Federal Modernization Workbook · Book 15
Book 15 — Compliance Automation & Day-2 Operations
Where Modernization Becomes Routine
Why modernization succeeds or fails at the help desk: intake and triage, help-desk authority in Entra ID, the service catalogs, SaaS integration governance, the CMDB, control compliance automation across clouds, who runs day two, attestation, the operator runbook, and provider notices
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Chapter 14, on provider notices, was added after Release 2.0 and is a draft until the next baseline edition, as is Appendix B, the recovery and escalation runbooks. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s help-desk Entra operations guide, the day-two operator runbook, the ServiceNow compliance-kit roadmap, and the Federal Compliance series’ implementation, automation and day-two operations volumes that cover the help desk, ITSM and telephony catalogs, SaaS integration, the CMDB, control compliance automation, attestation, the evidence pipeline and validation harnesses. Every external claim was checked against a primary source between October 21 and November 2, 2026, and each note carries its own date. The replaced pages are kept in the repository’s archive/b15-day2-operations/ folder, and their old addresses forward to the chapters that replaced them.
The kit applies this book’s help-desk model: five Word documents (the intake and routing flow, the administrative responsibilities guide, the application access governance model, the governance structure brief, and the implementation path and run guide that shows how to run the scripts), the routing matrix as a PowerShell module, the scripts with plain-text copies for mail systems that block .ps1 files, and Pester tests that need no tenant. Its read-only app inventory also flags apps consented to act as every user, the Entra ID counterpart of the Start Kit’s unconstrained-delegation check. Download helpdesk-entra-operations-kit.zip (SHA-256 5d00dce2008ba01d73cbe15c782153d7d0c8c786ce6c81ccd474220035181676); the release page lists every change. The scripts are not tenant-tested, so run every change script with -WhatIf first.
b15-day2-operations-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 12 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Technical deep dive (about 50 minutes live, 20 narrated): intake and triage, help desk authority in Entra ID, catalogs and the CMDB, and control automation, in modules on the Presentations page.
Executive briefing (about 30 minutes live, 14 narrated): for the CIO, service owner, help desk and operations leads and the CISO: the help desk as the risk point, one front door, executors who never decide, reconciled inventory, measuring day-two health and buying native compliance apps first, with each decision’s owner and timing, on the Presentations page.
In-house automation executive briefing (about 9 minutes narrated): for Chapter 13, building day-two automation in-house when there’s no funding for new products, with a pilot to approve, on the Presentations page.
Draft: the Microsoft automation reference, Module 1: Graph and Azure Foundations and Module 2: Microsoft Entra ID through Microsoft Graph, covers the endpoints, sign-in, permissions and request patterns behind this book’s control automation, with tested read-only checks in Python and PowerShell.
A modernized estate is judged on day two. The test is whether the help desk can reset, unlock, provision and recover safely under the new model, without becoming the easiest way in: help desks are a favored target for social engineering, and NIST’s recovery guidance and CISA’s advisories say so plainly. It is also whether every request reaches one front door, is routed by its authority class, is approved by the right person and leaves evidence behind; whether the CMDB knows what exists; and whether control evidence is produced continuously by automation in each cloud rather than assembled before an audit. Book 15 is about that work. It sets out the help desk’s least-privileged roles in Entra ID and the identity checks that come before any sensitive action, the service catalogs, the governance of SaaS integrations, the CMDB as a reconciled projection of authoritative sources, and control compliance automation for Microsoft 365, Azure, AWS and VMware. It is candid about what each platform already provides, including the ITSM platform’s own compliance and continuous-monitoring applications, and builds only what they lack, and, where there is no money to buy them, how the agency’s own staff can build the essentials safely. Operations is where modernization either becomes routine or quietly reverts.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why does modernization succeed or fail at the help desk, and why is day two where compliance lives or dies? | 01, 02 |
| What | Intake and triage, help-desk authority in Entra ID, the service catalogs, SaaS integration governance, the CMDB, and control compliance automation across clouds | 03, 04, 05, 06, 07, 08, 09 |
| Who | Who executes, who approves, and who owns each catalog, runbook and record | 10 |
| How | Attest and evidence controls through the compliance application, run the day-two runbook with harnesses that test the automation itself, build the automation in-house when there is no funding for new products, and own every provider’s notices through to closure | 11, 12, 13, 14 |
Appendices: A — Help desk task reference · B — Recovery and escalation runbooks
Reading paths
- Executives (20 minutes): Chapters 01, 02 and 10, or the 15-minute presentation.
- Service desk managers and staff: Chapters 03 and 04, with Appendices A and B.
- ITSM and ServiceNow platform teams: Chapters 05, 07, 11 and 13.
- Cloud and platform engineers: Chapters 06, 08, 09 and 14.
- Operations leads and ISSOs: Chapters 10, 11, 12 and 14.
Where this book sits in the workbook
This is Book 15 of the Federal Modernization Workbook. Privileged access and the help desk’s role tiers are in Book 04; routine remediation as a ticket to a machine, and the governance roles, in Book 13; the evidence contract and security operations in Book 12; and the authorization package and continuous monitoring in Book 14. Training for the help desk and the wider workforce is Book 16.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Modernization Succeeds or Fails at the Help Desk | Why a modernized estate is judged on day two rather than at cutover: the help desk holds the most dangerous routine actions in identity, attackers know it, and federal guidance treats recovery as a bypass to be guarded; what the help desk must be able to do safely under the new model; and how routing, authorization and evidence decide whether modernization becomes routine or quietly reverts. |
| Chapter 02 — Day Two Is Where Compliance Lives or Dies | Why a control that is designed and deployed still decays unless the day-two work that touches it is routed, authorized and evidenced by automation; what SP 800-53 asks of account, authenticator, change and inventory management and of continuous monitoring; the program’s deploy model and coordination contract, with the service management platform coordinating and native tools actuating; and the day-two operating model the rest of the book builds. |
| Chapter 03 — Intake, Triage and Routing | How a request reaches the help desk, how it is triaged by the authority the task needs, who approves and who executes, how it is routed to the ITSM or identity-governance pipeline, how the person is verified before a reset or recovery, and the evidence every ticket leaves behind. |
| Chapter 04 — Help Desk Authority in Entra ID | The help desk’s authority model in Microsoft Entra ID: which built-in roles fit help desk work and whose credentials each can touch, scoping with administrative units and restricted management units, PIM activation, Temporary Access Pass and MFA re-registration, and the high-risk tasks that need a second approver. |
| Chapter 05 — The Service Catalogs: ITSM and Teams Telephony | The help-desk catalog that turns everyday identity work into typed, approved and evidenced requests; the five verbs every identity change reduces to and the checks that close each one; and the Teams Phone catalog for numbers, calling policy, voice routing and emergency calling, including what Kari’s Law and the FCC’s dispatchable-location rules ask of a multi-line telephone system’s operator, why the agency configures as if they bind it, and what remote softphone users need. |
| Chapter 06 — SaaS Integration Governance | Why connecting a third-party SaaS application to Entra ID is the densest control-closing moment in the identity estate; the authorization check against FedRAMP Marketplace data that has to come before any configuration; what consent restriction does and doesn’t settle; OAuth application risk and app governance in the government clouds; how single sign-on and SCIM provisioning close account-management controls; a seven-phase catalog from request to offboarding; the least-privilege actuation surface; and the ongoing review that keeps an integration authorized. |
| Chapter 07 — The CMDB and Asset Identity | The CMDB as the operational inventory every ticket, change and finding routes to: how it is populated by discovery and service graph connectors, how the platform’s identification and reconciliation engine and the program’s reconcile pass keep it bound to one authoritative asset identity, what CM-8 and its enhancements ask of it, how duplicate and stale configuration items are found and retired, and why patching and evidence fail without it. |
| Chapter 08 — Control Compliance Automation: Microsoft 365 and Azure | How control evidence is collected automatically from Microsoft 365 (ScubaGear, Microsoft Graph, Purview audit, Purview Compliance Manager) and Azure (Azure Policy regulatory compliance initiatives such as the FedRAMP Moderate built-in, Defender for Cloud regulatory compliance, Azure Resource Graph), how the results reach the IT service management and compliance platform as owned work, what each feature does in the government clouds, and where ServiceNow’s own compliance products already cover part of the design. |
| Chapter 09 — Control Compliance Automation: AWS and VMware | How control evidence is collected automatically from AWS (AWS Config conformance packs, Security Hub CSPM and the new Security Hub, Systems Manager Patch Manager, and why AWS Audit Manager is no longer a foundation to build on) and from the agency’s own VMware estate (vSphere Configuration Profiles, vSphere Lifecycle Manager images, VCF Operations compliance and Security Posture Management, Broadcom’s hardening guide and the CIS ESXi benchmarks), what each does in AWS GovCloud (US), the AWS commercial Regions and on premises, how each feeds the same evidence contract, and where the on-premises virtualization layer leaves an evidence gap the agency has to close itself. |
| Chapter 10 — Who Runs Day Two | The roles that run day-two operations (the service desk lines, identity operations, platform owners, the ITSM platform team, the CMDB owner, the change advisory board, security operations, the ISSO and the authorizing official), who executes, who approves and who owns each catalog item and runbook, where those roles come from in NIST guidance, and a responsibility matrix consistent with the program’s other Who chapters. |
| Chapter 11 — Attestation, Evidence and the Compliance Application | How a closed remediation task becomes an assessed control: system evidence first and human attestation only where no system can prove the control, the four-step attestation loop behind CA-2, CA-5 and CA-7, what ServiceNow’s own compliance and continuous-authorization applications already provide, the program’s compliance application as one way to fill the gaps, and the evidence and continuous-monitoring pipeline that carries it all into the authorization package. |
| Chapter 12 — The Day-Two Operator Runbook and Validation | The operator’s runbook for a governed estate: the daily, weekly, monthly and quarterly steps, what each proves and which control it supports, the governed procedure for the eight everyday tasks that most often arrive ungoverned, and the validation and test harnesses that check the automation itself so a silent failure becomes a loud one. |
| Chapter 13 — Building Day-Two Automation In-House | When there is no funding for new licenses or a vendor, how federal staff can build the compliance application on the ServiceNow instance the agency already owns: what that does and doesn’t replace, AI-assisted development under the agency’s AI-use policy with a named reviewer for every line, a sandbox-to-production path under change control mapped to NIST’s SSDF and its generative-AI profile, who writes, reviews, approves and operates, and the audit evidence the development path itself produces. |
| Chapter 14 — Provider Notices in Day-Two Operations | The notices cloud providers send about the agency’s own tenant, account, tenancy or project, and why they go unread: the six kinds of notice (maintenance, retirement, advisory, security, change and incident) across Azure, Microsoft 365, Oracle Cloud Infrastructure, AWS and Google Cloud; who owns each kind under this book’s roles; how a notice becomes a task in the front door and closes only on a re-read; the weekly digest; the evidence and the federal requirements it supports; government-cloud availability; and where the provider notices guide and kit fit. |
| Appendix A — Help Desk Task Reference | Task-by-task reference for help desk identity work in Microsoft Entra ID: the least-privileged role, scope, approval, verification and evidence for each task, the escalation matrix, OneDrive triage, and read-only pre-check scripts. |
| Appendix B — Recovery and Escalation Runbooks | Identity-proofing and escalation runbooks for the help desk’s six hardest calls: a lost passkey, a Windows Hello for Business reset, a replaced device, a BitLocker recovery key, an emergency access account incident and a user blocked by Conditional Access. Each runbook gives the trigger, the identity check, who executes and who is escalated to, copy-paste commands, and the evidence; then the help-desk simulation that tests them, government-cloud availability, and the control states, change safety and assessment mapping. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 15: fix confirmed crosswalk errors (admin consent chain, Tier 1 notice, per-user MFA role, federated reset, CA exclusions, evidence record) (#403); External Partner Person: light edits to existing pages, held findings, links (E0 to E9) (#419); External Partner follow-up: ch10 stages and TAP lifetime, guest-invitation decider, control-support wording (#420); Book 15: settle 33 inconsistency findings (contract values, read-only rule, approvers, terms, pointers) (#435); Decisions fix pass for Books 13 to 19: Book 18 gates and roles, Db2 spelling, Book 15 approvers, Book 16 criteria, Book 17 roles, Book 13 drift mapping (#456); Claim language: supports, not satisfies (rule, check, first sweep) (#474); and 4 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Section 508: accessibility gates in Books 18 and 16, notes in Books 04 and 15 (#314) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269); Content rules: one home per type, and the federal layers every guide carries (#271) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (24 merged changes since the book began) |