This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Federal Modernization Workbook
Downloads
Every file the workbook publishes: the kits, the Ansible examples, a reference implementation, the nineteen books and the developer workbook as Word documents, and the narrated videos
One place for every Federal Modernization Workbook download: the read-only Start Kit assessment scripts, the read-only validation kit for the track implementation guides, the Copilot agent pack for in-house automation, the Help Desk / Cloud Services Entra ID Operations Kit, the Ansible example playbooks, the application modernization reference implementation, each book as a Word document, and the narrated presentation videos.
Everything here is free to download. The kits rebuilt on every site deploy and the Word editions are built from the same sources as the site, so those downloads match the page you read. The Help Desk kit is a pinned release asset with a fixed hash, so it changes only when a new release is cut.
Kits
Every command in these kits is listed, with what it does and the pages that teach it, in the Command Reference. The labs that use them, chapter by chapter, are on the Labs page.
| Kit | What’s in it | Download |
|---|---|---|
| Start Kit — read-only estate assessment | PowerShell scripts that count the forest, the SQL Server estate, and RADIUS and NPS, with a one-page summary traced to its sources. Read-only by policy; unit-tested against fixtures, not proven against a live estate. Every script also comes as a .txt copy for Copilot and mail systems that block .ps1 files. See Book 00, Chapter 08. |
start-kit.zip, rebuilt on every site deploy from examples/start-kit |
| Validation kit — read-only checks for the track implementation guides | PowerShell checks for the Validate steps in the Attribute-Driven Migration, Intune, Azure Arc and non-person identity implementation guides, plus the HR and dynamic-group checks from the Attribute-Driven Migration guide. They read Microsoft Graph, Azure Resource Graph and, optionally, Active Directory, and each returns a status with its evidence. Illustrative, fixture-tested, read-only; 42 checks. Not proven against a live tenant: run each check first in a test tenant. Every script also comes as a .txt copy for mail systems that block .ps1 files. |
validation-kit.zip, rebuilt on every site deploy from examples/validation-kit |
| Attribute-Driven Migration code — the code behind Book 19 | Every examples folder the nine code chapters of Book 19, Building the Attribute-Driven Migration build on: the HR-to-Entra middleware, the Graph client patterns, the validation kit, dynamic rules as code, the Lifecycle Workflows extensions, Group Policy and machine configuration as code, the Ansible examples and the drift pipeline, with the Microsoft samples each chapter starts from, pinned unmodified with their licenses. Illustrative and fixture-tested; not proven against a live tenant. Every script also comes as a .txt copy for mail systems that block scripts. |
attribute-driven-migration-code.zip |
| Ticket-to-Machine code — the code behind Building Ticket-to-Machine | examples/servicenow-sailpoint: the ServiceNow and SailPoint ISC clients, the typed-finding contract, drift reconciliation, the re-read rule, the evidence export and the one-writer check, with the ServiceNow scripts and SailPoint workflows they mirror. Illustrative and fixture-tested; not proven against a live instance or tenant. See Building Ticket-to-Machine and its learning path. |
ticket-to-machine-code.zip |
| Ticket-to-Machine task catalog — list your agency’s own tasks | A macro-free Excel workbook and CSV template for your agency’s day-to-day Ticket-to-Machine tasks: one row per task with its lane, trigger, drift class, severity, the five request-chain clauses, controls, KSIs and owner. Seven formula checks, 25 fictional worked examples, a Copilot prompt sheet, and check_catalog.py, which applies the same checks to a CSV export and writes a sample ticket contract for each row (it reads its vocabulary from the integration kit’s finding_contract.py, included). Download it at work; nothing comes back. See Building an internal Ticket-to-Machine task catalog. |
ticket-to-machine-task-catalog.zip |
| HR-Driven Identity code — the code behind Building HR-Driven Identity | examples/hr-lifecycle with the folders its seven chapters build on: the HR-to-Entra middleware (hcm-entra), Lifecycle Workflows extensions, dynamic rules, the drift pipeline and the validation kit, with the Microsoft samples they start from, pinned unmodified with their licenses. Read and plan only; fixture-tested, not proven against a live tenant. See Building HR-Driven Identity and its learning path. |
hr-driven-identity-code.zip |
| Privileged Access code — the code behind Building Privileged Access | examples/privileged-access: the privileged inventory, emergency access, Conditional Access for administrators, PIM for Entra roles, groups and Azure resources, access reviews and the evidence run, with the drift pipeline, the validation kit and the Learn pages and samples the chapters start from, pinned unmodified. Read-only unless a step says -Apply against a fixture; not proven against a production tenant. See Building Privileged Access and its learning path. |
privileged-access-code.zip |
| Non-Person Identity code — the code behind Building Non-Person Identity | examples/non-person-identity: the register, ownership and the orphan rule, the migration path matrix, app management policies and rotation, workload identity federation, gMSAs and the Kerberos island, least privilege, Conditional Access for workload identities, AI agent identities and drift, with the drift pipeline, the validation kit and the Learn pages and samples the chapters start from, pinned unmodified. Changes only through reviewed plans; fixture-tested, not proven against a production tenant. See Building Non-Person Identity. |
non-person-identity-code.zip |
| Microsoft Automation code — the code behind the Microsoft Automation learning path | examples/ms-automation: a Graph client for the commercial and government clouds, and equivalent Python and PowerShell read-only checks for Entra ID and Intune, each tied to the policy it evidences, with Microsoft’s Graph snippets pinned unmodified. Fixture-tested, not proven against live tenants. See the learning path, starting with Module 1. |
microsoft-automation-code.zip |
| Cisco Catalyst SD-WAN evidence collector | examples/cisco-sdwan: one Python script that signs in to SD-WAN Manager, makes only GET requests, and writes the ED 26-03 release gate and an evidence file. Tested against mocked responses, not proven against a live fabric; not an endorsement of the product. See the Cisco SD-WAN implementation guide and Book 09. |
cisco-sdwan.zip |
| Distribution point consolidation kit | examples/dp-consolidation: PowerShell scripts for each step of the implementation guide: a read-only inventory of distribution points, boundary groups, site roles, clients and packaging that writes hashed evidence tagged with controls and KSIs; a sizing calculator against 4,000 clients per distribution point; dry-run-by-default change scripts for the hub tier, boundary groups, peer cache and office retirement; and the five retirement gates. Fixture data for a fictional estate runs Lab 1 with no hierarchy. Fixture-tested, not run against a live hierarchy. Every script also comes as a .txt copy. |
dp-consolidation.zip |
| Provider notices code — the code behind the Provider Notices implementation guide | examples/provider-notices: read-only collectors for Azure Service Health, Microsoft 365 Message center and service health, Oracle Cloud Infrastructure Announcements, AWS Health and Google Cloud Personalized Service Health, one normalized notice record, a router that turns notices needing action into Ticket-to-Machine typed tasks (dry run by default), a weekly digest, and hashed evidence tagged with controls and KSIs; the deployment runbook’s scripts; neutral routing templates and Copilot prompts to fill at work; and the Ticket-to-Machine finding contract the router mirrors. Fictional fixtures run Lab 1 with no tenant. Fixture-tested, not run against a live tenant. Every script also comes as a .txt copy. |
provider-notices-code.zip |
| Zero Trust Assessment results kit — the code behind the Zero Trust Assessment implementation guide | examples/zta-results: reads the JSON export Microsoft’s Zero Trust Assessment writes (release 3.1.0), without connecting to a tenant; normalizes every result to Book 11’s seven results, with skipped tests counted apart from failures; writes the closure register, one entry per finding with its finding family, remediation page and ready-for-closure evidence; compares two runs (new, fixed, regressed, still open, no longer evaluated); and records each step as hashed, chained evidence tagged with controls and KSIs. Neutral review and exception templates and Copilot prompts to fill at work. Fictional Contoso fixtures run Lab 1 with no tenant. Fixture-tested, not run against a live tenant. Every script also comes as a .txt copy. |
zta-results.zip |
| Copilot agent pack — Day-Two Automation Builder | Instructions, starter prompts and optional knowledge files that set up Microsoft 365 Copilot as a drafting and review assistant for in-house day-two automation, with a 17-test acceptance test to run before anyone relies on it. The agent drafts; people review, test and approve. Checked against Microsoft’s Agent Builder limits, not yet built in a live tenant. See Book 15, Chapter 13. | copilot-agent-pack.zip, rebuilt on every site deploy from examples/copilot-agent-pack |
| Help Desk / Cloud Services Entra ID Operations Kit v1.6.2 | Five Word documents (intake and routing flow, administrative responsibilities, application access governance, governance structure brief, and the implementation path and run guide for the scripts), the routing matrix as a PowerShell module, the scripts with plain-text copies for mail systems that block .ps1 files, and Pester tests that need no tenant. Its read-only app inventory also flags apps consented to act as every user, the Entra ID counterpart of the Start Kit’s unconstrained-delegation check. Applies the help-desk model in Book 15. Not tenant-tested: run every change script with -WhatIf first. |
helpdesk-entra-operations-kit.zip · release notes SHA-256 5d00dce2008ba01d73cbe15c782153d7d0c8c786ce6c81ccd474220035181676 |
| Ansible examples — CMDB-driven inventory, assessment, Arc onboarding and drift | A dynamic inventory that reads a CMDB export and groups hosts by coverage tier, platform and configuration owner, and six small playbooks: the CM-8 inventory feed with Azure Arc agent status, Arc onboarding gated by check mode and an explicit confirm_change=true, a Linux baseline drift check pinned to check mode, read-only Cisco IOS and Infoblox NIOS facts, an Arc wave plan, and the same onboarding waves through Microsoft’s own Arc role. Clean under ansible-lint (production profile) and yamllint, with tests that fail on any ungated write; run against a test control node, not proven against a live estate. See the companion guide Ansible for Configuration Automation. |
ansible-examples.zip, rebuilt on every site deploy from examples/ansible, with a .txt copy of every playbook and script |
| Application modernization reference implementation | A Spring Boot REST service over PostgreSQL with its OpenAPI contract, a React front end, a Db2/Oracle to PostgreSQL migration tool that proves the move with row counts, checksums and aggregate reconciliation, and an agentic AI pattern with a provider-neutral interface and a stub model, so no API key is needed. Tests run against a real embedded PostgreSQL engine; docker-compose runs the whole stack. Illustrative, not production code. See Book 18, Chapter 08. | app-modernization.zip, rebuilt on every site deploy from examples/app-modernization, with a .txt copy of every source file |
Meeting templates
| Template | Word form |
|---|---|
| The One-Page Ask: the page to bring to the meeting that approves the pre-flight | The_One_Page_Ask.docx |
| Charter Sign-Off Sheet: names for the charter roles and the six gates | Charter_Sign_Off_Sheet.docx |
| For the CIO: the clocks and the cost, on one page | Brief_for_the_CIO.docx |
| For the CISO: leavers and account findings, on one page | Brief_for_the_CISO.docx |
| For the CHCO: Federal HR 2.0 and the contractor source, on one page | Brief_for_the_CHCO.docx |
| For the Authorizing Official: evidence over attestation, on one page | Brief_for_the_Authorizing_Official.docx |
Books as Word documents
Each book downloads as one Word document with its chapters in reading order, its notes and its diagrams. The books page lists each book’s chapter and page counts.
Companion guides as Word documents
Reference pages as Word documents
The reference pages, one Word document each, and all six together in the Reference Set.
Developer workbooks as Word documents
Draft, held for review page by page; see Developer Workbooks.
Videos and presentations
- Narrated presentation videos: watch them on the Videos page, or download the MP4s from the October 23, 2026 video release.
- HR-driven identity interview videos: the October 20, 2026 release.
- Earlier editions: every edition of the workbook, with its Word editions, decks, narration audio and videos, is kept on the Archive page.
- Decks (PowerPoint, with and without narration), scripts and captions: the Presentations page.