Federal Modernization Workbook · Book 01
Book 01 — The Transformation Arc
Client-Server to Hybrid Cloud
Client-server to hybrid cloud: why modernization is so hard, what changes across identity, policy, services, compute and access, who leads it, and how to analyze, plan and deliver it in gated phases
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s Client-Server to Hybrid-Cloud series, the Modernization Journey whitepaper, the modernization overview page and an earlier copy of the series’ opening chapters. Every external claim was checked against a primary source on October 20–25, 2026 and carries a footnote. The earlier pages are kept in the repository’s archive/b01-transformation-arc/ folder, and their old addresses forward to the chapters that replaced them.
The Federal Modernization Workbook is independent guidance. It isn’t federal policy or an official government publication. Where it says a federal document requires something, it cites that document, and the document governs; Appendix A maps each requirement to its source. The program design (the five prerequisites, the gates, the phases and the rollback points) is the workbook’s own recommendation. The target state assumes Microsoft’s cloud: Microsoft Entra ID, Microsoft Intune, Azure Arc and the Microsoft 365 government clouds. Appendix B says where that applies and what changes on other platforms.
b01-transformation-arc-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 15 minutes narrated): the Why / What / Who / How deck and its narrated, self-running edition, with built-in captions, are on the Presentations page.
Executive briefing (about 30 minutes live, 25 narrated): the transformation at decision level, who leads it and the roadmap’s gates, on the Presentations page.
Most agencies run on a client/server estate built around Active Directory, and for twenty years that directory quietly did governance nobody wrote down. Where a user or a computer sat in the tree decided what it could reach, which settings it received and who could change it; its domain controllers answered names, issued certificates and authorized network access. Moving to cloud identity, cloud device management and hybrid operations removes that machinery piece by piece, and each piece fails in its own way, often long after the cutover is declared done. That is why modernization is hard: it is a governance rebuild, not a platform swap. This book is the arc of that rebuild from end to end. It analyzes the estate before anything moves, plans the work as gated phases with a rollback at every step, and treats leadership’s job as conducting the orchestra rather than playing the instruments. It is also the map of the workbook: each chapter carries the argument at the level of the whole program and links the book that owns the detail.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why is modernization so hard, and what governance was hiding in the directory? | 01, 02 |
| What | What changes: the platform foundation, identity, policy, network services, compute and the access plane | 03, 04, 05, 06, 07, 08 |
| Who | Who leads, decides and does the work across the program | 09 |
| How | Analyze the estate, turn the analysis into a plan and deliver it, and follow the migration roadmap | 10, 11, 12 |
Appendices: A — Requirements mapping · B — Applicability
The books behind each chapter
Reading paths
- Executives (20 minutes): Chapters 01, 02 and 09, or the 15-minute presentation.
- Architects: Chapters 01–08, then 12.
- Program managers: Chapters 09–12, with Appendix A.
- New to the workbook: this book first, then the book for your part of the estate.
Where this book sits in the workbook
This is Book 01 of the Federal Modernization Workbook, and its overview. The other published books each take one part of the arc and carry it in depth; see the table above.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Why Modernization Is Hard | A plain-language account of how federal IT reached its current shape, why the move to cloud identity keeps stalling, what the session-to-token shift and the physics of distance actually change, and the five prerequisites the rest of the book turns into work. |
| Chapter 02 — The Problem: Governance Hidden in the Directory | Why Active Directory was the implicit governance model for every Windows-era service, the eleven categories of object it governs silently, why the OU tree was the governance tree, why naive migrations fail, what the program provides, and the dependency chain the rest of the book follows. |
| Chapter 03 — The Platform Foundation | The single governed host that runs every analysis, plan, delivery and evidence step: its five roles, why one authoritative writer matters, how governance stays separate from execution, its integrations, and what it is not. |
| Chapter 04 — Identity Transformation | How the OU tree’s hidden governance becomes explicit in a flat cloud directory: HR-sourced attributes, dynamic groups, administrative units and Conditional Access bound into one model, the move from session-based to token-based identity, the joiner-mover-leaver lifecycle, drift, and the phased migration. |
| Chapter 05 — Policy Transformation | How twenty-five years of Group Policy is regenerated, not copied, into Intune configuration and compliance policies, Conditional Access and Azure machine configuration, with one owning layer per setting, staged testing and a governed retirement of the last GPOs. |
| Chapter 06 — Network Services: DNS, DHCP and IPAM | Why DNS, DHCP and IP address management move together and with the directory, how AD-integrated DNS gives way to governed on-premises authority and Azure private resolution, what AD authorization of DHCP does and doesn’t do, and why one IPAM authority must own the address space. |
| Chapter 07 — Compute Transformation | How domain-joined PCs move to Microsoft Entra join and Intune, how servers come under Azure Arc and machine configuration, why hybrid join is a waypoint, what Kerberos and NTLM dependencies must be resolved before any server leaves the domain, and how device lifecycle becomes policy. |
| Chapter 08 — The Access Plane | How the identity-bound access plane replaces the Active Directory network perimeter: Zero Trust as the model, Conditional Access as the decision, SASE as the edge, phishing-resistant MFA and Entra certificate-based authentication as the proof, privileged access without standing rights, continuous access evaluation, and token-based access at the mainframe boundary. |
| Chapter 09 — Who Leads the Transformation | Who leads, decides and does the work across the whole modernization program: the executive sponsor and CIO, the CISO and authorizing official, the program office, platform teams, application owners, the help desk, HR and records; why Microsoft supplies the instruments but not the orchestra; and where each book in the workbook assigns ownership for its own domain. |
| Chapter 10 — Analyzing the Estate | How the Federal Modernization Program inventories a client/server estate before anything moves: a read-only, least-privilege, provenance-bound assessment that produces one versioned artifact set across eleven dependency categories, plus the transaction profile that decides which applications may leave their data. |
| Chapter 11 — Analysis, Plan, Delivery | The transformation engine: how a committed assessment becomes governed change on the target surface through three stages (Analyze, Plan, Deliver), two gates, separate governance and execution identities, an actuation ceiling per operation class, rollback, and an evidence packet for every run. |
| Chapter 12 — The Migration Roadmap | The program view of the whole transformation: the structural move and five principles behind it, seven gated phases with five parallel workstreams, mechanical gate criteria, rollback triggers and gate authority, the FedRAMP and federal clocks the roadmap runs against, and where to start. |
| Appendix A — Requirements Mapping | A compliance-enabling map, not a compliance claim: each federal requirement the transformation touches (EO 14028, OMB M-22-09 and M-26-14, CISA BOD 25-01 and the Zero Trust Maturity Model, NIST SP 800-207, SP 800-63-4 and SP 800-53 Rev. 5, the Evidence Act and FedRAMP’s Consolidated Rules), what it actually asks, where Book 01 addresses it, the book that closes it, and the evidence it calls for; then the requirements that are often cited for this arc but don’t say what is claimed. |
| Appendix B — Applicability | Which environments the Book 01 target state assumes and where it doesn’t apply as written: commercial cloud and GCC Moderate, GCC High and DoD, air-gapped enclaves, and OT and 802.1X networks; the platform and licensing assumptions; and what the book is and isn’t. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 01: fix confirmed crosswalk errors (appendix A rows, Ch 05, 07, 08, 09, 10, 11, 12) (#376); Book 01: resolve inconsistency findings (14 fixed, 4 held for decision) (#424); Books 00-03: decision fixes (AU naming, tiers, durations, drift ceilings, figures, ownership) (#452); Claim language: supports, not satisfies (rule, check, first sweep) (#474); Consistency read A (Books 00-04): risk-tier notation, memberOf, emergency accounts (#482); Decisions of Nov 8, items 1-9 (Books 00-08) (#486); and 2 more (all changes) |
| 1.4 | 2026.11.4 | 2026-11-05 | Sweep stale wording, and link sources on every deck (#361) |
| 1.3 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344); Windows Server standard across the books, guide, Arc policy and endpoint plan (#353); Decks and narration: the Windows Server standard in ten decks (#355) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (20 merged changes since the book began) |