This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Federal Modernization Workbook
Presentations
The 15-minute Why / What / Who / How decks for every workbook book, with their narrated editions
Download the PowerPoint decks for the Federal Modernization Workbook books: each book’s 15-minute Why / What / Who / How briefing, its narrated self-running edition and its narration script.
Every workbook book has a 15-minute briefing (its narrated edition runs 9 to 15 minutes) that follows the book’s four questions: Why the topic matters, What changes, Who owns it, and How to do it. Each deck carries full speaker notes, and every slide names the chapter and the primary sources behind it.
- Deck: the editable PowerPoint file, for presenting live.
- Narrated: the same deck with recorded narration on every slide, set to play by itself.
- Script: the narration as text, for practice or for reading instead of watching.
- Captions: the narration as timed WebVTT captions. Every narrated deck carries them built in; the
.vttfile is the same captions for a video player.
The decks download from the current edition’s GitHub Release, which also holds each narrated deck’s audio as a zip. Earlier editions keep their own decks, listed on the Archive.
TipWatch the videos
Every narrated deck is also available as a 1080p MP4 video, with its matching .vtt caption file, in the narrated presentation videos release on GitHub: the Start series, the nineteen book briefings, the executive briefings, the technical deep dives, the research presentations and the HR-driven identity interview set. Download a video and its caption file and play them together in any player that loads WebVTT captions.
New here? Start with the narrated executive briefing of about 7 minutes on the Start Here page: why modernization begins with identity, and the first step leadership can approve.
Presentations for pages that are still under review, such as product evaluations, are on those pages in Evaluations, Explainers and the companion guides, not here.
Book presentations
| Book | Question | Deck | Narrated | Script and captions |
|---|---|---|---|---|
| Book 00 — Orientation & Program | Why modernize, and why now? | Deck | Narrated (about 13 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 01 — The Transformation Arc | Why is modernization so hard? | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 02 — Identity & Directory | Why does identity matter? | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 03 — HR-Driven Identity | Why should HR, not IT, decide who exists? | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 04 — Access & Privilege | Why is every access decision a policy decision? | Deck | Narrated (about 9 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 05 — Devices & Endpoints | Why can’t Group Policy come to the cloud? | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 06 — Data Platform: SQL Server Identity | Why is the database where legacy authentication hides? | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 07 — PKI & Certificates | Why do certificates outlive every migration? | Deck | Narrated (about 13 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 08 — DNS, DHCP & IPAM | Why is DNS now the control plane? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 09 — Network & Transport | Why does physics decide the architecture? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 10 — Cloud Boundary & Landing Zone | Why does the authorization boundary decide what you can use? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 11 — Zero Trust & Assessment | Why is Zero Trust a whole-agency property, not a product? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 12 — Security Operations & Telemetry | Why can’t you defend what you can’t see? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 13 — Governance, Drift & Evidence | Why does compliance decay the day after the audit? | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 14 — Federal Compliance & Authorization | Why does every control need proof, not a promise? | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 15 — Compliance Automation & Day-2 Operations | Why does modernization succeed or fail at the help desk? | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 16 — People: Training & Education | Why do people, not tools, close the gap? | Deck | Narrated (about 13 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 17 — AI Identity Governance | Why do AI agents need identities and owners? | Deck | Narrated (about 13 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 18 — Application Modernization | Why is application modernization a portfolio decision, not a rewrite? | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
Executive briefings and technical deep dives
Some books carry more than a 15-minute deck can. Executive briefings (about 30 minutes live; 7 to 25 minutes narrated) are built around decisions: what has to be decided, who owns it and when it is needed, with no configuration detail. Technical deep dives (about 50 minutes live; 15 to 27 minutes narrated) are organized in modules of about ten minutes, each opened by a divider slide, so they can be watched in parts; their slides carry the tables, flows and decision matrices, and every slide names the chapter behind it. Both follow the same accessibility rules as the book decks.
| Book | Edition | What it covers | Deck | Narrated | Script and captions |
|---|---|---|---|---|---|
| Book 00 — Orientation & Program | Executive | For sponsors, CIOs and CISOs: the external clocks, the charter, phases and gates, who decides, and the decisions to make with owners and timing | Deck | Narrated (about 25 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 01 — The Transformation Arc | Executive | For sponsors, CIOs and authorizing officials: why modernization is hard, the arc at decision level, who leads, and the roadmap’s gates and rollback | Deck | Narrated (about 25 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 02 — Identity & Directory | Executive | For the CIO, CISO and identity program lead: Entra ID as the identity plane, the hidden migration surface, delegation without OUs, the phased migration and retiring AD last | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 02 — Identity & Directory | Technical | Assessing the forest, then building the Entra ID target and migrating (Chapters 07–11, Appendices B–C) | Deck | Narrated (about 24 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 03 — HR-Driven Identity | Executive | For the CIO, HR leadership, CISO and privacy officer: HR as the source of authority, the Federal HR 2.0 window, joiner-mover-leaver, the contractor decision and Gate G1’s HR feed | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 03 — HR-Driven Identity | Technical | Attribute authority and the canonical schema, the provisioning pipeline and Federal HR 2.0, lifecycle, PIV binding and access, and drift, evidence, ownership and the execution plan (Chapters 01–12) | Deck | Narrated (about 22 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 03 — HR-Driven Identity, Chapter 15 | Executive | External Partner Identity, for the CIO, CISO, business owners, privacy officer and authorizing official: the authority split, the class and Guest by default, one decider per row, assurance per transaction, the route in, privacy and records, eleven readiness checks and the decisions | Coming with the next edition | Video coming (narration recorded, about 11 min, with captions) | Script |
| Book 03 — HR-Driven Identity, Chapter 15 | Technical | External Partner Identity in three modules: assurance and the default route (connected organization, access package, cross-tenant access, the partner list in Conditional Access); cross-tenant sync as an exception; the partner identity record, tests T0 to T10, monitoring and evidence (Chapter 15, Appendix D; Book 04, Appendix C) | Coming with the next edition | Video coming (narration recorded, about 16 min, with captions) | Script |
| Book 04 — Access & Privilege | Executive | For the CISO, CIO and identity governance officer: access as policy, the Conditional Access baseline, phishing-resistant MFA, privileged tiers, applications as identities and access governance | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 04 — Access & Privilege | Technical | The Conditional Access library, rollout and break-glass, PIM self-request with approval, access governance, access as code (Chapters 03–10) | Deck | Narrated (about 23 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 05 — Devices & Endpoints | Executive | For the CIO, CISO and endpoint lead: Intune-first onboarding, compliance as the access signal, the GPO sunset, servers under Azure Arc and the support dates | Deck | Narrated (about 17 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 05 — Devices & Endpoints | Technical | Intune-first onboarding, the GPO sunset and policy migration, servers under Azure Arc, and operating and evidencing the fleet (Chapters 04–05, 07–10, Appendix A) | Deck | Narrated (about 27 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 06 — Data Platform: SQL Server Identity | Executive | For the CIO, CISO, data platform owner and application owners: where legacy authentication hides, the estate count, the Entra token target, DBA and application ownership, NTLM and the risks | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 06 — Data Platform: SQL Server Identity | Technical | The strategy for removing Windows authentication, then a walk-through of runbooks R01–R10 for DBAs | Deck | Narrated (about 22 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 07 — PKI & Certificates | Executive | For the CIO, CISO, PKI owner and authorizing officials: cutover and expiry clocks, shrinking lifetimes, the AD CS inventory, the four-issuer target, PIV trust, CA ownership and retiring AD CS last | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 07 — PKI & Certificates | Technical | Hardening the AD CS that stays, the target PKI, device and user certificates, and coexistence through decommissioning (Chapters 03–04, 06–08, Appendices A–B) | Deck | Narrated (about 25 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 08 — DNS, DHCP & IPAM | Executive | For the CIO, CISO and infrastructure lead: DNS as the control plane, the federal DNS floor, leaving AD DNS, IPAM as the address record, the platform decision, ownership and costs | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 08 — DNS, DHCP & IPAM | Technical | Split-brain DNS and the AD DNS departure, edge interception and DNSSEC, private endpoints and IPAM, and the migration sequence (Chapters 02, 04–08, 10–11, appendices) | Deck | Narrated (about 24 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 09 — Network & Transport | Executive | What TIC 3.0 requires, the long interim, investment order and the decisions to make, with owners and timing | Deck | Narrated (about 23 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 09 — Network & Transport | Technical | TIC 3.0 in practice and token security, SD-WAN, SASE and legacy protocols on re-routed paths, network access control after AD, and the reference architecture and ownership (Chapters 03–09, 13) | Deck | Narrated (about 21 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 09 — Network & Transport | Technical | SD-WAN only: transport physics and what SD-WAN can fix, the branch edge and TIC 3.0, securing and governing the fabric, and the field-office transformation (Chapters 01–03, 05, 06, 08, 10–13) | Deck | Narrated (about 20 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 09 — Network & Transport | Executive | The field-office SD-WAN business case: cost, the 12-hub target, the five-year position, roadmap and gates, risks and the decision to ask for (Chapter 11) | Deck | Narrated (about 8 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 10 — Cloud Boundary & Landing Zone | Executive | For authorizing officials and ISSOs: FedRAMP 2026, the GCC gap, exceptions and the authorization package | Deck | Narrated (about 22 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 10 — Cloud Boundary & Landing Zone | Technical | Why the boundary decides and the 2026 FedRAMP rules, GCC and the feature gap with equivalents and exceptions, the landing zone, IPAM and network as code and the front door, and the authorization package (Chapters 01–11, Appendix A) | Deck | Narrated (about 20 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 11 — Zero Trust & Assessment | Executive | For CISOs and authorizing officials: what the mandates require, BOD 25-01, the two assessment tools, evidence rather than verdicts | Deck | Narrated (about 23 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 11 — Zero Trust & Assessment | Technical | The mandates, BOD 25-01, ScubaGear and the Zero Trust Assessment, beyond Microsoft 365, ownership, closing before assessing, and running the assessment for evidence (Chapters 01–10, Appendix A) | Deck | Narrated (about 20 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 12 — Security Operations & Telemetry | Executive | For the CISO, SOC lead, CIO and authorizing officials: M-26-14, one evidence contract, telemetry through the migration, SIEM, retention and cost, the queue, response and metrics | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 12 — Security Operations & Telemetry | Technical | The evidence contract and identity telemetry, platform telemetry to detection, vulnerability, patch and posture, and data protection and who runs security operations (Chapters 01–10) | Deck | Narrated (about 19 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 13 — Governance, Drift & Evidence | Executive | For the CIO, CISO, authorizing officials and program office: one record, one change path, no new AD dependencies, evidence over attestation, drift, exceptions and ongoing authorization | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 13 — Governance, Drift & Evidence | Technical | Drift and the authoritative record, deterministic rules and the drift engine, evidence over attestation and adapters, and who governs, reciprocity and governance at scale (Chapters 01–12) | Deck | Narrated (about 20 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 13 — Governance, Drift & Evidence | Reference | Appendix B, Ticket-to-Machine Reference: the coordination loop, the five-clause request chain, the five lanes and change classes, severity and tempo, the evidence record, four worked examples and the certificate exception (Appendix B, Chapter 10) | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 14 — Federal Compliance & Authorization | Executive | For authorizing officials, the CISO and ISSOs: proof over promises, the federal clock, the baseline and crosswalk, closure with proof, continuity, supply chain, privacy, who owns compliance and the authorization package | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 15 — Compliance Automation & Day-2 Operations | Executive | For the CIO, service owner, operations leads and CISO: the help desk as the risk point, routing by authority, approvals, the reconciled inventory, day-two measures and build or buy | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 15 — Compliance Automation & Day-2 Operations | Executive | Building day-two automation in-house when there’s no funding for new products: the no-cost path on the existing ServiceNow instance, AI-assisted development with guardrails, sandbox to production, who does what, the evidence, and a pilot to approve (Chapter 13) | Deck | Narrated (about 9 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 15 — Compliance Automation & Day-2 Operations | Technical | Intake, triage and routing, help desk authority in Entra ID, the service catalogs, SaaS and the CMDB, and control automation on Microsoft 365, Azure, AWS and VMware (Chapters 03–10, Appendix A) | Deck | Narrated (about 20 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 16 — People: Training & Education | Executive | For the CIO, HR leadership, CISO and training leads: decisions that move, federal workforce rules, role tracks and certification, labs, help desk readiness, readiness gates and knowledge retention | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 17 — AI Identity Governance | Executive | For the CIO, CISO, Chief AI Officer, authorizing officials and privacy officer: why AI agents need identities and owners, what federal AI rules require, the inventory, credentials, shadow AI, who decides and the evidence | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 17 — AI Identity Governance | Technical | AI agents as identities and the federal rules, the inventory and kinds of AI identity, owners, credentials and least privilege, monitoring, shadow AI, the scan and evidence (Chapters 01–10, Appendix A) | Deck | Narrated (about 21 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 18 — Application Modernization | Executive | For the CIO, chief architect, portfolio owners, CISO, privacy officer and authorizing officials: the application as the unit of decision, triage, one target architecture, proving the data, AI with an owner, compliance by design, who decides and running the portfolio in waves | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Book 18 — Application Modernization | Technical | Triage scoring and the decision table, the target architecture and support windows, schema conversion, validation, cut-over and coexistence, AI guardrails, controls across the life cycle, the review board and gates, the reference implementation, TOGAF and Zachman, and the waves (Chapters 01–10) | Deck | Narrated (about 21 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Attribute-Driven Migration to Entra ID · implementation guide · project plan | Technical | Part 1, the model and the HR track: what the OU tree encoded, the four tracks and the end state, the federal requirements, the attributes primer (AD compared with Entra ID, and which store each consumer reads), sourcing and proving the attributes from HR and Federal HR 2.0, sync, dynamic user groups, administrative units, Conditional Access personas, and the dangers of dynamic user groups | Deck | Narrated (about 18 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Attribute-Driven Migration to Entra ID · implementation guide · project plan | Technical | Part 2, devices, servers and non-person identities: what Intune and Azure Arc cover and the four-tier strategy for the rest, device targeting and the dangers of dynamic device groups, service accounts, service principals, workload identities and AI agents, PIV and CAC binding, then running it: the mover example, cut-over, drift, the limits (administrative units, Lifecycle Workflows at scale, what still needs AD), the checklist and the decisions | Deck | Narrated (about 18 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Attribute-Driven Migration to Entra ID · implementation guide · project plan | Technical | Deeper Dive Implementation, Part 1, Gates 0–3: a current-state baseline (trace real joiner, mover and leaver events), running the Start Kit and the group decision record, the slot register and single writer, the HR checks against an HR export and how to read a failing one, the two landing zones, the /bulkUpload record, the match trap and the April 7, 2027 Connect Sync deadline, and VK-SYNC-01 |
Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Attribute-Driven Migration to Entra ID · implementation guide · project plan | Technical | Deeper Dive Implementation, Part 2, Gates 4–6: dynamic rule text with every guard, rule tests and shadow diffs, administrative units, Conditional Access personas and VK-CA-01, device targeting, moving Group Policy with Microsoft’s own tools (Policy Analyzer, Group Policy analytics and Migrate, VK-INT-07; machine configuration beside Group Policy for servers), Red Hat on AWS under Ansible with one configuration and patch owner, and PIV binding with VK-PIV-01 | Deck | Narrated (about 17 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Attribute-Driven Migration to Entra ID · implementation guide · project plan | Technical | Deeper Dive Implementation, Part 3, Gates 7–9: the mover proof as a runbook, waves as attribute queries and the per-wave gate, Lifecycle Workflows at scale, retiring the OU tree (disable, never delete), drift classes and the standing checks, where the kits stop, what the overview simplified, and the decisions | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Implementation guide — HR-Driven Identity · developer workbook | Technical | Implementation, Part 1, Gates G1–G3: the seven gates on one page, the lifecycle rows of the writer register and the audit-log scan, contractors from their own source with an enforced earliest end and a read-only reconciliation, and joiner workflows as code with the Temporary Access Pass bridge and day-one readiness | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Implementation guide — HR-Driven Identity · developer workbook | Technical | Implementation, Part 2, Gates G4–G7: automatic assignment and the memberOf quarantine, the mover’s residual review, certificate-based authentication with a CRL per CA and the limits by cloud, the leaver’s order and separation timing from the logs, and the lifecycle drift classes, six metrics and hash-chained evidence |
Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Implementation guide — Non-Person Identity · developer workbook | Technical | Implementation, Part 1, Gates G1–G3: the six gates on one page, the inventory as code joined to an owner and a sponsor, two human owners and the orphan plan, the migration-path decision per identity, and the tenant policy that blocks secrets and caps certificates, with the rotation plan | Deck | Narrated (about 17 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Implementation guide — Non-Person Identity · developer workbook | Technical | Implementation, Part 2, Gates G4–G6: least privilege across five surfaces and workload Conditional Access, conversion with a parallel run and the Kerberos moves, owner changes, orphans and owner reviews with disable-first, SQL Server’s identities, AI agents, and the track’s evidence and rollback | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Example guide — Ticket-to-Machine on ServiceNow and SailPoint · developer workbook | Technical | Implementation, Part 1, Gates G1–G4: the loop on two products and the four gaps, each product’s FedRAMP status and every call declared at least privilege, one writer per attribute and one approver per authority class with the lanes and the writer check, the starting drift day over day, and the front door’s contract and workflow payloads | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Example guide — Ticket-to-Machine on ServiceNow and SailPoint · developer workbook | Technical | Implementation, Part 2, Gates G5–G7: actuation by authority, change records and the declared-exception lane, closing only on a re-read, the tempo and the five measures, the identity fixes on these products, evidence records with a hash chain, and the dangers across the seven gates | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Effective Meetings | Briefing | Why meetings matter to a modernization program, whether a meeting is needed at all, the three kinds of meeting, the agenda, the six roles, before / during / close / after, the agenda and notes templates, and the one-page checklist | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Ansible for Configuration Automation | Technical | Where Ansible fits beside Intune, Azure Arc, Azure Policy and Configuration Manager (one owning tool per setting), Arc onboarding at scale and the tier-2 platforms, Ansible Automation Platform for a Moderate civilian agency, evidence for CM-2, CM-3, CM-6, CM-7 and CM-8, the dangers, the phased adoption path and the example playbooks | Deck | Narrated (about 19 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Companion guide — Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities · training module | Briefing | Why a user account used as a service is the riskiest kind, the twelve kinds of service identity compared, what can move to Microsoft Entra ID and what can’t, the decision path and its dispositions, the program’s rules, requirements and KSIs, a user account to a gMSA and to a Windows Server 2025 dMSA with Microsoft Learn’s commands, the move to a managed identity, an Arc identity, a certificate or federation, the dangers and rollback, and where the Non-Person Identity kit takes over | Deck folder (the deck joins the next edition) | ▶ Watch (about 16 min, captions) · MP4 | Script · Captions |
| Decision guide — Content Delivery Modernization (DP Consolidation) · implementation guide · project plan | Executive | A decision briefing for a CIO, a budget officer and an endpoint lead weighing a distribution point refresh: the decision, the questions to answer before any money moves, capacity and timing against Microsoft’s limits, three options compared, the 12-hub and 24-DP target, peer caching and Connected Cache, the five retirement gates, cost and the five-year position, the roadmap, ten implementation stages from analysis to the last DP retired, risks, standard packaging with PSAppDeployToolkit, and the ask | Deck folder (the deck joins the next edition) | ▶ Watch (about 11 min, captions) · MP4 | Script · Captions |
Training: learning path modules
Each module of the Microsoft Automation learning path has a narrated deck that teaches it the way Microsoft Learn does: objectives, the concepts, a Try it slide with the real Lab 1 command and output, the government-cloud differences, the federal requirement and evidence, a short knowledge check and the summary.
| Module | Deck | Narrated | Script |
|---|---|---|---|
| Module 1: Graph and Azure Foundations | Deck | Narrated (about 15 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Module 2: Microsoft Entra ID through Microsoft Graph | Deck | Narrated (about 13 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Module 3: Intune through Microsoft Graph | Deck | Narrated (about 14 min, captions) · ▶ Watch · MP4 | Script · Captions |
Developer workbook chapter tours
Each code chapter of Book 19 and of four developer workbooks under Projects has a narrated tour of about ten minutes: why the chapter’s code comes first, what Microsoft’s own sample gives and leaves out, the code and its tests, who runs it, the two labs, the dangers and the checklist. The slides follow the Why, What, Who and How order of the book decks; each slide’s notes carry the narration, the chapter’s full detail and the footnotes it rests on.
Building the Attribute-Driven Migration
Building Privileged Access
| Chapter | Deck | Narrated | Script and captions |
|---|---|---|---|
| 01 — Privileged Inventory as Code | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 02 — Emergency Access Accounts as Code | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 03 — Conditional Access for Administrators and the Activation Gate | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 04 — PIM for Microsoft Entra Roles as Code | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 05 — PIM for Groups and the PRV Groups | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 06 — PIM for Azure Resources | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 07 — Access Reviews of Privileged Roles | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 08 — Evidence and Drift for the ISSO | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
Building Non-Person Identity
Building Ticket-to-Machine
| Chapter | Deck | Narrated | Script and captions |
|---|---|---|---|
| 01 — The Loop and the Typed Task | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 02 — The ServiceNow Client and Least Privilege | Deck | Narrated (about 9 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 03 — The SailPoint Client and Its Scopes | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 04 — Drift to a Typed Task | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 05 — The Re-read Rule | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 06 — Drift Reconciliation | Deck | Narrated (about 9 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 07 — Evidence Records for Book 13 and the ISSO | Deck | Narrated (about 9 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 08 — One Writer per Attribute | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
Building HR-Driven Identity
| Chapter | Deck | Narrated | Script and captions |
|---|---|---|---|
| 01 — The Writer Register as Code | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 02 — Contractor Sources and Enforced End Dates | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 03 — Joiner Workflows as Code and the Temporary Access Pass Bridge | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 04 — Access from Attributes and the Mover’s Residual Review | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 05 — Certificate-Based Authentication Checks | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 06 — Separation Timing from the Logs | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
| 07 — Lifecycle Drift, Metrics and Evidence | Deck | Narrated (about 11 min, captions) · ▶ Watch · MP4 | Script · Captions |
The Reference tab
A narrated briefing on the Reference pages: why each of the six matters (the Command Reference, the Federal Framework Crosswalk, the RMF Map, the M-19-17 and FICAM Crosswalk, the Microsoft Practice Crosswalk and the Source Register), how they fit together, where to start by role, and how each page says how far to trust it. The deck reaches the Release with the next edition, and the video follows.
| Presentation | Deck | Narrated | Script |
|---|---|---|---|
| The Reference Tab: twelve slides, Why / What / Who / How | Coming with the next edition | Video coming (narration recorded, about 10 min, with captions) | Script |
HR-driven identity interview set
A presentation set built from Book 03 — HR-Driven Identity for a 15-minute enterprise data architecture talk. It’s the agency-neutral edition: the examples are generic, so any agency can adapt it. The narrated videos (MP4, with captions) are attached to the repository release hr-identity-interview-2026-10-20.
| Presentation | Deck | Narrated | Script and captions |
|---|---|---|---|
| Executive cut: Why / What / Who / How in 9 slides, with the full deck as backup | Deck | Narrated (about 12 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Detailed 16-slide deck | Deck | Narrated (about 16 min, captions) · ▶ Watch · MP4 | Script · Captions |
| Contractor identity source: who is authoritative for a contractor (Q&A backup) | Deck | Narrated (about 10 min, captions) · ▶ Watch · MP4 | Script · Captions |
Accessibility
Every deck is built to meet Section 508 and WCAG 2.1 AA, and an automated check runs on each one before it is published.
- Captions. Each narrated deck has closed captions for every slide’s narration, built into the file. In the slide show, turn them on with the captions button on the media controls, or set Slide Show › Always Use Subtitles. The same captions are published as a
.vttfile for video players, Microsoft Stream and SharePoint. - Transcripts. The narration script is the full text of the narration, and each slide’s speaker notes carry it too.
- Screen readers. Every slide has a unique title, read first. Tables mark their header rows. Decorative icons and shapes are marked so screen readers skip them, and the narration audio is described. All text is tagged as English.
- Contrast and type. Text meets WCAG contrast against the white background, nothing is smaller than 10 point, and color is never the only signal: the Why, What, Who and How tags carry their words.
If something in a deck isn’t accessible to you, open an issue in the repository and it will be fixed.
How the decks are built
The decks are generated from each book’s chapters by small scripts in the repository’s presentations/ folder, using a shared theme and narration kit in presentations/_build/. When a chapter changes, its deck is rebuilt from the same source.