Projects
Developer Workbooks
Code-first companions to the program’s projects, for the developers who build their middleware, checks and pipelines
The project plans say what each project delivers and when. A developer workbook is for the people who write the project’s software: the middleware between systems, the checks that prove each gate, the rules and policies kept as code, and the pipelines that hand evidence to the ISSO. Each one starts from Microsoft Learn and from Microsoft’s own samples where they exist, builds only what those leave out, and keeps that code, with its tests, in the repository’s examples folder.
Every page is held for the owner’s review: until a page is approved it is listed in the weekly source watch issue, and an approved page that changes goes back on that list.
The workbooks
| Title | Description |
|---|---|
| Building HR-Driven Identity | A developer workbook for the Identity Lifecycle & Provisioning project and the HR-driven identity implementation guide: a code-first companion for the developers who build the writer register and its audit scan, the contractor source with enforced end dates, Lifecycle Workflows definitions as code with the Temporary Access Pass bridge, access packages assigned from HR attributes with the mover’s residual review, the certificate-based authentication checks, separation timing from the logs, and the lifecycle drift classes and metrics that reach the ISSO, then a runbook that deploys all of it to a test tenant and on to production. Each chapter starts from Microsoft Learn’s own procedure, builds tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a test tenant, and lists the verified Graph facts, the federal requirements and evidence, the dangers and a checklist. |
| Building Non-Person Identity | A developer workbook for the Non-Person Identity Modernization project: a code-first companion for the developers who build its register of service accounts, service principals, managed identities and AI agents, the ownership check and orphan rule, the per-account decision, credential modernization, least privilege, Conditional Access for workload identities and the evidence. Each chapter starts from Microsoft Learn and Microsoft’s own samples, builds tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a test tenant, and lists the verified Graph, Azure and Active Directory facts, the dangers and a checklist. |
| Building Privileged Access | A developer workbook for the Privileged Access & Administrative Identity project: a code-first companion for the developers who build its inventory, emergency access checks, PIM settings as code, Conditional Access for administrators, access reviews and evidence. Each chapter starts from Microsoft Learn and Microsoft’s own samples, builds tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a test tenant, and lists the verified Graph and Azure facts, the dangers and a checklist. |
| Building Provider Notices | A developer workbook for the provider notices implementation guide: a code-first companion for the developers who build the software that collects the notices cloud providers send about an agency’s own tenant, account, tenancy or project (scheduled maintenance, retirements, health and security advisories, upcoming changes and incidents), holds each as one record, routes the ones that need action to an owner as a Ticket-to-Machine typed task, writes a weekly digest and keeps hashed evidence. One chapter per provider (Azure Service Health with the alert policy, Microsoft 365, Oracle Cloud Infrastructure, AWS Health and Google Cloud Personalized Service Health), then routing, the digest and evidence, and a runbook that deploys the kit to a test environment and then production. Each chapter starts from the provider’s own documentation, builds on tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a test tenant, and lists the verified facts, the federal requirements and evidence, the dangers and a checklist. |
| Building Ticket-to-Machine | A developer workbook for the Ticket-to-Machine loop on ServiceNow and SailPoint Identity Security Cloud: a code-first companion for the developers who build the typed identity finding, the ServiceNow and SailPoint clients and their least privilege, drift events raised as typed tasks, the re-read rule that closes a finding only on evidence, the drift reconciliation, the evidence records an ISSO reads, the one-writer-per-attribute check, and a runbook that deploys the kit to a test environment and then to production. Each chapter builds tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a ServiceNow developer instance or a SailPoint sandbox, and lists the verified vendor facts, the federal requirements and evidence, the dangers and a checklist. |
One developer workbook per project track is planned. Five are here: Building Privileged Access, with all nine chapters written; Building Non-Person Identity, with all eleven chapters written; Building Ticket-to-Machine, with all nine chapters written; Building HR-Driven Identity, with all eight chapters written; and Building Provider Notices, the companion to the provider notices implementation guide, with all eight chapters written and waiting for the owner’s review. The first developer workbook, Building the Attribute-Driven Migration, is now Book 19 under Books. Workbooks for the other project tracks will be added here as they are written.