This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Projects · Developer workbook
Building Non-Person Identity
A developer workbook for the Non-Person Identity Modernization project
A developer workbook for the Non-Person Identity Modernization project: a code-first companion for the developers who build its register of service accounts, service principals, managed identities and AI agents, the ownership check and orphan rule, the per-account decision, credential modernization, least privilege, Conditional Access for workload identities and the evidence. Each chapter starts from Microsoft Learn and Microsoft’s own samples, builds tested code in the repository’s examples folder, runs a lab against fixtures with no tenant, then a step in a test tenant, and lists the verified Graph, Azure and Active Directory facts, the dangers and a checklist.
A developer workbook for the Non-Person Identity Modernization project
ImportantStatus: approved, not yet run against a live tenant
This workbook is new material. All eleven chapters are written and approved; Chapter 11, the deployment runbook, is the newest and hasn’t been run against a live tenant. An approved page that changes goes back on the weekly source watch issue until it is approved again. Narrated chapter tours for Chapters 01 to 10 are below. Every external claim was checked against Microsoft Learn or a workbook chapter between October 30 and November 2, 2026 and carries a note, and each chapter keeps its verification log in the repository. The code is illustrative. Its tests pass against fixtures, but it has not been run against a production tenant or domain.
The Non-Person Identity Modernization project runs the non-person identity track of the companion guide: every identity that isn’t a person, from an Active Directory service account whose password never expires to an AI agent with a sponsor. Its operator material already exists: Book 02’s service accounts, migration path matrix and discovery function; Book 04’s applications and workload identities and orphan policy; Book 17 on AI identity; and the implementation guide. Those tell an operator what to decide and how to prove it. They don’t teach anyone to build the software that reads the estate into one register, holds each decision as reviewed code, and hands the ISSO evidence a reviewer can check.
This workbook is for the developers who build that software. It is code first, and it starts from Microsoft. Each chapter begins with Microsoft Learn’s own procedure or sample, runs it offline against fakes, and builds only what it leaves out, in the repository’s examples folder, with tests. Each has a lab that runs on a laptop against fixtures with no tenant and no domain, then a short step in a test tenant with a way to back it out. Each lists the Graph, Azure and Active Directory facts the code depends on (endpoints, the least-privileged permission or right, availability in the US Government clouds, release stage), footnoted to Microsoft Learn with the date the page was read, then the dangers and a checklist. The last chapter is a deployment runbook: it takes the kit from those test-tenant steps to a live test environment, then to production, with the same commands for both.
The target estate is Microsoft 365 GCC (Moderate) with commercial Azure, and an on-premises Active Directory until the program retires it at program G5. GCC uses the worldwide endpoints: login.microsoftonline.com, graph.microsoft.com and management.azure.com. GCC High and DoD have separate hosts.1 2 Every chapter says so where an endpoint matters.
How each chapter is built
| Section | What it holds |
|---|---|
| Goal and audience | What you will build, and who should read it |
| Start with Microsoft’s sample | What Learn or Microsoft’s sample gives you, the pinned copy, and what it leaves to you, as a table of gaps pinned by tests |
| The code | The example it builds, what it adds to Microsoft’s sample, and the tests |
| Lab 1: fixtures, no tenant | Steps you can run anywhere, with the expected output |
| Lab 2: test tenant | The smallest change a test tenant needs, and how to back it out |
| Verified facts | Endpoints, least-privileged permissions and rights, national cloud availability and release stage, each footnoted |
| Dangers | What breaks in production, and the guard the code has for it |
| Checklist | What a reviewer checks before the code ships |
Design guidance in this workbook is marked as such: it is the program’s position, not a vendor statement. Preview and beta features carry their stage wherever they appear.
Chapters
The outline follows the project plan’s phases: inventory, ownership, a decision per account, credential modernization, least privilege, Conditional Access for workload identities, AI agents and steady state. The plan’s computed path runs through ownership, because an owner has to be found for every account “before anything is touched”, so Chapters 01 and 02 come first.
| # | Chapter | Plan | Starts from | What you build | Status |
|---|---|---|---|---|---|
| 01 | Non-person identity inventory as code | NP0.1, NP0.2, NP0.4, NP0.5, Gate 0 | Learn’s commands for finding service accounts and service principals (pinned in examples/third_party/entra-service-account-pages) and its script exporting app registrations’ secrets and certificates (pinned in examples/third_party/entra-app-credentials-export-page), then examples/non-person-identity |
One register: AD service accounts, MSAs, gMSAs and dMSAs, app registrations, service principals, managed identities, federated credentials, Graph application permissions and consent grants, each with an owner count, credential kind, risk, candidate target and stale lead; SQL Server accounts handed to the Data Platform plan; findings NPI-INV-01 to -09 and a manifest with a SHA-256 per file and the tenant ID | Written |
| 02 | Ownership and the orphan rule | NP1.1, NP1.3, D-NP2, Gate 1 (NP1.2’s AI sponsor fields recorded for Chapter 09) | Learn’s Graph samples for ownerless service principals, assigning owners and serviceManagementReference (pinned in examples/third_party/graph-applications-tutorial-page), then examples/non-person-identity |
The ownership check over Chapter 01’s register (two enabled human members, an active service record, an application owner for every AD account), findings NPI-OWN-01 to -09 with stable IDs, and the orphan rule as a dry-run plan: disable, never delete, once the identity governance officer confirms, a 30-day claim window, writes only with -Apply through a separate, delegated, reviewed path |
Written |
| 03 | The migration path matrix as code | NP2.1, D-NP3, NP2.2, D-NP4, Gate 2 | Learn’s decision tables for choosing an on-premises and a cloud service account, and its Workload ID FAQ (pinned in examples/third_party/entra-service-account-choice-pages), then Book 02’s matrix and examples/non-person-identity |
Book 02’s matrix as reviewed data (config/migration-matrix.json); a proposed target for every identity in Chapter 01’s register, read with Chapter 02’s ownership run; the owner’s disposition (retire, re-platform, keep, keep on Kerberos with an SPN owner and an end date) checked against it; waves with HIGH-risk accounts first and a rollback per wave; the Workload ID Premium scope (D-NP4) checked against the tenant’s subscriptions; findings NPI-MAT-01 to -09 and Gate 2; two reads, no writes |
Written |
| 04 | App management policies and certificate rotation | NP3.1, NP3.7 | Learn’s Graph samples for the tenant default policy, app management policies and adding a certificate to an app (pinned in examples/third_party/graph-app-credential-policy-pages), its configuration procedure (pinned in examples/third_party/entra-app-management-policies-page) and the Az.KeyVault certificate examples (pinned in examples/third_party/az-keyvault-certificate-help), then examples/non-person-identity |
The policy as reviewed JSON (secrets and symmetric keys blocked, certificates capped at 180 days for new apps, on application and service principal objects; exceptions with a record and an end date; the app instance property lock on every app registration), compared with the tenant into a plan that never loosens or drops a restriction; rotation through Key Vault, raised 60 days before expiry, approved by an owner, renewed, attached beside the old certificate, verified, and the old one removed after a 7-day overlap; findings NPI-POL-01 to -06 and NPI-ROT-01 to -07; writes only with -Apply through a separate, delegated, reviewed path |
Written |
| 05 | Workload identity federation and managed identities | NP3.2 to NP3.4 | Learn’s federated identity credential samples for an app registration and a user-assigned managed identity (pinned in examples/third_party/entra-wif-create-trust-pages), the Graph create sample (pinned in examples/third_party/graph-fic-create-page) and the Managed Identity REST examples (pinned in examples/third_party/msi-fic-rest-examples), then examples/non-person-identity |
Conversions in the plan’s order (managed identity, then federated credential, then certificate) as one reviewed file; federated credentials diffed against Graph and Resource Manager, checked against the claims the workload’s issuer will present, and exchanged against a fake token endpoint before cutover; managed identities created or recorded with their role assignments; findings NPI-WIF-01 to -09; the 30-day parallel run from sign-in evidence, then the legacy account disabled, never deleted, through a delegated write path with an approved plan hash and -Apply |
Written |
| 06 | gMSAs, dMSAs and the Kerberos island | NP3.5, NP3.6, NP7.3 | Learn’s gMSA, dMSA and KDS root key procedures (Manage group Managed Service Accounts, Setting up delegated Managed Service Accounts, the dMSA overview and Create a KDS root key, pinned in examples/third_party/windows-server-msa-pages), then examples/non-person-identity |
A plan per Kerberos account from reviewed dispositions: MSAs upgraded to gMSAs; traditional accounts, IIS application pools and scheduled tasks moved to a gMSA or a Windows Server 2025 dMSA, applied only with -Apply through a separate write path that never deletes the old account; the KDS root key checked read-only without the key; password retrievers as reviewed data; findings NPI-KRB-01 to -09; the island list with an SPN owner and an end date within D08 for the program’s SPN retirement (P4.6); and every gMSA and dMSA reconciled with the provisional end state (D11) before program G5 |
Written |
| 07 | Least privilege for service principals | NP4.1 to NP4.3, Gate 4 | Learn’s Review permissions granted to enterprise applications, its Microsoft Graph PowerShell script and Graph requests (pinned in examples/third_party/entra-review-app-permissions-page), then examples/non-person-identity |
The permission sweep over Chapter 01’s register: every app role assignment on every resource, delegated grants, directory roles and managed identities’ Azure role assignments; broad permissions against a reviewed list with a dated justification per exception and Learn’s narrower replacement (resource-specific permissions, Sites.Selected, RBAC for Applications in Exchange Online, a resource scope); findings NPI-LP-01 to -09; privileged service principals handed to the Privileged Access plan (A3.4); the first quarterly owner review; a dry-run plan that removes an app role assignment through its resource service principal or narrows a delegated grant, never deletes an app, applied only with -Apply through a separate, delegated, reviewed path |
Written |
| 08 | Conditional Access for workload identities | NP5.1 to NP5.3, D-NP5, Gate 5 | Learn’s Conditional Access for workload identities and its Graph JSON sample (pinned in examples/third_party/entra-workload-identity-ca-page), then examples/non-person-identity |
The scope as a reviewed file (Tier 1 single-tenant service principals by object ID, never through a group, in rings; NL-WorkloadEgress; managed identities, multitenant and SaaS apps out of scope with their controls); CA015 and CA037 per ring, always created report-only, with a pre-merge check (NPI-WCA-01 to -09), a tenant check, a diff and a dry run; a summary of the service principal sign-in logs (Graph beta) per principal; enforcement only with -AllowEnforce after D-NP5; a block alert definition |
Written |
| 09 | AI agent identities | NP6.1 to NP6.7, D-NP6, Gate 6 | Learn’s Microsoft Entra Agent ID samples for creating a blueprint and its credentials, inheritable permissions and the agent Conditional Access policies (pinned in examples/third_party/entra-agent-id-pages) and the Graph list requests for blueprints, agent identities and sponsors (pinned in examples/third_party/graph-agent-id-api-pages), then examples/non-person-identity |
Agent identities and blueprints read with sponsors, owners, credentials, inheritance, roles and attributes, and checked against creation closed, the reviewed production handshake, no secret on a production blueprint, no allAllowed role inheritance or standing privileged role, the ten-business-day sponsor rule and the AI drift checks (NPI-AI-01 to -23); Chapter 02’s sponsor fields filled; orphaned agents listed for the orphan rule, a manual hand-off; the two agent block policies as a report-only plan with a separate delegated write path; D-NP6 as data, with service principals and managed identities under the same rules where agent identities aren’t available; agent Conditional Access and agent risk preview watch items |
Written |
| 10 | Drift and evidence for the ISSO | NP7.1, NP7.2, NP7.4, Gate 7 | The Sentinel rule Learn’s security operations guide for applications links for added credentials (pinned in examples/third_party/sentinel-app-credential-rule), Learn’s directory audit and service principal sign-in activity (beta) reads, then the first workbook’s drift pipeline and Building Privileged Access’s Chapter 08 |
A scheduled run of Chapters 01 and 02 compared with the approved baseline by fingerprint: findings NPI-DRF-01 to -09 for ownerless, unused or expiring registrations, passwords that never expire, credentials added outside the pipeline and new consent grants; the review cycle read from Chapters 07 and 09 (NPI-REV-01 to -04); a documented contract for Chapters 03 to 09’s findings; the annual AI use-case inventory vintage comparison (NPI-VIN-01 to -05); packages with a SHA-256 per file, the tenant ID and a hash chain, and a period for AC-2, AC-6(5), IA-4, IA-5, IA-9 and M-25-21 with the Gate 7 criteria | Written |
| 11 | Deploying to test and production | G1 to G6 of the implementation guide | The guide’s gates, rollback and evidence; Learn’s procedures for workload Conditional Access in report-only mode, app management policies on specific applications, gMSAs and the KDS root key; Chapters 01 to 10’s code | A runbook for an Entra test tenant, Azure test subscription and AD test forest, then production: one settings file with no secrets, a read-only preflight (PF-01 to PF-11: licenses, roles, the deployment identity’s credential, the VK-NPI baseline, the test stage’s evidence), a safe order (inventory, the app management policy on a pilot, a federated credential and managed identity beside the old secret, a gMSA on a test host, workload Conditional Access report-only), a smoke test with a synthetic service principal and service account (ST-01 to ST-07), a rehearsed rollback that never deletes, go/no-go criteria, a staged enable by ring and first-week drift monitoring; for each step, the SP 800-53 controls, M-22-09 and SCuBA requirements it helps meet, the FedRAMP 20x KSI it aligns to and the evidence the ISSO keeps, written by the kit as an evidence record per step and checked before promotion; deploy/ scripts with a fixture mode and tests |
Written; not run against a live tenant |
Each chapter pins only the Microsoft samples it runs. Research gaps are numbered in blocks so the chapters can be written in parallel: Chapter NN uses rows (NN − 1) × 10 + 1 to NN × 10 − 1, so Chapter 01 has rows 1 to 9, Chapter 02 rows 11 to 19, Chapter 10 rows 91 to 99 and Chapter 11 rows 101 to 109.
Plan gates and the guide’s gates
The chapters use the project plan’s gate numbers, Gate 0 to Gate 7. The implementation guide and the learning path use its own six gates, G1 to G6. This is how they line up.
| Plan gate | Approver | Guide gate | Chapters |
|---|---|---|---|
| Gate 0 — Non-person identities inventoried | ISSO | G1 Inventory | 01 |
| Gate 1 — Every non-person identity owned | CISO | G1 Inventory (owner and sponsor); G6 Lifecycle (the orphan rule) | 02 |
| Gate 2 — Every account has a decision | ISSO | G2 Decision | 03 |
| Gate 3 — Credentials modernized | ISSO | G3 Credential rules; G5 Conversion | 04, 05, 06 |
| Gate 4 — Least privilege | CISO | G4 Least privilege | 07 |
| Gate 5 — Workload identities under Conditional Access | CISO | G4 Least privilege (Step 4e) | 08 |
| Gate 6 — AI identities governed | CISO | The guide’s AI agents section, across G1 to G6 | 09 |
| Gate 7 — Steady state | ISSO | G6 Lifecycle, with every gate’s evidence | 10 |
Chapter 11, the deployment runbook, uses the guide’s G1 to G6, because it runs every chapter’s code in one order.
Narrated chapter tours
Every chapter has a narrated tour: a deck in Why, What, Who and How order, a self-running edition with captions, and a video. The tours were recorded on November 2, 2026 from the approved chapters, and a tour is re-recorded when its chapter changes. All of them are also on the Watch page.
Reading paths
- Developers new to the project: Book 02, Chapter 09’s service accounts and matrix, then Chapter 01.
- Developers building Phases 0 and 1: Chapters 01 and 02, in that order; Chapter 02 reads Chapter 01’s register and checks it against its manifest.
- Server and Active Directory engineers: Chapter 01’s AD section, then Chapter 06.
- AI governance staff: Book 17, Chapter 05, then Chapter 09.
- ISSOs and reviewers of the code: the checklists at the end of each chapter, and the manifests the runs write.
- Engineers taking the kit to production: Chapter 11, after the second lab of Chapters 01, 04, 05, 06 and 08.
Where this workbook sits
This is the developer workbook for the Non-Person Identity Modernization project, one of the developer workbooks under Projects in the Federal Modernization Workbook. The design is Book 02, Chapter 09 and Chapter 10; the application controls are Book 04, Chapter 05 and Chapter 06; SQL Server’s accounts go to the Data Platform plan and Book 06; AI identity is Book 17. The Graph client pattern every chapter follows, one cloud table, a declared call list with its least-privileged permission and no default cloud, is the first workbook’s Chapter 02. Privileged non-human identities are swept in the Building Privileged Access workbook’s plan (A3.4), and this one doesn’t repeat that sweep. The read-only checks VK-NPI-01 to VK-NPI-09 in the repository’s validation kit are the gate checks the implementation guide names; this workbook’s code builds the register and the decisions those checks verify.
To learn the guide’s gates in order from these chapters’ labs, with a knowledge check for each, use the Non-Person Identity learning path: eleven modules, one per chapter.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Non-Person Identity Inventory as Code | Read every non-person identity into one register as code, starting from Learn’s own commands for finding service accounts and service principals and its script for exporting app registrations’ secrets and certificates (pinned in the repository), and adding what they leave to you: one read of Active Directory’s user-based service accounts, MSAs, gMSAs and dMSAs, app registrations, service principals by type, managed identities and their federated credentials, Graph application permissions and consent grants, each row with an owner count, credential kind, risk, candidate target and stale lead, SQL Server accounts handed to the Data Platform plan, and a manifest with a SHA-256 per file and the tenant ID, with labs against fixtures and a test tenant. |
| Chapter 02 — Ownership and the Orphan Rule | Check every identity in Chapter 01’s register against the program’s ownership rule as code, starting from Learn’s own Graph samples for finding ownerless service principals, assigning owners and setting serviceManagementReference (pinned in the repository), and adding what they leave to you: two enabled human members as owners, not service principals or guests, a service-management reference that names an active record, an application owner for every Active Directory account, findings with stable IDs, AI sponsor fields recorded for Chapter 09, and the orphan rule (D-NP2) as a dry-run plan that disables and never deletes, applied only through a separate, delegated, reviewed write path, with labs against fixtures and a test tenant. |
| Chapter 03 — The Migration Path Matrix as Code | Turn Book 02’s migration path matrix into reviewed data and code, starting from Learn’s own decision tables for choosing an on-premises service account, a cloud service account and Workload ID Premium (pinned in the repository), and adding what they leave to you: a proposed target for every identity in Chapter 01’s register, read with Chapter 02’s ownership run; the application owner’s disposition (retire, re-platform, keep, or keep on Kerberos with an SPN owner and an end date the authorizing official accepts) checked against it; conversion waves with HIGH-risk accounts first and a rollback recorded per wave; the Workload ID Premium scope (D-NP4) as a decision file checked against the tenant’s subscriptions; and Gate 2 as a check, with labs against fixtures and a test tenant. |
| Chapter 04 — App Management Policies and Certificate Rotation | Hold the tenant’s app management policy as reviewed JSON and rotate app registration certificates through Key Vault as code, starting from Microsoft’s own samples for the tenant default policy, app-specific policies, adding a certificate to an app and creating a Key Vault certificate (pinned in the repository), and adding what they leave to you: new client secrets and symmetric keys blocked and certificates capped at 180 days for new apps on both application and service principal objects, exceptions with a record and an end date, the app instance property lock on every app registration, a diff that never loosens or drops a restriction, a dry run and -Apply through a delegated, reviewed write path; then credentials near expiry found from Chapter 01’s register, a rotation raised before expiry and approved by an owner, the new certificate created in Key Vault and added beside the old one, verified, and the old one removed only after the overlap, with labs against fixtures and a test tenant. |
| Chapter 05 — Workload Identity Federation and Managed Identities | Convert non-person identities wave by wave in the plan’s order (managed identity, then federated credential, then certificate), starting from Learn’s own samples for federated identity credentials on an app registration and on a user-assigned managed identity, the Graph create sample and the Managed Identity REST examples (all pinned in the repository), and adding what they leave to you: federated credentials held as reviewed JSON with a diff, a dry run and an approved plan hash, a pre-cutover check that each credential’s issuer and subject match what the workload’s issuer will present, a token exchange test against a fake token endpoint, managed identities created or recorded with their role assignments, and the 30-day parallel run tracked from sign-in evidence before the legacy account is disabled, never deleted, with labs against fixtures and a test tenant. |
| Chapter 06 — gMSAs, dMSAs and the Kerberos Island | Move the Kerberos-only workloads in Chapter 01’s register as reviewed code, starting from Learn’s own gMSA, dMSA and KDS root key procedures (pinned in the repository): MSAs upgraded to gMSAs; traditional accounts, IIS application pools and scheduled tasks moved to a gMSA or a Windows Server 2025 dMSA through a dry-run plan applied only with -Apply, which never deletes the old account; the KDS root key checked read-only; the principals allowed to retrieve each managed password held as reviewed data; the accounts that stay on Kerberos recorded with an SPN owner and an end date within the program’s D08 and exported for its SPN retirement; and every gMSA and dMSA reconciled with the provisional end state before AD is retired, with labs against fixtures and a test domain. |
| Chapter 07 — Least Privilege for Service Principals | Sweep every service principal in Chapter 01’s register for its application permissions, delegated grants, directory roles and, for managed identities, Azure role assignments, starting from Learn’s own review-and-revoke script and Graph requests (pinned in the repository), and add what they leave to you: a reviewed list of broad tenant-wide permissions with a recorded, dated justification per exception, Learn’s narrower replacement for each (resource-specific permissions, Sites.Selected, RBAC for Applications in Exchange Online, a resource scope in Azure), privileged service principals handed to the Privileged Access plan (A3.4), the first quarterly owner review as a packet, and a dry-run plan that removes one app role assignment through its resource service principal or narrows one delegated grant, never deletes an app, and is applied only through a separate, delegated, reviewed write path, with labs against fixtures and a test tenant. |
| Chapter 08 — Conditional Access for Workload Identities | Hold Conditional Access for workload identities as reviewed data and code, starting from Learn’s own Graph JSON sample for a workload identity policy (pinned in the repository) and adding what it leaves to you: the scope as a reviewed file (Tier 1 single-tenant service principals assigned directly by object ID, never through a group; the workload egress ranges as a named location; managed identities, multitenant and SaaS apps recorded out of scope with the control that covers each), the program’s CA015 location restriction and CA037 high-risk block rendered ring by ring and always created report-only, a pre-merge check, a tenant check, a reader for the service principal sign-in logs (Graph beta) that summarizes the report-only results per principal, enforcement only with -AllowEnforce after decision D-NP5, and an alert definition for block events, with labs against fixtures and a test tenant. |
| Chapter 09 — AI Agent Identities | Govern AI agent identities as code, starting from Learn’s own Microsoft Entra Agent ID samples (pinned in the repository) for creating a blueprint and its credentials, inheritable permissions, the agent Conditional Access policies and the Graph list requests, and adding what they leave to you: creation closed and read back, the production handshake as a reviewed record, no secret on a production blueprint, no allAllowed role inheritance and no standing privileged role, the sponsor fields Chapter 02 recorded filled and checked, the ten-business-day sponsor confirmation rule, agent block policies in report-only through a separate reviewed write path, the AI drift checks, and decision D-NP6 as data, with service principals and managed identities under the same governance where agent identities aren’t available. |
| Chapter 10 — Drift and Evidence for the ISSO | Run Chapter 01’s register and Chapter 02’s ownership check on a schedule, compare the register with the last approved baseline by fingerprint, and raise the drift the plan names (ownerless, unused or expiring registrations, passwords that never expire, credentials added outside the pipeline, new consent grants), starting from the Sentinel rule Learn links for added credentials (pinned in the repository) and run offline; then read the review cycle’s records from Chapters 07 and 09, take Chapters 03 to 09’s findings through a small documented contract, compare the AI use-case inventory vintages, and package each run with a SHA-256 per file, the tenant ID and a hash chain into the period evidence for AC-2, AC-6(5), IA-4, IA-5, IA-9 and M-25-21, with labs against fixtures and a test tenant. |
| Chapter 11 — Deploying to Test and Production | A deployment runbook that takes the kit from the non-production environment of each chapter’s second lab to a live test environment (an Entra test tenant, an Azure test subscription and an Active Directory test forest), then to production: one environment settings file with no secrets, a read-only preflight with the licenses, roles and VK-NPI baseline, a safe deployment order (inventory and owners, the app management policy scoped to a pilot, a federated credential and managed identity run in parallel with the old secret, a gMSA on a test host, Conditional Access for workload identities report-only), a smoke test with a synthetic service principal and service account, the evidence, a rehearsed rollback, the promotion go/no-go criteria, then production with a change record, a staged enable by ring, first-week drift monitoring and a rollback, every step a copy-paste command linked to the implementation guide’s gate. Nobody has run it against a live tenant. |
No matching items
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); NPI workbook: fix 11 confirmed crosswalk errors (#378); Apply the open-choice decisions: text, plans, training, reference, register (#416); Figures, kit and config: Entra Domain Services diagram, CLM figure, Book 17 figures, hcm-entra slots 4-6, NPI apply hash and operator (#418); Non-Person Identity workbook: fix 16 inconsistency findings (#447); Approve 116 gated pages (Nov 7); fix RMF map stale-review test (#457); Claim language: supports, not satisfies (rule, check, first sweep) (#474); and 2 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Deck and audio links point at edition 2026.11.4 |
| 1.4 | 2026.11.3 | 2026-11-05 | Review gate: Mike’s approval of the 53 pages in the November 2 review packet (#334); NPI: apply the November 3 decisions on the discrepancies (#338); Training: a narrated video for every Non-Person Identity module, following the settled decisions (#340); Review gate: Mike’s approval of four pages changed on November 3 (#341); Review gate: Mike’s approval of NPI Chapter 06 (#343) |
| 1.3 | 2026.11.2 | 2026-11-02 | HR-Driven Identity labs: exact commands for every step, real output, commands lists (#293); Non-Person Identity labs: exact commands for every step, real output, commands lists (#295); Tours: HR-Driven Identity’s seven chapter tours, and the Privileged Access, Non-Person Identity and Book 19 tours with real kit output (#297); Lab command lists: the cleanup after the last step is labeled “After the steps”, not with the step before it (#300); Non-Person Identity: federal requirements and KSIs for every scripted step (#313); Building Non-Person Identity, Chapter 11: deploying to test and production (#315); Non-Person Identity learning path: ten modules (#324); Non-Person Identity learning path: Module 11, deploy to test, then production (#329) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Restore the developer workbook as Book 19, and the ADM implementation guide to Books > Guides (#270) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (15 merged changes since the workbook began) |
Footnotes
Microsoft Learn, “Microsoft Graph national cloud deployments,” https://learn.microsoft.com/graph/deployments (accessed Oct 30, 2026).↩︎
Microsoft Learn, “Compare Azure Government and global Azure,” guidance for developers (Azure Resource Manager endpoints), https://learn.microsoft.com/azure/azure-government/compare-azure-government-global-azure (accessed Oct 31, 2026).↩︎