Book 02 — Identity & Directory

Active Directory to Entra ID: why identity matters, what changes, who owns it, and how to do it

Book 02 of the Modernization Workbook: why identity is the control plane of a modern federal estate, how Active Directory and Entra ID differ, the hidden dependency surface and delegation model, who owns which decisions, and the discovery, assessment, build and migration steps, with a reference deployment and federal requirements crosswalk.

Book 02 — Identity & Directory: Active Directory to Entra ID

Status — draft book

This book consolidates twenty-two earlier workbook pages on identity and directory modernization (whitepapers, operational guides, reference architecture, learning pages and framing case studies) into one ordered book. Every external claim was checked against a primary source on October 20, 2026 and carries a footnote. The earlier pages are kept in the repository’s archive/b02-identity/ folder, and their old addresses forward to the chapters that replaced them.

Download and present

b02-identity-bundle.docx: the whole book as one Word document, regenerated on every site deploy.

15-minute presentation: the Why / What / Who / How deck and its narrated, self-running version are in the repository under presentations/b02-identity/.

Every access decision in a modern federal estate starts with a question about identity: who is this, is the claim about them still true, and what is this device or workload allowed to do? For twenty-five years Active Directory answered those questions inside the network perimeter, and it quietly took on much more: DNS, certificates, Wi-Fi and VPN authentication, file shares, time, application logins, and the organization chart encoded as OUs. Zero Trust moves the decision to the identity provider and evaluates it on every request. Moving from Active Directory to Entra ID is therefore not a directory upgrade. It decides whether every later control works.

Why, what, who, how

	Question	Chapters
Why	Why does identity matter, and why can’t AD simply be lifted into the cloud?	01, 02
What	What actually changes: the concepts, the hidden dependencies, the delegation model	03, 04, 05
Who	Who decides, who does the work, and which tools do what	06
How	Discover, assess, build the target, migrate and govern, with a reference deployment	07, 08, 09, 10, 11

Appendices: A — Federal requirements crosswalk · B — Forest assessment module · C — Identity assessment module

Reading paths

Executives (20 minutes): Chapters 01, 02 and 06, or the 15-minute presentation.
Architects: Chapters 01–06, then 11, then Appendix A.
Engineers running the work: Chapters 03–05 for the model, then 07–10 with Appendices B and C at hand.

Where this book sits in the workbook

This is Book 02 of the Modernization Workbook. The workforce side of identity, with HR as the source of authority, is in HR-Driven Identity. The SQL Server estate’s move off Windows authentication is in the SQL Server Identity Transformation series.

Chapters

Title	Description
Chapter 01 — Why Identity Matters	Why identity is now the control plane for access, what twenty-five years of Active Directory accumulated, why the move to Entra ID is forced by federal policy and by Microsoft’s product direction, and what a lift-and-shift migration puts at risk.
Chapter 02 — The Structural Problem	Why Active Directory’s forest, domain, OU and Group Policy hierarchy doesn’t map onto a flat Entra ID tenant governed by attributes, why session-based trust collides with continuous verification at the FedRAMP boundary, and why the migration has to be run as a governance and single-source-of-truth event.
Chapter 03 — Active Directory and Entra ID, Side by Side	The foundational crosswalk between the Active Directory world and the Microsoft Entra ID world: trust roots, protocols, cryptography, tooling, the eight core concepts of directory migration, and why the shift is a protocol and governance change rather than a tooling swap.
Chapter 04 — The Hidden Migration Surface	Everything that depends on Active Directory beyond users and groups: the eleven dependency object types, the eight migration adapters and their priority, the six-phase adapter model, adapter registration, post-migration validation, and the transformation inventory.
Chapter 05 — Delegation Without OUs	How administrative delegation works once the OU tree is gone: the three-tier model, administrative units including dynamic and restricted management units, the role assignment matrix, delegation principles, and drift detection.
Chapter 06 — Who Owns the Migration	Who decides, who does the work and who is consulted in an Active Directory to Entra ID migration, and which Microsoft-native tools the program consumes, where they stop, and what the program builds to fill the gaps.
Chapter 07 — Read-Only Discovery	How to start an Active Directory assessment before any elevated access is granted: what a standard account can and can’t read by default, how to record the gaps, how to ask for a narrow delegation, and how to protect what the assessment produces.
Chapter 08 — Assessing the Forest	The full forest assessment: prerequisites, topology and operations master discovery, OU and delegation extraction, GPO, DNS and AD CS analysis, computer, user, group and trust inventories, and the pipeline that commits every run to a versioned evidence repository.
Chapter 09 — Building the Entra ID Target	How to decompose the Active Directory identity model and rebuild it in Microsoft Entra ID: the object model and licensing, the sync engine and sign-in method decisions, groups, service accounts, privileged access, and the Conditional Access framework.
Chapter 10 — Migrating and Governing	How to govern the Entra ID target and move onto it: lifecycle workflows, access packages and reviews, cross-tenant collaboration, phishing-resistant authentication against M-22-09 and NIST SP 800-53, monitoring, the eleven-phase migration playbook, Git-based drift detection, and troubleshooting.
Chapter 11 — Reference Deployment	A reference deployment pattern for a federal civilian agency moving two Active Directory forests and a SQL Server estate to Microsoft Entra ID, walked through five phases to the evidence bundle an assessor consumes.
Appendix A — Federal Requirements Crosswalk	Microsoft’s Entra security checklist scored for a federal agency with a long Active Directory history, crossed with the CISA BOD 25-01 required SCuBA policies, the identity modernization specification’s contract requirements, and NIST SP 800-53 Rev. 5 controls.
Appendix B — Forest Assessment Module	The complete FMPADAssessment PowerShell module that Chapter 08 describes, restored and corrected, with installation steps and the assessment output schema with JSON examples.
Appendix C — Identity Assessment Module	Reference material for Chapters 09 and 10: the full Active Directory to Microsoft Entra ID attribute mapping, Conditional Access policy templates in Microsoft Graph JSON, and the FMPIdentityAssessment PowerShell module.