Vol IX Book 01 — Federal Compliance — Helpdesk & ITSM Catalog
The common Entra · M365 · Azure operator tasks as governed, control-mapped ServiceNow catalog items
0.1 Draft Proposal — Subject to Review
Developed by the CSI Team (Cloud Services Infrastructure); not yet reviewed or approved by the Agency CIO Office, OIS, or leadership. Date Code: 2026-07-21 14:46 ET
Series Context — Volume IX Book 01. The highest-volume day-2 surface: the everyday Entra / M365 / Azure help-desk requests — joiner/mover/leaver, credential resets, group and license grants, guest invites. This book turns each into a typed, control-mapped ServiceNow catalog item actuated through the in-boundary MID, so routine operations produce compliance evidence instead of eroding it.
1 What This Document Addresses
A service desk performs hundreds of identity changes a week. Each one — a new account, a password reset, a group add — is a change to an identity-attributed surface that a control governs (AC-2, IA-5, AC-6). Performed as a portal click by a standing-admin operator, it is ungoverned, unevidenced, and least-privilege only by hope. Multiplied across a week, that is the largest continuous source of control erosion in the estate.
This book expresses those requests as governed catalog items. The machine-readable binding lives in servicenow-day2/helpdesk-control-map.json — each item mapped to its control, approval gate, KSI, and evidence slot, a projection of the compliance spine and CI-checked against it.
2 The Catalog
Ten items across three families. Each is a request, not a click; each carries the approval gate its control requires.
| Catalog item | Control | Approval gate | Note |
|---|---|---|---|
| New account (Joiner) | AC-2 | manager + identity | Provision from the HRIT SSOT (Vol I Book 04); least-privilege baseline |
| Role/scope change (Mover) | AC-6 | manager + identity | Access review on change; remove stale entitlements |
| De-provision (Leaver) | AC-2 | manager + identity | Evidenced: disable, revoke sessions, reassign owned objects |
| Password reset | IA-5 | self-service / service-desk | SSPR where policy allows; else identity-verified gate |
| MFA-method reset | IA-5 | service-desk + verify | Identity-proofing required; log + alert (social-engineering target) |
| Account unlock | IA-5 | self-service / service-desk | Repeated unlocks are a Vol VI Book 03 detection signal |
| Group membership | AC-6 | owner + approver | Time-bound where elevated; access-review linked |
| License assignment | AC-2 | manager | Group-based licensing preferred |
| Conditional-Access exception | AC-3 | security approver | Reuse Vol VII Book 02 — mandatory expiry + review |
| Guest / B2B invite | AC-2 | sponsor + security | Sponsor + expiry |
Reuse, don’t reinvent. The Conditional-Access exception item is the same pattern Vol VII Book 02 already models (mandatory break-glass exclusion, expiry, access review). The help-desk catalog invokes it; it does not fork a second CA-exception path.
3 The Request Loop
Every item runs the same governed loop — the day-2 analogue of the Vol VII compliance loop:
- Request — a typed catalog item against the reconciled identity CI, with the requester, target, and justification.
- Approve — the gate the control requires (self-service, manager, identity, owner, or security approver — per the control map).
- Actuate — Microsoft Graph through the in-boundary MID Server; the connector holds scoped, logged, individually-approved write — never standing tenant admin (AC-6).
- Evidence — the request, approval, and Graph result become a change record (CM-3 / AU-2) reconciled to the CM-8 CMDB, feeding Vol VII Book 04 attestation.
The leaver is the one that fails audits. De-provisioning is an evidenced obligation, not a courtesy: disable the account, revoke active sessions and refresh tokens, and reassign owned objects (groups, app ownerships, mailboxes). A leaver “done” with no evidence trail is an orphaned-credential finding waiting to happen — the exact gap the audited catalog closes.
4 Identity MACD-R — The Five Verbs at the Help Desk
Every identity operation the catalog fulfills is one of five verbs — a Move, Add, Change, Deletion, or Reset — and each verb travels the full authorized path of the series’ MACD-R Lifecycle Doctrine (Vol 0 Book 00): SSOT-originated, authoritatively authorized, executed under a just-in-time scoped role, closed with provenance, and emitting evidence automatically. The verbs differ in what originates them, what the closure probe must verify, and which controls they exercise:
| Verb | Identity meaning | SSOT origin | Closure probe verifies | Controls exercised |
|---|---|---|---|---|
| Add | Joiner: account provisioned, groups/licenses derived, MFA registered, SCIM fan-out to federated apps | HR joiner event | Account exists with exactly the derived entitlements; MFA method registered; every SCIM-connected app provisioned | AC-2, IA-4, IA-5 |
| Move | Mover: role/unit change → attributes updated, group and license membership re-derived, app access re-evaluated | HR mover event | New derivation matches the SSOT record; stale entitlements from the old role removed | AC-2, AC-6 |
| Change | Entitlement or attribute change outside a role move: access requests, group adds, delegation grants | Governed request resolved against the SSOT record | The granted scope equals the approved scope — nothing broader | AC-2, AC-6 |
| Deletion | Leaver: disable, revoke sessions and tokens, deprovision every federated app, reassign owned objects — including the leaver’s anchored non-human estate (owned service accounts and app registrations transfer per the Human-Anchor Rule) | HR leaver event | Account unusable everywhere; zero live sessions; SCIM deprovisioned in each connected app; no orphaned objects or ownerless non-human identities | AC-2, AC-2(3), IA-4 |
| Reset | Credential events: password reset, MFA method reset, session revocation | Governed request against the SSOT identity | Re-proofing performed to policy before issuance; new credential meets IA-5; old credential unusable | IA-4, IA-5, AC-2 |
Reset is the highest-risk verb, and it is the one attackers order from the help desk. A password or MFA reset re-issues the keys to an identity on the strength of a phone call — the classic help-desk social-engineering entry. The catalog’s Reset items therefore gate on identity re-proofing to policy (IA-4 discipline: verified against the SSOT record, not caller-supplied facts), execute under a scoped just-in-time role, and close only on a probe confirming the old credential is dead and the new one meets policy. A Reset closed manually, with no re-proofing payload, is precisely the closure the Closure Provenance Doctrine refuses to count.
The matrix is the doctrine made operational: the five verbs are the same five the SSOT Registry (Vol 0 Book 00) governs for every object class — what changes at the help desk is only the class (human identities here, their anchored non-human estate on the Deletion row) and the probes.
5 Closure Necessity
5.1 Closure Necessity — the help desk is a control surface, not a convenience
Volumes I and VII establish that verified identity, phishing-resistant auth, and least privilege are the mechanisms. This book makes the routine exercise of those mechanisms governed and evidenced. Without it, AC-2, IA-5, and AC-6 are eroded a hundred small clicks at a time — each unlogged, each least-privilege by hope. The catalog does not add a new control; it stops the highest-frequency operations from quietly dismantling the ones already claimed.
7 Honest Limits
- Self-service items (SSPR, unlock) are only as strong as the tenant’s authentication-method policy; a weak SSPR policy is a Vol VI Book 02 configuration concern, not a catalog fix.
- The catalog governs the request; a standing global administrator can still act out of band — Vol VII Book 02 detections and access reviews catch that.
- Substituting the ITSM platform changes the catalog and connector syntax; the request→approve→actuate-via-MID→evidence discipline is invariant.
8 Cross-References
servicenow-day2/helpdesk-control-map.json— the machine-readable catalog → control binding this book documents.- Vol I Book 04 (HRIT Identity SSOT) — the identity source of truth the JML items provision from.
- Vol VII Book 02 — the Conditional-Access exception pattern this catalog reuses; Vol VII Book 04 — where the audited actions become attestation.
- Vol IX Book 03 — app-registration governance (service-principal identity lifecycle, the machine analogue of JML).
9 Provenance
Draft. ServiceNow, Microsoft Graph, and Entra are deployed examples; the request→approve→actuate-native→evidence discipline is the invariant. Vendor claims cite vendor documentation. The figure above is authored as committed house-style SVG, rendered to PNG at 3× for crisp .docx zoom.