.gov; W3C, Web Content Accessibility Guidelines 2.1 |
| Pages affected |
Presentations |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#74, #81 |
Agree, disagree or send evidence on WD-033
WD-034: Which book defines what each extensionAttribute slot holds?
| Options considered |
Each book defines its own use; One program-wide map; other books match or link it |
| Choice |
The HR-driven identity book carries the single map for users and devices. All other books, scripts and device filters match it. No slot has two meanings. |
| Rationale |
The books disagreed; for example slot 10 was account type in two books and organization code in another. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 06 — The Canonical Workforce Identity Model, Access and Privilege |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#76 |
Agree, disagree or send evidence on WD-034
WD-035: How do book pages look and how is contrast handled?
| Options considered |
Default theme; One house theme with link and label colors darkened to 4.5:1 |
| Choice |
All book pages, the books index and Presentations share one theme. Link and small-label colors are darkened to meet WCAG AA 4.5:1 contrast. The duplicate title heading is replaced by a hero header. |
| Rationale |
Not stated beyond the contrast target. |
| Basis |
External requirement |
| Sources |
W3C, Web Content Accessibility Guidelines 2.1 |
| Pages affected |
The Workbook Books, Presentations |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#82 |
Agree, disagree or send evidence on WD-035
WD-036: How should citations appear in the Word editions?
| Options considered |
Word footnotes; Chapter endnotes in a Notes section |
| Choice |
Each chapter ends with a numbered Notes section, references are linked superscripts, and a source cited twice in a chapter is listed once. The web pages get a Notes heading. |
| Rationale |
Not stated beyond the change itself; the PR says it moves footnotes to endnotes and shortens the bundles. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/bundle-filter.lua, The Workbook Books |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#83 |
Agree, disagree or send evidence on WD-036
WD-037: Where does a topic that fits no numbered book live?
| Options considered |
A standalone companion guide outside the numbered books; Inside the closest numbered book (People) |
| Choice |
A standalone companion guide with its own Books-index section, which can move into the People book later |
| Rationale |
The meetings guide is not tied to one book. The PR says it can move later. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Effective Meetings — Purpose, Agenda, Roles, and Follow-Through, The Workbook Books |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#86 |
Agree, disagree or send evidence on WD-037
WD-038: How is an outside critique or a cross-chapter conflict turned into a fix?
| Options considered |
Accept the critique as written; Check each claim against primary sources and apply only the fixes that hold up |
| Choice |
Each claim is checked on its own. Every factual change is researched independently and endnoted. Wording-only changes are logged as such in the chapter’s verification file. |
| Rationale |
In round 1, 137 critique claims were checked. 36 were wrong and 47 were already addressed, so only the verified fixes were applied. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
How This Workbook Knows What It Says, Orientation and Program |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#87, #89, #106 |
Agree, disagree or send evidence on WD-038
WD-039: How does the workbook describe its own authority?
| Options considered |
Present the program as federal policy; Say up front that it is guidance, not federal policy |
| Choice |
The orientation and arc books state early that the workbook is guidance, not federal policy |
| Rationale |
Added after the external critique was checked claim by claim. No further reason is given in the PR. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 02 — How to Use This Workbook, The Transformation Arc |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#87 |
Agree, disagree or send evidence on WD-039
WD-040: When two chapters give different cadences or approvers for the same control, which wins?
| Options considered |
Leave each chapter as written; Pick one cadence and one owner and align every chapter |
| Choice |
One answer everywhere. Contingency testing is a first-year tabletop, then an annual functional exercise with a restore. The CISO owns the supply chain strategy and the CIO approves the charter. The service desk verifies but never approves MFA or password resets. |
| Rationale |
The deck reviews found chapters that conflicted. Each was resolved to match the owner matrix in the book’s governance chapter. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 06 — Contingency Planning and Business Continuity, Chapter 03 — Intake, Triage and Routing, Chapter 10 — Who Owns Compliance |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#87, #99, #101, #103 |
Agree, disagree or send evidence on WD-040
WD-041: What does the narrator read on each slide?
| Options considered |
The full speaker notes; A short spoken part that conveys the slide’s intent |
| Choice |
Early decks voiced the speaker notes. |
| Rationale |
Replaced once the intent-first style was approved on a pilot. The PR does not frame it as a separate choice. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-21 |
| Status |
superseded |
| Defined in |
#90 |
| Superseded by |
WD-053: What does the narrator say on each slide? |
Agree, disagree or send evidence on WD-041
WD-042: What happens to the working source pages once a book is written?
| Options considered |
Keep them live beside the book; Archive them and redirect the old URLs to the book |
| Choice |
Source pages and images used for a book are archived, with redirects to the new chapter |
| Rationale |
Not stated in the PR. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Archive, Security Operations and Telemetry |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#91, #102, #104 |
Agree, disagree or send evidence on WD-042
WD-043: Which remediation clock binds an agency: the FedRAMP timeframes or the CISA directive?
| Options considered |
FedRAMP remediation timeframes; BOD 26-04 for the agency; FedRAMP timeframes bind providers |
| Choice |
The agency’s clock is BOD 26-04. FedRAMP timeframes and KSIs bind cloud providers, not agencies. Where an external clock is shorter or different in kind, it governs. |
| Rationale |
Found when each book’s claims were checked against primary sources. BOD 26-04 revoked BOD 22-01 and 19-02. |
| Basis |
External requirement |
| Sources |
CISA, BOD 26-04 prioritizing security updates by risk; CISA, BOD 26-04 implementation guidance; FedRAMP, NTC-0014 response to BOD 26-04 |
| Pages affected |
Chapter 06 — Vulnerability Management, Chapter 02 — Day Two Is Where Compliance Lives or Dies, Chapter 10 — Operational Tempo: Ticket to Machine, Not Ticket to Human |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#91, #96, #97, #100 |
Agree, disagree or send evidence on WD-043
WD-044: How does the workbook find out that a cited source has changed?
| Options considered |
Manual re-checks by the editor; A weekly automated watcher over every cited URL and federal feeds |
| Choice |
A weekly workflow compares every cited source (Learn pages by ms.date, other HTML by text, PDFs by hash) and watches federal feeds. It opens one grouped issue only when something changed. |
| Rationale |
Not stated in the PR beyond the design. The book endnotes cite 1,766 unique sources, too many to re-check by hand. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/source_watch/README.md, .github/workflows/source-watch.yml, How This Workbook Knows What It Says |
| Date |
2026-10-21 |
| Status |
settled |
| Defined in |
#92, #95, #161 |
Agree, disagree or send evidence on WD-044
WD-046: Who turns off an orphaned AI agent identity, and who sponsors one?
| Options considered |
Automatic turn off on detection; A person turns off it once the orphan is confirmed |
| Choice |
A person turns off the agent after confirmation. A sponsor must be an agency employee, and a contractor may be the technical owner. Retiring one agent is the sponsor’s decision and retiring a whole system is the system owner’s. No production access before an authorization covers it. |
| Rationale |
Aligned the lifecycle chapter, the deck and the ownership matrix after the deck review. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 05 — Owners, Sponsors and the AI Identity Lifecycle, Chapter 08 — Who Owns AI Identity Governance |
| Date |
2026-10-22 |
| Status |
settled |
| Defined in |
#105 |
Agree, disagree or send evidence on WD-046
WD-048: Where does material go that is not yet reviewed enough to join the books?
| Options considered |
Straight into the books; A separate Research area with visible review status |
| Choice |
A Research area labeled on every page. Statuses are Draft, In review, Proved and Published. Types are explainer, product deep dive and implementation guide. Research stays out of the book tables, metrics and Word bundles. |
| Rationale |
Items are published for review before they join the books. Each page states it is not part of the books and not endorsed by any agency. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Research has moved |
| Date |
2026-10-22 |
| Status |
superseded |
| Defined in |
#107, #109 |
| Superseded by |
WD-103: How should the workbook’s pages be organized as the number of guides, labs and evaluations grows? |
Agree, disagree or send evidence on WD-048
WD-049: How often does the narration name the workbook?
| Options considered |
On the first book reference of every slide; Once per deck |
| Choice |
The first book reference on each slide was voiced with the workbook’s full name. |
| Rationale |
Reversed the next day when narration was rewritten. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-22 |
| Status |
superseded |
| Defined in |
#110 |
| Superseded by |
WD-054: How often does the narration name the workbook? |
Agree, disagree or send evidence on WD-049
WD-051: How do wide tables and diagrams appear in Word and web editions?
| Options considered |
Leave wide tables to overflow; Balance columns, switch to landscape, use 10 pt table text, and carry diagrams as vectors |
| Choice |
Wide or crowded tables go landscape automatically with a 10 pt table style. Diagrams are embedded as SVG with a PNG fallback. Phones get tables as labelled cards. Every Word edition gets a chapter header and a page-numbered footer. The site builds no PDF; browser print is the PDF route. |
| Rationale |
The PR reports the PKI bundle fell from 171 to 162 pages and landscape pages from 23 to 16, with no mid-word breaks. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
assets/landscape.lua, assets/fmw-theme.scss, Downloads |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#113, #116, #118, #119 |
Agree, disagree or send evidence on WD-051
WD-052: How are certificates handled outside the PKI book?
| Options considered |
Each book handles its own certificates; Every book gets a certificates section mapped to the PKI book’s classes, issuers and renewal engines |
| Choice |
17 books gain a Certificates in this book section with a diagram. The PKI book makes the issuer decision. Monitoring covers three renewal engines, not one, and there is no single replacement CA. |
| Rationale |
Conflicts with the PKI book were fixed without cutting content. The CLM platform appendix is linked from every section. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Appendix C — Anatomy of the CLM Platform, Chapter 10 — Retirement, Steady State and Measuring Success |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#115, #117 |
Agree, disagree or send evidence on WD-052
WD-053: What does the narrator say on each slide?
| Options considered |
The full speaker notes; One short conversational part per slide: the slide’s purpose and one or two highpoints, then a lead-in to the next slide |
| Choice |
Intent-first narration kept in a narration file per deck. Notes keep the full detail and sources for presenters and are no longer read aloud. The build stops if a title no longer matches its slide. Applied to all book, executive, technical and research decks. |
| Rationale |
Narrated editions now run 8 to 24 minutes instead of 25 to 72, so each still fits the briefing slot. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#115, #121, #123, #124, #125 |
Agree, disagree or send evidence on WD-053
WD-054: How often does the narration name the workbook?
| Options considered |
On every slide; Once per deck, on slide 1 |
| Choice |
The workbook is named once per deck, on slide 1 |
| Rationale |
Part of the intent-first rewrite. No separate reason is given. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#121 |
Agree, disagree or send evidence on WD-054
WD-055: Which length does a deck’s label show?
| Options considered |
The live-talk length only; Both the live and the narrated length |
| Choice |
Labels give both, such as about 30 minutes live and 22 narrated. Narrated lengths come from the caption track. |
| Rationale |
Intent-first narration made the narrated editions shorter than the live talks. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations, Network and Transport |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#126 |
Agree, disagree or send evidence on WD-055
WD-056: How does a leader first meet the workbook?
| Options considered |
Start from the books index; A Start Here page and a short narrated series that leads with a four-week Phase 0 pre-flight and no vendor decision |
| Choice |
A Start Here page plus a four-episode series of about 6 minutes each. The case rests on identity, the ask is Phase 0, and the finish line is Gate G1. Local numbers and the shape of the ask are labeled design guidance, and the page stays agency-neutral. |
| Rationale |
Four reasons are given: external clocks, every decision rests on identity, the HR side is being rebuilt anyway, and the access risk is already carried. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Start Here, Presentations |
| Date |
2026-10-23 |
| Status |
settled |
| Defined in |
#131, #134 |
Agree, disagree or send evidence on WD-056
WD-057: Can the workbook name specific vendor products?
| Options considered |
Vendor-neutral only; Vendor-named research pages labeled as an example, not a recommendation |
| Choice |
The books stay vendor-neutral. Vendor-named companions live in Research, are labeled as an example or implementation guide, and say they are not an endorsement. |
| Rationale |
The ticket-to-machine example sits beside the vendor-neutral appendix and states it is an example, not a recommendation. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide, Appendix B — Ticket-to-Machine Reference, Research has moved |
| Date |
2026-10-24 |
| Status |
settled |
| Defined in |
#107, #137, #138, #143 |
| Note |
Research was retired by WD-103, so the vendor-named companions no longer live there: each now sits in Guides, Training, Reference, Evaluations or Explainers by type, still labeled as an example and not an endorsement. |
Agree, disagree or send evidence on WD-057
WD-061: What color is the site header?
| Options considered |
White navbar; Black navbar with white text |
| Choice |
Black top bar with white text, and black headers with white text on section landing pages. Chapters and research pages keep a light header. |
| Rationale |
Not stated in the PR beyond restoring the earlier look. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
assets/fmw-theme.scss, assets/fmw-hero.lua |
| Date |
2026-10-25 |
| Status |
settled |
| Defined in |
#111, #147 |
Agree, disagree or send evidence on WD-061
WD-062: Where do the narrated MP4s live?
| Options considered |
Commit them to the repo or site; Host them on a release and stream them into the site |
| Choice |
MP4s stay out of the repo (one Start Here video was the explicit exception) and stream from a release. The site publishes only captions and a manifest so players can load same-origin tracks. |
| Rationale |
The MP4s total about 12 GB, too big for the site host. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Videos, Presentations, Start Here |
| Date |
2026-10-25 |
| Status |
settled |
| Defined in |
#133, #134, #153 |
Agree, disagree or send evidence on WD-062
WD-063: How are project plans presented?
| Options considered |
Prose schedules; Sample plans generated from data, with a computed critical path, float, decision points and gates |
| Choice |
A Projects section of sample plans built from the books. Each shows the critical path, near-critical items, decide-by weeks and gates. Downloads are Microsoft Project XML and CSV, then Azure Boards and Jira imports. |
| Rationale |
The plans are generated by a script, so the pages and downloads stay in step and can be checked. |
| Basis |
Workbook design |
| Sources |
https://learn.microsoft.com/azure/devops/boards/queries/import-work-items-from-csv |
| Pages affected |
Projects, Program Master Schedule: Phases 0 to 5 and Gates G0 to G5 |
| Date |
2026-10-25 |
| Status |
settled |
| Defined in |
#150, #151, #154, #155, #158 |
Agree, disagree or send evidence on WD-063
WD-065: May new work add dependencies on Active Directory during the migration?
| Options considered |
Allow them and retire later; Ask of every add or change whether it creates an AD dependency; a yes needs an approved, dated exception |
| Choice |
From G0 every change is screened for domain joins, Kerberos, NTLM or LDAP, service accounts, GPOs, AD groups, AD-integrated DNS, trusts and AD CS templates. A yes is an exception approved by the authorizing official, with an end date and the Entra alternative considered. Drift checks flag unexplained new AD objects. G0 also records a provisional end state: AD retired, or a dated Kerberos island for named workloads. |
| Rationale |
Adopts two points from Microsoft’s road-to-the-cloud guidance. The vendor article that prompted the change is not cited. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, Road to the cloud: implement a cloud-first approach; Microsoft Learn, Road to the cloud: transformation posture |
| Pages affected |
Chapter 04 — Change Control and Provenance, Chapter 12 — The Migration Roadmap, Chapter 08 — Pre-Flight: Platform and Assessment |
| Date |
2026-10-25 |
| Status |
settled |
| Defined in |
#159 |
Agree, disagree or send evidence on WD-065
WD-066: When the assessment tool and the directive’s published list conflict, which governs?
| Options considered |
The newest tool release; The directive’s published page until it is updated |
| Choice |
The books keep the directive’s policy IDs and note the tool’s renumbered ID beside them. The published page governs until it is updated. The assessment chapters are re-based on ScubaGear 2.0.0, and counts from the older release stay labeled as such. |
| Rationale |
The books were right against their source. The tool renumbered the same policy, and a crosswalk that called the books out of date was corrected. |
| Basis |
Workbook design |
| Sources |
CISA, BOD 25-01 secure practices for cloud services; CISA, ScubaGear Entra ID baseline, release 2.0.0; CISA, ScubaGear README, release 2.0.0 |
| Pages affected |
Chapter 04 — SCuBA and BOD 25-01, Chapter 05 — ScubaGear and Microsoft’s Zero Trust Assessment, Access and Privilege |
| Date |
2026-10-26 |
| Status |
settled |
| Defined in |
#152, #161, #162 |
Agree, disagree or send evidence on WD-066
WD-067: What may a kit script do, and what does the workbook claim about it?
| Options considered |
Scripts may change state if the reader opts in; Assessment kits are read-only, tested against fixtures, and labeled illustrative |
| Choice |
Kits are labeled illustrative and not proven against a live estate. The Start Kit is read-only. An automated test fails on any state-changing verb, file write outside the output path, or non-SELECT query. |
| Rationale |
Not stated in the PR beyond the safety design. Packaging found three defects in printed code, which were fixed in place and logged. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
examples/start-kit/README.md, Identity and Directory, Downloads |
| Date |
2026-10-27 |
| Status |
settled |
| Defined in |
#139, #164, #165, #169 |
Agree, disagree or send evidence on WD-067
WD-068: How are downloadable kits published?
| Options considered |
Commit the zip to the repo; Release assets with a SHA-256, one Downloads tab listing everything |
| Choice |
The Help Desk Kit ships as a versioned release asset with its SHA-256 on the page. The Start Kit zip is rebuilt reproducibly on every deploy. One Downloads tab lists kits, Word editions and videos. |
| Rationale |
Hashes were checked against a fresh download, and the build is byte-identical for the same commit. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Downloads, Compliance Automation and Day-2 Operations |
| Date |
2026-10-27 |
| Status |
settled |
| Defined in |
#164, #166, #167, #168, #170 |
Agree, disagree or send evidence on WD-068
WD-069: Which delegation risks do the audit kits check?
| Options considered |
Only the checks already listed; Unconstrained Kerberos delegation in AD, and tenant-wide delegated consent in Entra |
| Choice |
The Start Kit reports unconstrained and constrained delegation, marking SQL Server accounts and privileged users who can be delegated. The Help Desk Kit reports apps consented to act as every user. |
| Rationale |
Entra has no Kerberos delegation, so tenant-wide delegated consent is its counterpart. Both stay read-only. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
examples/start-kit/README.md, Downloads |
| Date |
2026-10-27 |
| Status |
settled |
| Defined in |
#169, #170 |
Agree, disagree or send evidence on WD-069
WD-070: How should application modernization be framed?
| Options considered |
A rewrite program; A portfolio decision with six dispositions: retire, retain, rehost, replatform, refactor, rebuild |
| Choice |
Application modernization is a portfolio decision. The target reference architecture is Java 25 LTS, Spring Boot 4.1, React 19, OCI containers and the strangler fig pattern, shown by a runnable reference implementation. |
| Rationale |
Not stated in the PR beyond the chapter framing. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Application Modernization, Chapter 02 — Triaging the Portfolio, Chapter 03 — The Target Reference Architecture |
| Date |
2026-10-28 |
| Status |
settled |
| Defined in |
#173 |
Agree, disagree or send evidence on WD-070
WD-071: How do kit downloads work for tools that refuse code attachments?
| Options considered |
Commit .txt copies of scripts; Build a .txt copy beside every code file in the zip at build time |
| Choice |
The build adds a .txt copy of every script, code, configuration and data file to each kit zip. The copies are never committed, and a name collision fails the build. |
| Rationale |
Microsoft 365 Copilot and some mail systems do not accept .ps1 or .py attachments. Build-time copies cannot drift from the originals. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/build_start_kit_zip.py, Downloads, examples/copilot-agent-pack/README.md |
| Date |
2026-10-28 |
| Status |
settled |
| Defined in |
#175, #176 |
Agree, disagree or send evidence on WD-071
WD-072: How may a team show that an application’s transactions are reduced before its data is separated?
| Options considered |
Accept estimates; Count round trips from packet captures, SQL connection polling or a named measuring tool, and refuse estimates |
| Choice |
The Start Kit gate passes an application only when every transaction is Reduced or WithinBudget. Estimates are refused and flagged. The kit never captures traffic. |
| Rationale |
The arc chapters make ‘profiled and reduced’ a required check before a separation is approved. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
examples/start-kit/README.md, Chapter 10 — Analyzing the Estate |
| Date |
2026-10-29 |
| Status |
settled |
| Defined in |
#179 |
Agree, disagree or send evidence on WD-072
WD-073: Where should contractor identities be sourced from for the HR-driven pipeline?
| Options considered |
Record contractors as contingent workers in the HR platform now; An agency-owned contractor system of record now; contingent workers later as a source swap |
| Choice |
Use an agency-owned contractor system of record now. Move to HR contingent workers later, only after the program office confirms scope, licensing and privacy. The pipeline enforces the end date. |
| Rationale |
The HR 2.0 stated scope is civilian employees only, and the platform’s projected end date has no effect on processing. |
| Basis |
Workbook design |
| Sources |
FAR, 52.204-9 PIV of contractor personnel; NIST, FIPS 201-3 PIV of federal employees and contractors; GSA, Identity Lifecycle Management Playbook |
| Pages affected |
Contractors as Oracle Contingent Workers: Choosing the Contractor Source of Truth, Chapter 09 — Credentials and Certificates Across Joiner, Mover, Leaver |
| Date |
2026-10-29 |
| Status |
settled |
| Defined in |
#181, #194 |
Agree, disagree or send evidence on WD-073
WD-075: How much of the site does a pull request check render?
| Options considered |
Render the full site on every PR (50 to 60 minutes); Three tiers: FULL, CHANGED and NONE, chosen by which files changed |
| Choice |
Small PRs render only the changed pages and check their links, footnotes, bundles and redirects. Build or layout changes trigger the full render. The deploy still renders the full site on every merge. Kit test suites also run in PR checks, and rendered pages are kept for 7 days. |
| Rationale |
Small PRs should not need a 50 to 60 minute full-site render. Kit tests had run only on one machine, so some platform claims were unchecked. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/check_changed.py, CONTRIBUTING.md |
| Date |
2026-10-29 |
| Status |
settled |
| Defined in |
#189, #245, #247 |
Agree, disagree or send evidence on WD-075
WD-076: Which configuration authority does the workbook treat as the baseline?
| Options considered |
Defense hardening guides as the baseline; CISA SCuBA, NIST SP 800-53 Rev. 5 at Moderate, and CIS or vendor guidance |
| Choice |
The workbook is written for FedRAMP Moderate civilian agencies. Microsoft 365 and Google Workspace use CISA SCuBA and BOD 25-01. Hosts and network gear use CIS Benchmarks, the NIST National Checklist Program or vendor hardening guides. Defense-only items stay as references labelled ‘(High only)’. |
| Rationale |
The audience is civilian Moderate agencies, so the configuration authority is CISA, not the Defense hardening authority. |
| Basis |
Workbook design |
| Sources |
CISA, BOD 25-01 secure practices for cloud services; CISA, Secure Cloud Business Applications project; NIST, National Checklist Program |
| Pages affected |
Ansible for Configuration Automation, Chapter 08 — GPO to Intune Policy Migration, docs/compliance/Vol_I_Book_01_Cloud_Landing_Zone_IPAM_FedRAMP.md |
| Date |
2026-10-29 |
| Status |
settled |
| Defined in |
#190, #193 |
Agree, disagree or send evidence on WD-076
WD-077: What starts the leaver process for a contractor who holds a PIV card?
| Options considered |
The card system’s termination event; The contractor end date, with the card system as an input only |
| Choice |
The earliest end date wins, computed by the middleware. The end date starts the 18-hour clock. A card termination is a leaver input, and a reissue is not. No contractor record means no card. |
| Rationale |
The PIV path is labelled design guidance, not yet validated, and PS-7(d) was checked against SP 800-53 Rev. 5. |
| Basis |
External requirement |
| Sources |
NIST, FIPS 201-3 PIV of federal employees and contractors; NIST, SP 800-79-2 PIV card issuer authorization; FAR, 52.204-9 PIV of contractor personnel |
| Pages affected |
Chapter 09 — Credentials and Certificates Across Joiner, Mover, Leaver, Chapter 10 — From Attributes to Access |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#181, #194, #197 |
Agree, disagree or send evidence on WD-077
WD-078: How are overlaps between Intune, Arc, Ansible and Configuration Manager prevented?
| Options considered |
Let several tools manage the same setting; One owning tool per setting and one patch owner per server, recorded as CMDB attributes |
| Choice |
Each setting has one config owner and each server one patch owner. Both are recorded in the CMDB and written as Arc tags. |
| Rationale |
Update Manager only assesses servers that another tool patches, so patching needs a named owner. The patch-owner rule is labelled design guidance. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Ansible for Configuration Automation, Chapter 09 — Servers Under Azure Arc |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#182, #204 |
Agree, disagree or send evidence on WD-078
WD-079: How does the workbook keep agency and system names out of public pages?
| Options considered |
Rely on reviewers; An automated gate with a hashed term list, run on every PR and weekly |
| Choice |
A checker matches tracked files against salted hashes of banned terms and reports file and line only. It runs on PRs and weekly on main. Existing hits are excused by a shrink-only baseline. |
| Rationale |
Logs and issues are public, so the terms are stored as hashes and not printed. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/check_neutrality.py, CONTRIBUTING.md |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#201, #190 |
Agree, disagree or send evidence on WD-079
WD-080: How are the ‘Authorities Closed Here’ tables in the compliance volumes kept consistent?
| Options considered |
Edit each table by hand; Generate every table from one data file and fail the check on drift |
| Choice |
Ten tables are generated from one spine data file by a script. A check fails if a table differs from the spine, so no one edits the tables by hand. |
| Rationale |
The pages already said the tables were generated, but the source files were missing. Without them a regeneration could bring back the old wording. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
data/federal-compliance-compliance-spine.yml, docs/compliance/Vol_I_Book_01_Cloud_Landing_Zone_IPAM_FedRAMP.md |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#193 |
Agree, disagree or send evidence on WD-080
WD-081: How are research claims re-checked, and who approves substantive fixes?
| Options considered |
Fix every finding as it is found; Apply mechanical fixes; list substantive findings for the editor’s approval; mark unproven claims ‘pending proof’ |
| Choice |
Each footnote is re-checked against sources opened raw. Mechanical fixes such as quotes and section numbers are applied. Substantive findings wait for approval. Unvalidated design lines carry one identical pending-proof note. |
| Rationale |
About 160 rows were checked: 133 supported, 24 partly supported, 2 not supported. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
How This Workbook Knows What It Says, docs/about/_verification/verification-pass-2026-10.md |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#197 |
Agree, disagree or send evidence on WD-081
WD-082: How are application dependencies recorded for triage?
| Options considered |
Free-text inventory; A structured evidence map with a schema, where every link is a claim with basis, date and confidence |
| Choice |
Dependencies go on an evidence map with eight entity types. Unevidenced links must be marked assumed and tied to an open question. A schema and a checker enforce this. |
| Rationale |
A link is a claim, not a deployment fact. Dates and open questions keep the map honest. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 02 — Triaging the Portfolio, Chapter 10 — Analyzing the Estate |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#200, #201 |
Agree, disagree or send evidence on WD-082
WD-084: What does a chapter do when Microsoft’s pages disagree or say nothing?
| Options considered |
Pick one reading silently; Flag the conflict, label inferences, and keep the stricter figure in code |
| Choice |
Conflicts between Learn pages are recorded, not resolved. Inferences and program choices are labelled ‘inference’, ‘interpretation’ or ‘design guidance’. Code keeps the stricter figure. |
| Rationale |
Example: the bulk upload rate is 40 requests per second on one page and 40 per 5 seconds on another. The code keeps the stricter one. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
How This Workbook Knows What It Says, Chapter 07 — Cloud Private Endpoints, SDN and IPAM Consistency |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#204, #207, #208, #212, #215 |
Agree, disagree or send evidence on WD-084
WD-086: Do the multi-line telephone 911 rules bind a federal agency’s softphone system?
| Options considered |
Treat the rules as not applying; Configure as if the rules bind the agency, and let counsel decide |
| Choice |
Configure Teams emergency calling as if the rules apply. The text is a labelled interpretation, and an HR-derived address is only the lowest-ranked location source. |
| Rationale |
The rules ask where the caller is, not the HR duty station. The statute defines the covered ‘person’ without naming government, and the FCC order does not address federal agencies. |
| Basis |
External requirement |
| Sources |
FCC, Order 19-76 implementing Kari’s Law and RAY BAUM’S Act; U.S. Code, 47 U.S.C. 623 multi-line telephone systems; Microsoft Learn, Emergency addresses for remote locations |
| Pages affected |
Chapter 10 — From Attributes to Access, Chapter 05 — The Service Catalogs: ITSM and Teams Telephony, Chapter 07 — Cloud Private Endpoints, SDN and IPAM Consistency |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#207, #210 |
Agree, disagree or send evidence on WD-086
WD-087: How is each developer workbook chapter built?
| Options considered |
Write original code; Start from Learn’s procedure and Microsoft’s own sample, pinned unmodified, and add only what it leaves out |
| Choice |
Each chapter pins the Microsoft sample with blob hashes checked against upstream, runs it unmodified against fakes, and uses a gap table in which a test pins each gap. A source-watch feed follows the upstream commits. |
| Rationale |
Learn first, then Microsoft’s sample, then workbook code only for what they leave to the developer. |
| Basis |
Workbook design |
| Sources |
Microsoft, entra-id-inbound-provisioning CSV2SCIM sample; Microsoft Learn, PowerShell samples for dynamic membership processing |
| Pages affected |
Building the Attribute-Driven Migration, Building Privileged Access, Building Non-Person Identity |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#208, #213, #215, #216, #217, #218, #219, #222, #223, #228, #230 |
Agree, disagree or send evidence on WD-087
WD-088: Can developer workbook pages publish without an editor’s approval?
| Options considered |
Publish on merge like other pages; Gate every workbook page on approval; weekly list of pages awaiting review |
| Choice |
Each page carries a review status. Approval records a hash of the body, and a changed body reopens review. The weekly Source watch lists unapproved pages. The gate covers all workbook folders, and chapter tours wait for approval. |
| Rationale |
Requested as: add it to the weekly review, but gate changes to the developer series until reviewed. 31 pages were approved on October 31. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/source_watch/review_gate.py, Developer Workbooks |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#208, #214, #248, #252 |
Agree, disagree or send evidence on WD-088
WD-089: How do narrated videos play on the site?
| Options considered |
MP4 only; YouTube embed when an ID exists, MP4 as fallback and download, with slide chapters |
| Choice |
A video with a YouTube ID plays from the privacy-enhanced domain. Otherwise the MP4 plays. Both show a jump-to-slide list built from the deck’s advance times. |
| Rationale |
The release serves MP4s as application/octet-stream, which Safari and iOS will not play. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Presentations |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#209 |
Agree, disagree or send evidence on WD-089
WD-090: Does the private DNS platform comparison cover Oracle Cloud Infrastructure?
| Options considered |
AWS, Azure, Google Cloud and NSX only; Add Oracle Cloud Infrastructure to the comparison |
| Choice |
OCI is added to the platform tables in the DDI chapters, and the limits and failure-behavior table covers it too. |
| Rationale |
Not stated in the PR beyond extending the comparison. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 07 — Cloud Private Endpoints, SDN and IPAM Consistency |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#212 |
Agree, disagree or send evidence on WD-090
WD-092: How do the example code kits change a tenant?
| Options considered |
Apply changes directly; Dry run by default; write only with an explicit apply flag, never delete, read back after writing |
| Choice |
Kits read first and show a diff. Writes need -Apply, and some need an approved plan hash. They create policies report-only, disable accounts instead of deleting them, and never send DELETE. |
| Rationale |
Not stated beyond the guard design. The non-person kit records a 30-day claim window before an orphaned account is disabled. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 02 — Ownership and the Orphan Rule, Chapter 05 — Workload Identity Federation and Managed Identities, Building Privileged Access |
| Date |
2026-10-30 |
| Status |
settled |
| Defined in |
#217, #223, #224, #230, #236 |
Agree, disagree or send evidence on WD-092
WD-093: What does the weekly source watch monitor?
| Options considered |
Sources cited in books only; Also research pages, developer workbooks, Learn source commits, and pages past their review date |
| Choice |
The watch covers research and workbook citations, uses Learn’s source commit to detect real changes, quotes changed lines where the source repository is public, and lists pages past their lifecycle review date. |
| Rationale |
Otherwise a change to a cited Microsoft page would go unnoticed until the 90-day review. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/source_watch/README.md, scripts/source_watch/review_dates.py |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#188, #214, #244, #246 |
Agree, disagree or send evidence on WD-093
WD-095: How are versions of the workbook frozen and archived?
| Options considered |
Rely on git history alone; Dated editions as tags plus Releases, per-book version histories, and an Archive page |
| Choice |
An edition is a tag edition-YYYY.MM with a Release holding the built files. A book is 1.0 in its first edition and goes up 0.1 per edition that changes it. Rewriting git history to shed binaries is documented as an option only and was not done. |
| Rationale |
Generated .pptx and .mp3 history is 2.2 GiB of a 2.43 GiB pack. A history rewrite would force every clone and open PR to be redone. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Archive, CONTRIBUTING.md |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#250 |
Agree, disagree or send evidence on WD-095
WD-096: How does the Start Kit survey directory attributes across domains?
| Options considered |
Query one domain controller; Read Global Catalog attributes once per domain, read the rest from each domain’s own controllers, and mark unreadable attributes ‘not collected’ |
| Choice |
The survey reads the partial attribute set from the schema at run time and never writes. A refused read is marked not collected, never empty. A shared export feeds the later checks. |
| Rationale |
Learn’s schema reference lists employeeID, employeeType and department as not in the Global Catalog by default. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Active Directory schema: Employee-ID attribute; Microsoft Learn, Active Directory schema: Employee-Type attribute; Microsoft Learn, Active Directory schema: Manager attribute |
| Pages affected |
examples/start-kit/README.md, Attribute-Driven Migration: An Implementation Guide |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#251, #253, #254, #255 |
Agree, disagree or send evidence on WD-096
WD-097: Where do the generated decks and narration audio live?
| Options considered |
Keep them in git; Move them to an edition Release and keep only the sources in git; Rewrite git history to remove them |
| Choice |
Decks and audio live on the edition’s Release, checked by size and sha256. Sources, captions and scripts stay in git. History is not rewritten; that stays a documented option. |
| Rationale |
Not stated in the PR beyond this being the second of two revision-control changes. The editor approved it. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
presentations/_build/README.md, CONTRIBUTING.md, Archive |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#260 |
Agree, disagree or send evidence on WD-097
WD-098: Should every example command carry built-in help?
| Options considered |
Help only on some commands; A synopsis and at least one example on every public command, enforced in CI, with one generated page listing them |
| Choice |
Every exported function, script and Python tool has a synopsis and an example. CI fails if one is missing. The Command Reference page is generated at build time. |
| Rationale |
The PR answers whether commands have help and whether there is a guide. 310 functions had no synopsis. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Command Reference, CONTRIBUTING.md |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#261 |
Agree, disagree or send evidence on WD-098
WD-099: Does the cloud DNS comparison cover Oracle Cloud as well as AWS and Azure?
| Options considered |
AWS and Azure only; AWS, Azure and Oracle Cloud |
| Choice |
Add Oracle Cloud Infrastructure to every part of the cloud DNS evaluation, with its government-cloud scope and FedRAMP Marketplace status. |
| Rationale |
Every cloud-platform comparison also covers Oracle Cloud, because the HR platform runs on it. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Cloud DNS on AWS, Azure and Oracle Cloud: Native Resolvers, Infoblox and BIND |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#262 |
Agree, disagree or send evidence on WD-099
WD-100: How does the source watcher fetch pages from a host that refuses Python’s HTTP client?
| Options considered |
Leave the host unwatched; Fetch that host with curl and keep the same headers and pacing |
| Choice |
Fetch cisa.gov and its subdomains with curl; fall back to the Python client with a warning if curl is missing. |
| Rationale |
The watcher had never tracked the workbook’s most-cited federal publisher, about 280 citations, because the host returned 403 to Python. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/source_watch/README.md, data/source-watch/config.json |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#263 |
Agree, disagree or send evidence on WD-100
WD-101: How does the workbook use CISA’s Hybrid Identity Solutions Guidance, and what does ‘source of identity’ mean in HR-driven identity?
| Options considered |
Mention the guidance once; Cite it where it applies and tie it to the HR chapters in two short places; Add a full section to the HR book |
| Choice |
Cite the guidance in the identity chapters. In the HR book, read its ‘source of identity’ as the directory that governs sign-in, not the HR system of record, and add two short ties instead of a section. |
| Rationale |
The guidance is about authentication, not HR or provisioning. The workbook already covered nearly all of its substance but named it once. |
| Basis |
External requirement |
| Sources |
CISA, Hybrid Identity Solutions Guidance; Microsoft Learn, Embrace cloud-first: convert group source of authority |
| Pages affected |
Chapter 09 — Credentials and Certificates Across Joiner, Mover, Leaver, Identity and Directory |
| Date |
2026-10-31 |
| Status |
settled |
| Defined in |
#265, #266 |
Agree, disagree or send evidence on WD-101
WD-102: What narrated decks does a developer workbook get?
| Options considered |
One deck per workbook; A story deck plus one tour per chapter |
| Choice |
Ticket-to-Machine gets one end-to-end story deck and eight chapter tours. Tours follow the chapter’s sections and cite its footnotes. The same pattern covers the other developer workbooks. |
| Rationale |
Not stated in the PR beyond the editor choosing this option. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Building Ticket-to-Machine, Learning path: Ticket-to-Machine on ServiceNow and SailPoint |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#256, #283 |
Agree, disagree or send evidence on WD-102
WD-103: How should the workbook’s pages be organized as the number of guides, labs and evaluations grows?
| Options considered |
Keep a Research section with mixed page types; One home per content type, matched to Microsoft Learn’s types |
| Choice |
Retire Research. Move all 24 pages to Guides, Training, Reference, Evaluations or Explainers by type, keep each page’s status label, and keep old URLs as aliases. Four rules against sprawl: a page does not change type, link don’t repeat, one deck series per guide, new guides fill a named gap. |
| Rationale |
To avoid sprawl and get closer to Microsoft Learn’s content model. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
CONTRIBUTING.md, Research has moved, How This Workbook Knows What It Says |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#269, #271 |
Agree, disagree or send evidence on WD-103
WD-104: Where do the Attribute-Driven Migration developer workbook and implementation guide live?
| Options considered |
Under Projects, as a developer workbook and a project guide; Back in Books: the workbook as b19 Building the Attribute-Driven Migration, the guide under Books > Guides |
| Choice |
Restore the workbook as b19 Building the Attribute-Driven Migration and the implementation guide to Books > Guides. The Projects section stays for the other developer workbooks. |
| Rationale |
Under the Learn-style content model, how-to guides live in Books > Guides. The editor asked for the workbook to return as b19. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Building the Attribute-Driven Migration, Attribute-Driven Migration: An Implementation Guide |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#270 |
Agree, disagree or send evidence on WD-104
WD-105: What must every implementation guide and training module carry beyond Microsoft Learn’s content?
| Options considered |
Follow Learn’s structure only; Add federal requirements and evidence, and where agencies are today |
| Choice |
Every gate or module states the requirement it meets (OMB, CISA, NIST SP 800-53 Moderate, SP 800-63, FedRAMP) and the ISSO’s evidence. It also gives the assumed starting state, a government-cloud availability check citing Learn with the date read, and an interim path. |
| Rationale |
Learn does not give a federal reader these two layers. Learn is used first for how Microsoft features work; federal primary sources for what is required. |
| Basis |
Workbook design |
| Sources |
OMB, M-22-09 moving the government toward zero trust; NIST, SP 800-53 Rev. 5 security and privacy controls; NIST, SP 800-63-4 digital identity guidelines |
| Pages affected |
CONTRIBUTING.md, HR-Driven Identity: An Implementation Guide, Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#271, #272, #273 |
Agree, disagree or send evidence on WD-105
WD-106: When is an implementation guide finished?
| Options considered |
When the guide text is done; When it has the guide, a narrated deck series, a developer workbook with labs, and a training path |
| Choice |
A guide is finished only with all four pieces. Until then it names the missing pieces as planned. |
| Rationale |
The editor asked that every implementation guide come with a full developer workbook with labs, and training. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
CONTRIBUTING.md, Training, HR-Driven Identity: An Implementation Guide |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#274, #275, #276, #277, #278, #280 |
Agree, disagree or send evidence on WD-106
WD-107: Under what license is the workbook published?
| Options considered |
One license for everything; Content under CC BY-NC-ND 4.0 and code under MIT |
| Choice |
Content (docs, decks, narration, images, media) is CC BY-NC-ND 4.0. Code (examples, scripts, deck build kit, workflows) is MIT. Third-party samples keep their own licenses. The workbook is stated not to be government work. |
| Rationale |
The editor chose the split license and ownership. The PR says it is not legal advice and an IP attorney should review it before any sale or licensing deal. |
| Basis |
Workbook design |
| Sources |
https://creativecommons.org/licenses/by-nc-nd/4.0/ |
| Pages affected |
LICENSE.md, README.md |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#279 |
Agree, disagree or send evidence on WD-107
WD-108: How are lab outputs and Lab 1 slides produced?
| Options considered |
Hand-written example output; Run each Lab 1 command as written and capture the real output, checked in CI |
| Choice |
Lab 1 steps show what the kit really prints, drawn as terminal captures. A check fails when a capture no longer matches the kit. Tour slides use the same captures. Chapters whose steps need unavailable modules are left out of capture and say so. |
| Rationale |
Not stated in the PR beyond making each lab show real output. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Building Ticket-to-Machine, Labs, CONTRIBUTING.md |
| Date |
2026-11-01 |
| Status |
settled |
| Defined in |
#288, #291, #293, #294, #295, #296, #297 |
Agree, disagree or send evidence on WD-108
WD-109: How are lab steps written?
| Options considered |
Prose steps the reader works out; Every step is a paste-ready command block or a numbered click path |
| Choice |
Every reader action is a bash or PowerShell block. Placeholders are listed once at the top of each lab. Each lab can be followed alone. Only portal-only actions and reader-prepared inputs stay as prose. A generated Labs page lists every lab. |
| Rationale |
Not stated in the PR; the PRs show the labs rewritten to remove steps a reader had to work out. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Labs, Building HR-Driven Identity, Building Privileged Access |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#290, #293, #294, #295, #296, #300 |
Agree, disagree or send evidence on WD-109
WD-110: How are lab steps and kit outputs tied to federal requirements?
| Options considered |
One requirements table per chapter; One row per scripted step or output file, with the control, a FedRAMP 20x KSI and the exact command or file that is the evidence |
| Choice |
Each scripted step gets a row naming its NIST SP 800-53 Moderate control, the KSI it aligns to and the evidence. Only KSI IDs the workbook already cites are used, and each pairing is checked against fedramp.gov. KSIs are described as provider-side indicators the agency aligns its own evidence to. |
| Rationale |
So an ISSO can see what each step proves. Controls not in the Moderate baseline are marked as such. |
| Basis |
External requirement |
| Sources |
FedRAMP, Key Security Indicators, Consolidated Rules for 2026; NIST, SP 800-53 Rev. 5 security and privacy controls |
| Pages affected |
Building Ticket-to-Machine, Building the Attribute-Driven Migration, Non-Person Identity: An Implementation Guide, Privileged Access: An Implementation Guide |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#301, #304, #306, #312, #313, #325 |
Agree, disagree or send evidence on WD-110
WD-111: How does a developer workbook take a kit from Lab 2 to production?
| Options considered |
Leave deployment to the reader; A runbook chapter: test stage first, go/no-go criteria, then production, with only a settings file changing between stages |
| Choice |
Each workbook gets a deployment chapter. One settings file per environment holds no secrets. Pre-flight checks block unsafe starts. Every script has a dry-run or fixture mode. Production follows in waves with first-week drift monitoring. Chapters say plainly they were not run against a live tenant and treat live results as expectations. |
| Rationale |
Not stated in the PR beyond the runbook design. For privileged access, the order is built to prevent lockout. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 09 — Deploying to Test and Production, Chapter 11 — Deploying to Test and Production, Chapter 08 — Deploying to a Test Tenant, Then to Production, Chapter 09 — Deploying to Test and Production |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#302, #307, #308, #311, #315, #329 |
Agree, disagree or send evidence on WD-111
WD-112: What happens to internal evaluation documents that name an agency and cite internal mail?
| Options considered |
Keep them in the public repository; Remove them from the tree; leave history alone unless the owner decides to rewrite it |
| Choice |
Remove the two documents from the working tree. Their findings are handled in separate PRs. Removing them from history would need a rewrite and is left to the owner. |
| Rationale |
They name the agency and cite internal mail, so they do not belong in a public repository. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
CONTRIBUTING.md |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#309 |
Agree, disagree or send evidence on WD-112
WD-113: How can an agency practitioner build a task catalog without sending agency data to a public repository?
| Options considered |
Collect agency tasks in the public workbook; Ship a neutral template and prompts that the practitioner fills in at work with an approved AI assistant |
| Choice |
Publish a fictional template, worked examples, a checker and copy-paste prompts for Microsoft 365 Copilot Chat. The agency’s own tasks never come back to the public repository. |
| Rationale |
The pack is for use at work. Everything in it is fictional. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Building an internal Ticket-to-Machine task catalog |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#310 |
Agree, disagree or send evidence on WD-113
WD-114: In what order does the privileged access guide sequence its gates?
| Options considered |
Inventory, then PIM, then emergency access; Inventory, then emergency access first, then Conditional Access and PIM |
| Choice |
Gate 2 is emergency access. Pre-flight blocks unless emergency accounts are excluded from every Conditional Access policy in any state. Later modules carry lockout guard callouts. |
| Rationale |
The order is built to prevent lockout. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Privileged Access: An Implementation Guide, Module 2: Emergency access first |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#311, #322, #325 |
Agree, disagree or send evidence on WD-114
WD-117: Where does the workbook handle privacy for identity work?
| Options considered |
Leave privacy to the privacy office; A dedicated chapter in the HR book plus short privacy sections in six other books |
| Choice |
Add a chapter on privacy for workforce identity (PII, SORN coverage, PIA triggers, minimization, disclosures, retention) and short privacy sections in the access, devices, telemetry, governance, AI and modernization books. Note that no PT control is in the Moderate baseline, so a Moderate system with PII carries the privacy baseline too. |
| Rationale |
Makes privacy a design obligation of identity work, closing a gap found by an outside review. |
| Basis |
External requirement |
| Sources |
NIST, SP 800-53B control baselines; OMB, Circular A-130 managing information as a strategic resource; U.S. Code, Privacy Act of 1974, 5 U.S.C. 552a |
| Pages affected |
Chapter 14 — Privacy for Workforce Identity, Federal Framework Crosswalk |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#317, #320 |
Agree, disagree or send evidence on WD-117
WD-118: How does the workbook show federal traceability to an ISSO, assessor or authorizing official?
| Options considered |
Rely on the existing crosswalk tables; Add an RMF task map, an M-19-17 and FICAM crosswalk, and an authority register |
| Choice |
Map all 47 SP 800-37 Rev 2 tasks, each marked Covered, Partial or Not covered. Add an M-19-17 and FICAM crosswalk marked Strong, Partial, Gap or Out of scope. Add a register of 24 authorities. Gaps are stated plainly. |
| Rationale |
Makes federal traceability visible. |
| Basis |
External requirement |
| Sources |
NIST, SP 800-37 Rev. 2 risk management framework |
| Pages affected |
RMF Map, M-19-17 and FICAM Crosswalk, Federal Framework Crosswalk |
| Date |
2026-11-02 |
| Status |
settled |
| Defined in |
#318 |
Agree, disagree or send evidence on WD-118
WD-122: In what order does the orphan rule act on a non-person identity nobody will own?
| Plan decision |
D-NP2 in the non person identity plan |
| Options considered |
Give the office 30 days to find an owner, then suspend (the implementation guide’s wording); Disable once the finding is confirmed, then a 30-day claim window (plan decision D-NP2) |
| Choice |
Disable first, then a 30-day claim window in which the office names an owner or the identity is retired. The implementation guide changes to match the plan and Chapter 02. |
| Rationale |
The plan’s decision D-NP2 and Chapter 02 already used this order. Disable-first is a non-person identity rule, not Access and Privilege’s. Access and Privilege, Chapter 06 gives the office 30 days and then suspends at day 31, which is the option rejected here. The identity is disabled, not deleted, so a claim within the window can restore it. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Non-Person Identity: An Implementation Guide, Chapter 02 — Ownership and the Orphan Rule, Non-Person Identity Modernization: Service Accounts, Workload Identities and AI Agents, Chapter 06 — Who Decides Access |
| Date |
2026-11-03 |
| Status |
settled |
| Defined in |
#321 |
| Note |
Raised as a discrepancy in #321 and decided by the workbook’s editor on 2026-11-03. The changed gated pages go back through the review gate. |
Agree, disagree or send evidence on WD-122
WD-128: What happens to a high-risk Active Directory account that is kept out of the first conversion wave?
| Options considered |
Chapter 03’s check warns on it; The guide’s G2 check fails on it unless it is in wave 1 or retired |
| Choice |
G2 fails it. Chapter 03 changes so the kit’s check fails, as the guide requires. |
| Rationale |
The guide’s G2 check is the stricter rule, and the kit now enforces the gate as the guide states it. A warning would let the gate pass with the account still waiting. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Non-Person Identity: An Implementation Guide, Chapter 03 — The Migration Path Matrix as Code |
| Date |
2026-11-03 |
| Status |
settled |
| Defined in |
#321 |
| Note |
Raised as a discrepancy in #321 and decided by the workbook’s editor on 2026-11-03. |
Agree, disagree or send evidence on WD-128
WD-129: Which pages does the review gate hold for the editor’s approval?
| Options considered |
The developer workbooks, Building the Attribute-Driven Migration and its implementation guide; Also every implementation guide (docs/books/guides/) and every training page (docs/training/) |
| Choice |
Extend the gate to docs/books/guides/ and docs/training/. |
| Rationale |
Not recorded beyond the decision itself. The guides and learning paths are built from the same kits as the gated workbooks. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
scripts/source_watch/review_gate.py, Training |
| Date |
2026-11-03 |
| Status |
settled |
| Defined in |
#336 |
| Note |
Extends the review gate of WD-088. Applied to review_gate.py in |
Agree, disagree or send evidence on WD-129
WD-130: How does the Attribute-Driven Migration smoke test treat VK-DG-03, a validation kit check that can only run with delegated permissions?
| Options considered |
Fail the smoke test when the check can’t run; Drop the check from the smoke test; Accept it as a documented exception, verified by hand at the first live run |
| Choice |
Accept VK-DG-03 as a documented exception in the smoke test, and verify it by hand at the first live run. |
| Rationale |
The smoke test runs app-only, so a delegated-only check always ends in error there. Failing on it would block every run; dropping it would lose the check. A documented exception keeps it visible. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 10 — Deploying to Test and Production, Chapter 09 — Drift Pipelines and Evidence to the ISSO |
| Date |
2026-11-03 |
| Status |
settled |
| Defined in |
#336 |
Agree, disagree or send evidence on WD-130
WD-131: How does the narration refer to the workbook’s books and sources?
| Options considered |
Keep “Book NN” in narration; Name each book by its title and cite the original source |
| Choice |
Every remaining book number in the narration (190 changes) becomes the book’s title, and narration names the original source, not the workbook’s book number. |
| Rationale |
The editor asked that narration refer to the original source instead of a book number, and name a book by its title when it must name one. Facts with no outside source are called the workbook’s guidance. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
presentations/_build/README.md |
| Date |
2026-11-03 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-131
WD-132: Where does the External Partner Person class live in the workbook?
| Options considered |
A stand-alone appendix book; Light edits to existing pages only; A new HR-Driven Identity chapter and a Access and Privilege appendix with the Microsoft Entra profile |
| Choice |
A new HR-Driven Identity chapter 15 holds the class, the authority split, the standard, the record and the gates. A new Access and Privilege appendix C holds the Microsoft Entra partner access profile. A short HR-Driven Identity appendix holds the partner record template. Other books get light edits and pointers, not new files. |
| Rationale |
It keeps the authoritative-source argument in the book that makes it. The workbook already handles partners as B2B guests across six chapters, so most of the proposal folds into existing pages. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
InBox/Public_GitHub_Proposal_External_Partner_Identity_Class_for_the_Federal_Modernization_Workbook.docx, HR-Driven Identity, Access and Privilege |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-132
WD-133: What does the workbook call the new class, and how does it relate to worker type and persona?
| Options considered |
Use class, worker type and persona as three separate words; Make the class the parent, with worker type and persona as views of it |
| Choice |
External Partner Person is the class. Class is the parent term. Worker type stays the HR attribute, and the Externals persona becomes a view of the class and is renamed to match. |
| Rationale |
The workbook sorts people by worker type and by persona today. Without one rule, three overlapping words drift apart across the books. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity, Access and Privilege |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-133
WD-134: Which Entra user type do external partner persons receive?
| Options considered |
Member by default; Guest by default, with Member by exception |
| Choice |
Partner persons stay Guest by default. Member requires an exception record. |
| Rationale |
The workbook’s internal baselines and its compliant-device policy scope Members and exclude guests. A partner synced as Member would fall into internal baselines by accident. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Access and Privilege |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-134
WD-135: Does the vendor-neutral standard or the Entra profile lead?
| Options considered |
The neutral standard first and long; A short neutral standard in one chapter, with the Entra profile as the practical page |
| Choice |
The neutral standard stays short and sits in one chapter. The Entra profile is the main practical page. |
| Rationale |
The workbook is Microsoft-first and cites Microsoft Learn. A long neutral standard would reverse that emphasis. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity, Access and Privilege |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-135
WD-136: How much of the External Partner Person material ships in the first edition that carries it?
| Options considered |
Text, decks, videos and a kit example together; Text and the partner record first, with decks, videos and the kit example in the next regeneration |
| Choice |
The first edition carries the text and the record. Decks, videos and the kit example follow in the next regeneration. |
| Rationale |
Decks and videos are the costly tail of the work, and the text can be reviewed on its own. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-136
WD-137: Does the workbook teach assurance selection for partner persons, or only cite it?
| Options considered |
Cite NIST SP 800-63 and stop; Teach identity, authenticator and federation assurance selection briefly in the new chapter |
| Choice |
The new HR-Driven Identity chapter teaches assurance selection by transaction risk, briefly, with its sources. |
| Rationale |
Only PKI and Certificates mentions federation assurance today, and no chapter teaches how to choose a level. The proposal depends on it. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-137
WD-138: In what order are the 1,625 consistency findings fixed, given the partner additions?
| Options considered |
Fix everything first; Hold everything until the additions land; Fix findings on untouched and lightly touched pages first, and hold the 16 on pages the additions rewrite |
| Choice |
Findings on pages the additions leave alone, or touch lightly, are fixed first. The 16 findings on Identity and Directory chapter 10 and the HR-Driven Identity and Governance, Drift and Evidence indexes wait and are fixed together with the additions. |
| Rationale |
Fixes on pages the additions do not rewrite are not wasted. Fixing the held pages first would spend effort on text that is about to change. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 10 — Migrating and Governing, HR-Driven Identity, Governance, Drift and Evidence |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-138
WD-139: When are the sources behind the new partner chapter checked?
| Options considered |
After the chapter is drafted; Before any chapter text is written |
| Choice |
About twelve primary sources are checked before any text for the new chapter is written, and the result goes in a verification note. |
| Rationale |
A source check can overturn a claim in the proposal, and finding that after drafting means rework. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
HR-Driven Identity |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-139
WD-140: Which Microsoft Entra route is the default for partners outside the agency’s own organization?
| Options considered |
Cross-tenant synchronization and entitlement management as equal options; Entitlement management with B2B guests as the default, cross-tenant synchronization as the exception |
| Choice |
Entitlement management with B2B collaboration guests is the default route for outside partners. Cross-tenant synchronization is the exception, used only with a recorded reason. |
| Rationale |
Microsoft’s FAQ says cross-tenant synchronization is intended for use within an organization, for privacy reasons, and points to entitlement management for inviting B2B users across organizations. It pushes only internal members of the source tenant and does not collect user consent. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, What is cross-tenant synchronization?; Microsoft Learn, Govern access for external users in entitlement management |
| Pages affected |
Access and Privilege, HR-Driven Identity |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
| Note |
Refines WD-135, which kept the Entra profile as the practical page; it does not change that choice. |
Agree, disagree or send evidence on WD-140
WD-141: How does the Entra profile keep WD-134 (Guest by default) when the product default differs?
| Options considered |
Accept the product default (external member); Set the userType mapping to Guest explicitly and require an exception record for Member |
| Choice |
The Entra profile states the userType mapping as a required setting, set to Guest. Member remains an exception that needs an exception record. |
| Rationale |
Cross-tenant synchronization creates external members by default, and an existing guest is not changed unless the mapping is set to Always. The workbook’s Conditional Access library scopes Members separately from guests, so the default would move partners into the internal baselines. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, Configure cross-tenant synchronization; Microsoft Learn, What is cross-tenant synchronization? |
| Pages affected |
Access and Privilege |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
| Note |
WD-134 stands; this entry records how it is applied. |
Agree, disagree or send evidence on WD-141
WD-142: When are the cloud pair for Government-cloud partners and the unverified source items settled?
| Options considered |
In the chapter draft; In a second source pass before any chapter text |
| Choice |
A second source pass settles the cloud pair for a partner in a Government cloud tenant, and the four unverified items (FIPS 201-3 eligibility, FedRAMP’s current requirements, EO 14028’s status, GRS 3.2 retention), before any chapter text is written. What it cannot settle stays listed as unverified. |
| Rationale |
Finding a wrong cloud pair or an outdated requirement after drafting means rework, as WD-139 already reasoned. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
docs/books/b03-hr-identity/_verification/15-external-partner-identity.md |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-142
WD-143: When do the sources for the partner chapter enter the Source Register?
| Options considered |
Now; When the chapter is written and cites them |
| Choice |
The candidate sources enter the Source Register when the chapter is written and cites them in footnotes. |
| Rationale |
The register accepts a row only for a source the books cite in a footnote, so rows added now would have no citation to check against. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Source Register |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
— |
Agree, disagree or send evidence on WD-143
WD-144: Does the drift pipeline keep the OSCAL Assessment Results and POA&M export added in
| Options considered |
Remove the export; Keep the export, with its pinned OSCAL 1.2.3 schemas, tests and the Building the Attribute-Driven Migration Chapter 09 lab step |
| Choice |
The export stays: the drift pipeline writes OSCAL 1.2.3 Assessment Results and a plan of action and milestones from a clean run, validated against the pinned schemas, and Building the Attribute-Driven Migration Chapter 09 carries a lab step that runs it. |
| Rationale |
It gives the ISSO the pipeline’s evidence in the machine-readable form the federal assessment tools take and it is covered by its own tests. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 09 — Drift Pipelines and Evidence to the ISSO |
| Date |
2026-11-06 |
| Status |
settled |
| Defined in |
#393, #401 |
Agree, disagree or send evidence on WD-144
WD-145: What does CP-001 rely on in GCC High and DoD, where Device Health Attestation is only planned?
| Options considered |
Keep the three boot-measured rules as the only check; Keep them, and add the checks that don’t depend on attestation for GCC High and DoD |
| Choice |
CP-001 and CP-002 keep Require BitLocker, Require Secure Boot and Require code integrity, but in a GCC High or DoD tenant the program doesn’t count them as evidence until Learn lists attestation as available there. It adds Encryption of data storage on a device for BitLocker, reads Secure Boot and code integrity from Defender for Endpoint’s device health and vulnerability management reporting as a drift finding, and uses the Defender for Endpoint machine risk score as a risk signal, confirmed in the pilot. |
| Rationale |
Intune’s government service description lists Windows Device Health Attestation as planned, not available, for GCC High and DoD, while the Windows compliance settings reference says GCC High and DoD devices use it; the program plans on the narrower statement. Learn gives a replacement only for the encryption check, so the Secure Boot and code integrity reads are the program’s design guidance. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Microsoft Intune for US Government GCC High and DoD service description; Microsoft Learn, Device compliance settings for Windows in Intune; Microsoft Learn, Microsoft Defender for Endpoint for US Government customers |
| Pages affected |
Chapter 08 — GPO to Intune Policy Migration, Chapter 10 — Operating and Evidencing the Fleet |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. Learn’s two pages disagree on attestation in GCC High and DoD; recheck both when the service description changes. |
Agree, disagree or send evidence on WD-145
WD-146: Where does the Tenant Creator role sit in the PIM tiers?
| Options considered |
Tier 2 without approval, like the other Tier 2 roles; Tier 2, eligible only, with approval required |
| Choice |
Tenant Creator is a Tier 2 role, eligible only and never active, with approval by PIM-Approvers-T2, an 8-hour activation, a ticket and 180-day eligibility, held through PRV-T2-TenantCreator with no administrative-unit scope. |
| Rationale |
The role lets its holder create tenants even when non-admin tenant creation is restricted, and the creator becomes Global Administrator of the new tenant, so an unapproved activation would put a tenant outside every policy. Microsoft recommends restricting tenant creation to the Tenant Creator role. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Microsoft Entra built-in roles: Tenant Creator; Microsoft Learn, Configure Microsoft Entra for Zero Trust: Protect tenants and isolate production systems |
| Pages affected |
Appendix B — PIM Role Settings Reference, Chapter 09 — Access Governance: Packages, Reviews and Lifecycle |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. |
Agree, disagree or send evidence on WD-146
WD-148: Are the credential, test and triage thresholds in Books 02, 07, 08, 13, 17 and 18 confirmed?
| Options considered |
Leave them as design guidance to confirm; Confirm them as the program’s settled thresholds |
| Choice |
Confirmed: an HSM-backed key for high-privilege applications; certificate renewal at 80% of lifetime; no redirect domain whose registration expires within 90 days; a yearly agent-disable test and a yearly federation recovery test; the secret rotation windows; the attack-path score with wave thresholds of 8 and 4; and the 90-day stale-application rule. |
| Rationale |
The thresholds are risk-based recommendations whose reasons the chapters give; confirming them fixes the values the drift checks and the remediation factory use. The score’s thresholds still change after calibration. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Secure your Azure Key Vault certificates |
| Pages affected |
Chapter 08 — Lifecycle, Monitoring and Decommissioning, Chapter 06 — DNS Identity, Certificates and DNSSEC, Chapter 06 — Credentials, Least Privilege and Access Policy for AI, Chapter 09 — Building the Entra ID Target, Chapter 14 — Applications, Secrets and Configuration Drift, Chapter 02 — Triaging the Portfolio, Appendix A — Identity Remediation Work Packages |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. |
Agree, disagree or send evidence on WD-148
WD-149: Are the standing-privilege exception routes confirmed?
| Options considered |
Leave the approvers, expiry limits and severities as proposed; Confirm them |
| Choice |
Confirmed: the approvers for each register category; at most one year for a service principal that can’t activate and six months for Other; and the drift severities for an unregistered permanent assignment, an expired entry and a changed role setting. |
| Rationale |
The routes reuse Governance, Drift and Evidence’s split between a bounded exception the CISO approves and a risk acceptance the authorizing official decides; Microsoft recommends no permanent assignments other than the emergency accounts. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Plan a Privileged Identity Management deployment |
| Pages affected |
Chapter 14 — Applications, Secrets and Configuration Drift |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. |
Agree, disagree or send evidence on WD-149
WD-150: Are the design positions on emergency access, relay, break-glass, rollback, RADIUS failure, backout triggers and emergency calling confirmed?
| Options considered |
Leave them as design guidance; Confirm them as program decisions |
| Choice |
Confirmed as program decisions: emergency accounts are kept out of every dynamic rule and wave, and excluded from the phishing-resistant authentication-strength policies; IP-restricted anonymous relay is the preferred relay method for a gMSA workload; SD-WAN’s break-glass path is a local AAA account plus out-of-band access; the DirectAccess retirement keeps its rollback steps; 802.1X behavior when RADIUS is unreachable is set and tested per vendor; the backout triggers in the thirteen implementation guides stand; and the Zero Trust mapping block doesn’t apply to emergency calling. |
| Rationale |
Each position protects a way back or a way in when something fails, and each chapter gives its reason; confirming them stops them being read as optional. |
| Basis |
Workbook design |
| Sources |
None external: the choice rests on the pages it shaped. |
| Pages affected |
Chapter 10 — Deploying to Test and Production, HR-Driven Identity: An Implementation Guide, Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities, Building Network and Transport’s SD-WAN Design on Cisco Catalyst SD-WAN, Chapter 05 — SD-WAN, SASE and Governed-Path Transport, Chapter 07 — Network Access Control: 802.1X and RADIUS, Chapter 05 — The Service Catalogs: ITSM and Teams Telephony, Ansible for Configuration Automation, Azure Arc Track: Implementation Guide, Attribute-Driven Migration: An Implementation Guide, Distribution Point Consolidation: An Implementation Guide, Building HR-Driven Identity’s HR Pipeline: Oracle Fusion Cloud HCM to Microsoft Entra ID, Intune Track Implementation: Attribute-Driven Management of End-User Devices, Non-Person Identity: An Implementation Guide, Privileged Access: An Implementation Guide, Provider Notices: An Implementation Guide, Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. |
Agree, disagree or send evidence on WD-150
WD-151: Does the synchronization-account location restriction get a number in the Conditional Access library?
| Options considered |
Leave it as an unnumbered procedure in Identity and Directory; Number it in Access and Privilege’s library |
| Choice |
It is CA039-SyncAccounts-LocationRestriction, in wave 4, with two forms under one number: a user form for the Directory Synchronization Accounts role while any legacy connector account exists (Entra ID P1, emergency access group excluded by the library’s convention) and a workload form, CA039-SyncSP-LocationRestriction, for the Connect Sync service principal (Workload ID Premium). Both block any location except NL-SyncServerEgress and start in report-only. |
| Rationale |
Microsoft’s Zero Trust guidance says the directory sync account should be locked down to named locations; a numbered policy is exported, reviewed and drift-checked with the rest of the library. A Conditional Access policy targets either users or workload identities, so one number carries two forms. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Configure Microsoft Entra for Zero Trust: Protect identities and secrets; Microsoft Learn, Microsoft Entra Conditional Access for workload identities |
| Pages affected |
Chapter 07 — The Conditional Access Policy Library, Appendix A — Conditional Access Policy Templates, Chapter 09 — Building the Entra ID Target |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. Extends WD-026’s numbering. |
Agree, disagree or send evidence on WD-151
WD-153: Does the Windows LAPS policy move to automatic account management?
| Options considered |
Manual mode on the built-in Administrator; Automatic mode, built-in account, name randomized; Automatic mode, custom account, built-in Administrator disabled; As the previous option, with the managed account disabled until needed |
| Choice |
ES-006 moves to automatic account management with a custom managed account (FMPLocalAdmin, enabled, name not randomized) and the built-in Administrator disabled. Devices below Windows 11, version 24H2 keep the earlier manual-mode profile until they cross the floor; the move runs through the hardening rings with a rollback to the manual profile. |
| Rationale |
Microsoft recommends automatic mode at all times except rare cases, targeting a custom account with the built-in Administrator left unused and disabled. CP-001’s 24H2 floor means every compliant workstation can take it. |
| Basis |
Microsoft Learn |
| Sources |
Microsoft Learn, Windows LAPS account management modes; Microsoft Learn, Configure policy settings for Windows LAPS; Microsoft Learn, Windows Local Administrator Password Solution in Microsoft Entra ID |
| Pages affected |
Chapter 08 — GPO to Intune Policy Migration |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. Learn doesn’t state automatic mode’s availability by cloud; the GCC High or DoD pilot confirms it. |
Agree, disagree or send evidence on WD-153
WD-154: How are group managed service accounts created and restricted?
| Options considered |
Leave the three questions open; Adopt the guide’s three recommendations |
| Choice |
gMSA containers run only on domain-joined hosts; a gMSA whose workload holds no SPN is created outbound-only (-RestrictToOutboundAuthenticationOnly) by default; and creating gMSAs is a right delegated on the service-account OU, not a Domain Admins task, with Domain Admins kept for the dMSA steps Learn says need it. |
| Rationale |
Learn’s pattern for non-domain-joined container hosts brings back a stored domain password; outbound-only removes inbound authentication a no-SPN service doesn’t need; and Learn allows the delegated create right, which keeps day-to-day work out of Domain Admins. |
| Basis |
Workbook design |
| Sources |
Microsoft Learn, Manage group Managed Service Accounts; Microsoft Learn, Create gMSAs for Windows containers |
| Pages affected |
Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities |
| Date |
2026-11-11 |
| Status |
settled |
| Defined in |
— |
| Note |
Basis: workbook owner decision, November 11, 2026. The Non-Person Identity kit’s Chapter 06 write path still names Domain Admins or a delegated right; naming the delegated group there is a kit change, not made here. |
Agree, disagree or send evidence on WD-154