attribute-driven-migration.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Read the tree 1 1

1

2027-01-04T08:00:00 2027-01-29T17:00:00 2 2 AT0.1 OU tree exported read-only: placement and size, GPO links at domain, OU and site, inheritance, and hand-made delegations; every OU and each GPO half tagged with its track 1.1 2 2027-01-04T08:00:00 2027-01-13T17:00:00 PT64H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-0-read-what-the-ou-tree-encodes 3 3 AT0.2 A decision for every security group: keep synced, convert to cloud-only, convert to dynamic, or retire 1.2 2 2027-01-14T08:00:00 2027-01-25T17:00:00 PT64H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/b02-identity/09-building-the-entra-target.md#the-per-group-decision 2 1 0 7 4 4 AT0.3 OU-to-unit mapping drafted: which OU delegations become administrative units, and which become Azure RBAC scopes for servers 1.3 2 2027-01-14T08:00:00 2027-01-19T17:00:00 PT32H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/09-building-the-entra-target.md#organizational-units 2 1 0 7 5 5 AT0.4 GPO settings split by track: user halves to the HR track's policy design, computer halves to the Endpoint plan 1.4 2 2027-01-14T08:00:00 2027-01-19T17:00:00 PT32H0M0S 7 0 Identity engineering, with the endpoint lead Owner or approver: Identity engineering, with the endpoint lead Source: ../books/guides/attribute-driven-migration.md#four-tracks 2 1 0 7 6 6 X-EG0 Device and server observation signed off (Endpoint plan, Gate 0) 1.5 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 CISO / ISSO (Endpoint & Device Modernization plan) Owner or approver: CISO / ISSO (Endpoint & Device Modernization plan) If decided late: The Endpoint plan triages Group Policy without knowing which halves belong to people Source: endpoint-device.md 4 2027-01-29T17:00:00 5 1 0 7 7 7 X-NPG0 Non-person identities inventoried (Non-Person Identity plan, Gate 0) 1.6 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 ISSO (Non-Person Identity Modernization plan) Owner or approver: ISSO (Non-Person Identity Modernization plan) If decided late: Service accounts in the tree are inventoried without their OU placement and delegations Source: non-person-identity.md 4 2027-01-27T17:00:00 2 1 0 7 8 8 ATG0 Gate 0 — The tree read 1.7 2 2027-01-25T17:00:00 2027-01-25T17:00:00 PT0H0M0S 7 1 Identity engineering lead Owner or approver: Identity engineering lead Criteria: Inventory in Git, site-linked GPOs included; every OU and every GPO half tagged with its track; a decision for every group; the OU-to-unit mapping drafted; nothing changed in the forest Source: ../books/b02-identity/10-migrating-and-governing.md#phase-0-assessment 3 1 0 7 4 1 0 7 5 1 0 7 9 9 X-G0 Program G0 — Ready to Plan: the read-only assessment committed 1.8 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Steward (backup: executive sponsor; program) Owner or approver: Steward (backup: executive sponsor; program) If decided late: The program plans Phase 1 without knowing what the OU tree encodes Source: program-master-schedule.md 4 2027-01-29T17:00:00 8 1 0 7 10 10 Phase 1 — Schema and slots 2 1

1

2027-01-04T08:00:00 2027-02-05T17:00:00 11 11 AT1.1 AD attribute inventory: which attributes are populated, by whom and how fully; which extension attributes are free to carry codes 2.1 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#compared-with-active-directory 12 12 X-DI1 Enterprise person key, and how source keys map to it (Identity Lifecycle plan, D-I1) 2.2 2 2027-01-08T17:00:00 2027-01-08T17:00:00 PT0H0M0S 7 1 ICAM governance body, with HR and identity engineering (Identity Lifecycle & Provisioning plan) Owner or approver: ICAM governance body, with HR and identity engineering (Identity Lifecycle & Provisioning plan) If decided late: The mapping has no key to carry in employeeId Source: identity-lifecycle.md 4 2027-01-08T17:00:00 13 13 AT1.2 AD-to-Entra mapping for every attribute that drives access, per object type: users, devices, Arc servers, service principals; the store for each from the store table 2.3 2 2027-01-11T08:00:00 2027-01-19T17:00:00 PT56H0M0S 7 0 Data architect, with identity engineering Owner or approver: Data architect, with identity engineering Source: ../books/guides/attribute-driven-migration.md#the-attribute-stores-in-the-order-to-reach-for-them 11 1 0 7 12 1 0 7 14 14 X-I12 Attribute authority map signed (Identity Lifecycle plan, I1.2) 2.4 2 2027-01-20T17:00:00 2027-01-20T17:00:00 PT0H0M0S 7 1 ICAM governance body (Identity Lifecycle & Provisioning plan) Owner or approver: ICAM governance body (Identity Lifecycle & Provisioning plan) If decided late: The schema can't name a writer for an attribute whose authority isn't decided Source: identity-lifecycle.md 4 2027-01-20T17:00:00 15 15 D-AT1 Attribute schema: the store and the single writer for every attribute that drives access, in all four tracks 2.5 2 2027-01-20T17:00:00 2027-01-20T17:00:00 PT0H0M0S 7 1 Data architect Owner or approver: Data architect Options: Native properties first, then extension attributes 1–15 for what rules read, directory extensions for more slots, custom security attributes for sensitive values rules don't need, device properties, Azure tags and certificateUserIds (the store table); or a broader use of directory extensions from the start If decided late: No slot can be assigned, and every group rule, persona and targeting convention waits Source: ../books/guides/attribute-driven-migration.md#attributes 13 1 0 7 14 1 0 7 16 16 D-AT2 The coded slot register: which extension attribute carries which code, on users and on devices 2.6 2 2027-01-20T17:00:00 2027-01-20T17:00:00 PT0H0M0S 7 1 Data architect, with HR for the code lists Owner or approver: Data architect, with HR for the code lists Options: The program attribute map (organization, worker type and position category in extensionAttribute10 to 12; region, cost center, division, account type, clearance and DoNotSync in their slots; device tier, role and environment on the device object); or an agency map that keeps the same rule: codes, never names, one writer per slot If decided late: Rules and filters are written against slots that may move, and every one is rewritten later Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md#program-attribute-map 15 1 0 7 17 17 AT1.3 Slot register published: one writer per slot, the code list owner, what reads it; the help desk, self-service and Exchange write paths listed for removal 2.7 2 2027-01-21T08:00:00 2027-01-26T17:00:00 PT32H0M0S 7 0 Data architect Owner or approver: Data architect Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md#writers 16 1 0 7 18 18 AT1.4 Device, server and non-person attribute authorities named: the procurement record through the Autopilot group tag, the asset record through Arc onboarding tags, the owning system's record 2.8 2 2027-01-21T08:00:00 2027-01-25T17:00:00 PT24H0M0S 7 0 Data architect, with the endpoint lead Owner or approver: Data architect, with the endpoint lead Source: ../books/guides/attribute-driven-migration.md#stage-1-source-the-attributes 15 1 0 7 19 19 ATG1 Gate 1 — Schema and slots signed 2.9 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 ICAM governance body Owner or approver: ICAM governance body Criteria: Every attribute that drives access has one store, one writer and one owner, in all four tracks; the slot register published; the person key carried in employeeId in both directories; codes, never display names, in anything a rule reads Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 17 1 0 7 18 1 0 7 20 20 X-P11 Attribute taxonomy finalized (program P1.1) 2.10 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The program's taxonomy is finalized without the cross-track slot register Source: program-master-schedule.md 4 2027-02-05T17:00:00 19 1 0 7 21 21 Phase 2 — Prove the attributes 3 1

1

2027-01-27T08:00:00 2027-02-05T17:00:00 22 22 X-I15 HR data baselined; employeeId populated; orphan candidates owned (Identity Lifecycle plan, I1.5) 3.1 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 HR (Identity Lifecycle & Provisioning plan) Owner or approver: HR (Identity Lifecycle & Provisioning plan) If decided late: The coverage baseline measures data the HR plan hasn't yet corrected Source: identity-lifecycle.md 4 2027-01-26T17:00:00 23 23 AT2.1 Coverage baseline across the tracks: uncorrelated accounts, empty coded slots, counts per organization code against an HR export, duplicate keys; device and server attribute coverage 3.2 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-2-prove-the-attributes-are-true-before-anything-depends-on-them 19 1 0 7 22 1 0 7 24 24 D-AT3 Correlation threshold before any rule grants access 3.3 2 2027-02-02T17:00:00 2027-02-02T17:00:00 PT0H0M0S 7 1 Authorizing official, through the agency's risk governance Owner or approver: Authorizing official, through the agency's risk governance Options: 99% of the pilot cohort correlated (a proposed starting point); a risk-tiered threshold, stricter for privileged and leaver-sensitive populations; 100% with a dated exception list If decided late: No group can be piloted, because nobody has said how true the attributes must be Source: ../books/b03-hr-identity/12-execution-plan.md#sequencing-principle 23 1 0 7 25 25 AT2.2 Other write paths removed: help desk and self-service edits to the access slots, Exchange custom-attribute cmdlets, write rights on the target OUs 3.4 2 2027-01-27T08:00:00 2027-02-05T17:00:00 PT64H0M0S 7 0 Identity engineering, with security Owner or approver: Identity engineering, with security Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md#writers 17 1 0 7 26 26 AT2.3 Entra ID sign-in, audit and provisioning logs routed outside Entra ID before the pilot's first change 3.5 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Security operations Owner or approver: Security operations Source: ../books/b03-hr-identity/11-drift-metrics-and-evidence.md#the-evidence-each-event-leaves 19 1 0 7 27 27 ATG2 Gate 2 — Attributes proven for the pilot 3.6 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Correlation threshold met on the pilot cohort; every enabled account correlated or on a dated exception list; no duplicate keys; every other write path to the access slots removed in AD and Entra ID; logs leaving Entra ID Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 24 1 0 7 25 1 0 7 26 1 0 7 28 28 Phase 3 — Sync 4 1

1

2027-01-27T08:00:00 2027-02-26T17:00:00 29 29 AT3.1 Sync mapping for the slot register: carriers in the provisioning apps' target lists, date mappings, the transitional account-type rule, the DoNotSync filter; soft and hard match blocked 4.1 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-3-map-the-attributes-through-sync 19 1 0 7 30 30 X-P17 Sync and DNS Private Resolver designs (program P1.7) 4.2 2 2027-02-12T17:00:00 2027-02-12T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The sync design is approved without the attribute flow for the coded slots Source: program-master-schedule.md 4 2027-02-12T17:00:00 29 1 0 7 31 31 X-IG3 HR feed live for the foundation scope, shadow differences explained (Identity Lifecycle plan, Gate 3) 4.3 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 ISSO (Identity Lifecycle & Provisioning plan) Owner or approver: ISSO (Identity Lifecycle & Provisioning plan) If decided late: The coded slots have no live writer, so the group library can't be shadowed on real data Source: identity-lifecycle.md 4 2027-02-26T17:00:00 32 32 ATG3 Gate 3 — Attributes flowing 4.4 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Identity engineering lead Owner or approver: Identity engineering lead Criteria: Object counts within ±1%; no sync errors; every slot in the register arrives in Entra ID with the value HR sent; shadow-mode differences explained; both match types blocked outside a planned window Source: ../books/b02-identity/10-migrating-and-governing.md#phase-1-sync-deployment-and-initial-sync 29 1 0 7 31 1 0 7 27 1 0 7 33 33 Phase 4 — Groups and administrative units 5 1

1

2027-01-20T08:00:00 2027-03-12T17:00:00 34 34 AT4.1 Dynamic user group library: node and functional rules on codes; every access rule guarded by accountEnabled and userType and excluding agents' accounts; nesting flattened; no memberOf 5.1 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/guides/attribute-driven-migration.md#stage-4-materialize-ou-subtrees-as-dynamic-groups 19 1 0 7 3 1 0 7 35 35 AT4.2 Rules checked before they exist in production: guards, codes not names, paused processing; each rule tested against named users 5.2 2 2027-02-03T08:00:00 2027-02-05T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b06-data-platform/17-dynamic-membership-delegation-and-privilege.md#writing-naming-and-testing-rules 34 1 0 7 36 36 D-AT4 Restricted management, unit by unit, before each unit exists 5.3 2 2027-01-19T17:00:00 2027-01-19T17:00:00 PT0H0M0S 7 1 Identity engineering Owner or approver: Identity engineering Options: No (the default): the unit scopes writes and stays in governance automation; yes, for a small set of sensitive accounts, accepting that they leave PIM, entitlement management, Lifecycle Workflows and access reviews If decided late: A unit is created without the decision, and restriction can't be changed afterward Source: ../books/b02-identity/05-delegation-without-ous.md#restricted-management-a-per-au-decision 4 1 0 7 37 37 AT4.3 Unit registry: tenant readers, department and division units whose rules mirror the group rules; scoped roles to PIM-eligible role-assignable groups; each unit created before the groups it holds 5.4 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-5-delegate-with-administrative-units 36 1 0 7 19 1 0 7 38 38 ATG4 Gate 4 — Group library and units designed 5.5 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 Identity engineering lead Owner or approver: Identity engineering lead Criteria: Every governed group on one of the two patterns, on codes, with guards; every unit rule mirroring its group rule; restriction decided for every unit; every role assignment in the matrix Source: ../books/b01-transformation-arc/04-identity-transformation.md#verification 35 1 0 7 37 1 0 7 39 39 X-P12 Dynamic group design tested; enterprise groups and administrative units built (program P1.2) 5.6 2 2027-02-17T17:00:00 2027-02-17T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The program builds groups and units from a design that hasn't been checked Source: program-master-schedule.md 4 2027-02-17T17:00:00 38 1 0 7 40 40 X-P21S Pilot attributes, groups and units going live (program P2.1, its start) 5.7 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: There's no live pilot data to shadow the rules against Source: program-master-schedule.md 4 2027-02-26T17:00:00 41 41 AT4.4 Shadow comparison on the pilot: each dynamic group against the group it replaces, every add and remove explained; membership-delta alerts on 5.8 2 2027-03-01T08:00:00 2027-03-10T17:00:00 PT64H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/guides/attribute-driven-migration.md#dynamic-user-groups-hr-track 40 1 0 7 32 1 0 7 42 42 X-P22 Pilot Conditional Access and Intune policies assigned (program P2.2, its start) 5.9 2 2027-03-12T17:00:00 2027-03-12T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Policies are assigned to groups whose membership hasn't been reconciled Source: program-master-schedule.md 4 2027-03-12T17:00:00 41 1 0 7 43 43 Phase 5 — Personas and targeting conventions 6 1

1

2027-01-21T08:00:00 2027-02-12T17:00:00 44 44 AT5.1 Conditional Access personas from coded attributes (worker type for internals and externals); every grant paired with a block; empty-slot users reported; emergency access excluded 6.1 2 2027-01-21T08:00:00 2027-01-27T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-6-replace-gpo-inheritance-with-conditional-access-and-intune-targeting 16 1 0 7 45 45 D-AT5 The persona set the Conditional Access library targets 6.2 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: The program's personas, built from the worker type and account type codes; personas plus division-specific overlays; fewer personas with more exclusions (not recommended) If decided late: The Conditional Access design runs in report-only without the groups it will enforce on Source: ../books/b04-access/03-the-conditional-access-model.md#naming-and-the-persona-model 44 1 0 7 46 46 X-P15 Conditional Access design running in report-only (program P1.5) 6.3 2 2027-02-12T17:00:00 2027-02-12T17:00:00 PT0H0M0S 7 1 CISO (program) Owner or approver: CISO (program) If decided late: Report-only runs against personas that may change Source: program-master-schedule.md 4 2027-02-12T17:00:00 45 1 0 7 47 47 AT5.2 Device targeting conventions: device slots written at registration by the provisioning service; dynamic device groups only where a rule reads tier or role; filters otherwise; no dynamic device group as an exclusion 6.4 2 2027-01-21T08:00:00 2027-01-25T17:00:00 PT24H0M0S 7 0 Endpoint lead, with the data architect Owner or approver: Endpoint lead, with the data architect Source: ../books/guides/attribute-driven-migration.md#intune-track 16 1 0 7 48 48 X-E12 Intune policy library built unassigned, with groups, filters and scope tags (Endpoint plan, E1.2, its start) 6.5 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Endpoint engineering (Endpoint & Device Modernization plan) Owner or approver: Endpoint engineering (Endpoint & Device Modernization plan) If decided late: The policy library is built on targeting the foundation may change Source: endpoint-device.md 4 2027-01-29T17:00:00 47 1 0 7 49 49 AT5.3 Server targeting conventions: the Arc tag taxonomy drawn from the asset record and aligned with the device slots; resource groups as the delegation scope 6.6 2 2027-01-26T08:00:00 2027-01-28T17:00:00 PT24H0M0S 7 0 Server infrastructure, with the data architect Owner or approver: Server infrastructure, with the data architect Source: ../books/guides/attribute-driven-migration.md#arc-track 18 1 0 7 50 50 X-E42 Tag taxonomy fixed from the asset record (Endpoint plan, E4.2) 6.7 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 Server infrastructure (Endpoint & Device Modernization plan) Owner or approver: Server infrastructure (Endpoint & Device Modernization plan) If decided late: Arc servers are tagged with a taxonomy the device and user sides don't share Source: endpoint-device.md 4 2027-02-05T17:00:00 49 1 0 7 51 51 AT5.4 Non-person conventions: owners and sponsors recorded by the enterprise person key; custom security attributes for service principals (system, environment, tier) defined 6.8 2 2027-01-21T08:00:00 2027-01-25T17:00:00 PT24H0M0S 7 0 Identity engineering, with the identity governance officer Owner or approver: Identity engineering, with the identity governance officer Source: ../books/guides/attribute-driven-migration.md#what-microsoft-documents-for-targeting-service-principals-by-attribute-partly 15 1 0 7 52 52 X-NP12 AI accountability: sponsors mastered in HR (Non-Person Identity plan, NP1.2, its start) 6.9 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 Sponsoring offices, with the identity governance officer (Non-Person Identity Modernization plan) Owner or approver: Sponsoring offices, with the identity governance officer (Non-Person Identity Modernization plan) If decided late: Sponsors are recorded by name rather than by key, and a sponsor's move or departure can't be matched Source: non-person-identity.md 4 2027-01-27T17:00:00 51 1 0 7 53 53 ATG5 Gate 5 — Targeting conventions set 6.10 2 2027-01-28T17:00:00 2027-01-28T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Personas from authoritative codes, grant and block in pairs, empty slots reported; device and server conventions published and handed to the Endpoint plan; non-person owners and sponsors keyed to the person key Source: ../books/guides/attribute-driven-migration.md#attribute-to-mechanism-crosswalk 45 1 0 7 47 1 0 7 49 1 0 7 51 1 0 7 54 54 Phase 6 — PIV and CAC binding 7 1

1

2027-03-01T08:00:00 2027-09-10T17:00:00 55 55 AT6.1 Binding coverage measured: certificateUserIds or altSecurityIdentities present and correct for every pilot card holder; the card management system named as the binding writer 7.1 2 2027-03-01T08:00:00 2027-03-05T17:00:00 PT40H0M0S 7 0 Identity engineering, with the PIV program office Owner or approver: Identity engineering, with the PIV program office Source: ../books/guides/attribute-driven-migration.md#pki-binding 32 1 0 7 56 56 D-AT6 Required affinity binding for PIV and CAC 7.2 2 2027-03-05T17:00:00 2027-03-05T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: High affinity in production (the program's position), with a custom rule per issuer during the pilot; low affinity until coverage is complete, with a dated end; mixed by issuer If decided late: PIV sign-in goes to the pilot at the tenant default, which is low affinity Source: ../books/b07-pki/06-device-and-user-certificates.md#username-bindings-and-affinity 55 1 0 7 57 57 AT6.2 High affinity piloted on the pilot cohort before the tenant setting changes; multifactor binding rule by issuer or policy OID 7.3 2 2027-03-08T08:00:00 2027-03-12T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/09-credentials-and-certificates.md#binding-the-piv-certificate-to-the-entra-user 56 1 0 7 58 58 X-P28 Certificate-based authentication for PIV and CAC holders (program P2.8) 7.4 2 2027-03-24T17:00:00 2027-03-24T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: PIV sign-in reaches the pilot with bindings nobody has measured Source: program-master-schedule.md 4 2027-03-24T17:00:00 57 1 0 7 59 59 D-AT7 Who writes the binding after AD 7.5 2 2027-03-12T17:00:00 2027-03-12T17:00:00 PT0H0M0S 7 1 ICAM governance body Owner or approver: ICAM governance body Options: The card management system writes certificateUserIds through Microsoft Graph at issuance (design guidance, an open pilot); Entra Connect keeps syncing from altSecurityIdentities while any AD remains; manual entry by a Privileged Authentication Administrator (not at scale) If decided late: User issuance can't move off AD CS, because nothing writes the binding without AD Source: ../books/guides/attribute-driven-migration.md#pki-binding 57 1 0 7 60 60 X-P45 User and device issuance off AD CS; smart-card logon GPO retired (program P4.5, its start) 7.6 2 2027-09-10T17:00:00 2027-09-10T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Issuance moves off AD CS with no writer for the binding Source: program-master-schedule.md 4 2027-09-10T17:00:00 59 1 0 7 61 61 ATG6 Gate 6 — PIV binding proven on the pilot 7.7 2 2027-03-12T17:00:00 2027-03-12T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every pilot card holder bound; high affinity piloted with no lockouts; phishing-resistant strength for CBA users; the leaver removes the binding as well as revoking the card Source: ../books/guides/attribute-driven-migration.md#pki-binding 57 1 0 7 62 62 Phase 7 — The mover proof 8 1

1

2027-03-29T08:00:00 2027-04-23T17:00:00 63 63 X-I43 Joiner and mover automation (Identity Lifecycle plan, I4.3) 8.1 2 2027-03-26T17:00:00 2027-03-26T17:00:00 PT0H0M0S 7 1 Identity engineering (Identity Lifecycle & Provisioning plan) Owner or approver: Identity engineering (Identity Lifecycle & Provisioning plan) If decided late: There's no mover workflow to prove the foundation against Source: identity-lifecycle.md 4 2027-03-26T17:00:00 64 64 AT7.1 Mover proof on the pilot: one personnel action moves a test user's organization code; groups, unit, persona and access packages change with no ticket; the device stays put; a drift scan comes back clean 8.2 2 2027-03-29T08:00:00 2027-04-02T17:00:00 PT40H0M0S 7 0 Identity engineering, with HR Owner or approver: Identity engineering, with HR Source: ../books/guides/attribute-driven-migration.md#worked-example-one-user-and-one-mover-event 63 1 0 7 42 1 0 7 53 1 0 7 65 65 ATG7 Gate 7 — Mover proven across the tracks 8.3 2 2027-04-02T17:00:00 2027-04-02T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: The test mover's access changed only through the attributes, within the measured latency; nothing assigned by hand; the device's groups unchanged; the sponsor of any non-person identity the user sponsors notified; the change traced from the personnel action to the drift report Source: ../books/guides/attribute-driven-migration.md#worked-example-one-user-and-one-mover-event 64 1 0 7 61 1 0 7 66 66 X-G2 Program G2 — Pilot Clean 8.4 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Steward and executive sponsor (co-signed; program) Owner or approver: Steward and executive sponsor (co-signed; program) If decided late: The pilot is called clean without a mover having been proved Source: program-master-schedule.md 4 2027-04-23T17:00:00 65 1 0 7 67 67 Phase 8 — Cut-over and the OU tree 9 1

1

2027-04-05T08:00:00 2027-11-05T17:00:00 68 68 AT8.1 Wave scopes written as attribute queries whose groups already exist; leaver automation first in every wave 9.1 2 2027-04-05T08:00:00 2027-04-07T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#stage-7-cut-over-in-phases 65 1 0 7 69 69 X-D07 Wave plan: which divisions, in which order (program D07) 9.2 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Executive sponsor and steering committee (program) Owner or approver: Executive sponsor and steering committee (program) If decided late: Waves are drawn by OU, not by attribute value Source: program-master-schedule.md 4 2027-04-23T17:00:00 68 1 0 7 70 70 AT8.2 Per-wave attribute gate: coverage of the wave's query, shadow diff, a dry run with writes off, then seven days in which every change traces to HR before the ticket path closes 9.3 2 2027-04-08T08:00:00 2027-04-14T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/appendix-c-acceptance-and-cutover.md#proving-hr-is-the-sole-source 68 1 0 7 71 71 X-P31 Wave 1, first region (program P3.1) 9.4 2 2027-05-25T17:00:00 2027-05-25T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Wave 1 closes with no attribute gate Source: program-master-schedule.md 4 2027-05-25T17:00:00 70 1 0 7 72 72 X-IG5 Populations cloud-mastered (Identity Lifecycle plan, Gate 5) 9.5 2 2027-07-02T17:00:00 2027-07-02T17:00:00 PT0H0M0S 7 1 ISSO (Identity Lifecycle & Provisioning plan) Owner or approver: ISSO (Identity Lifecycle & Provisioning plan) If decided late: Shown for reference: the HR plan's own cut-over Source: identity-lifecycle.md 4 2027-07-02T17:00:00 73 73 X-G3 Program G3 — Rollout Complete 9.6 2 2027-09-10T17:00:00 2027-09-10T17:00:00 PT0H0M0S 7 1 Executive sponsor and steering committee (program) Owner or approver: Executive sponsor and steering committee (program) If decided late: The transitional sync rules that read OU placement can't come out while any population still depends on them Source: program-master-schedule.md 4 2027-09-10T17:00:00 74 74 AT8.3 Transitional rules removed: the account-type sync rule that reads OU placement, OU-based scoping filters and the provisioning OU computation for cloud-mastered populations 9.7 2 2027-09-13T08:00:00 2027-09-24T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/09-building-the-entra-target.md#attribute-flow-and-transformations 73 1 0 7 75 75 X-P42 OU-based security groups retired (program P4.2) 9.8 2 2027-09-24T17:00:00 2027-09-24T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The OU tree still grants access through its groups Source: program-master-schedule.md 4 2027-09-24T17:00:00 76 76 AT8.4 OU tree frozen: hand-made delegations removed; no OU drives access, scoping or policy; the tree's final export archived in Git as the record 9.9 2 2027-09-27T08:00:00 2027-10-08T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b01-transformation-arc/04-identity-transformation.md#phase-4-legacy-retirement 74 1 0 7 75 1 0 7 77 77 ATG8 Gate 8 — OU tree retired as a control 9.10 2 2027-10-08T17:00:00 2027-10-08T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every population cut over by attribute query with its gate passed; no sync rule, scoping filter, group, delegation or policy reads OU placement; the final tree archived; rollback by re-enabling, never by re-creating Source: ../books/guides/attribute-driven-migration.md#stage-7-cut-over-in-phases 76 1 0 7 78 78 X-P51 AD changes frozen; final assessment (program P5.1, its start) 9.11 2 2027-11-05T17:00:00 2027-11-05T17:00:00 PT0H0M0S 7 1 Program office (program) Owner or approver: Program office (program) If decided late: AD is frozen while something still reads the OU tree Source: program-master-schedule.md 4 2027-11-05T17:00:00 77 1 0 7 79 79 Phase 9 — Drift, limits and steady state 10 1

1

2027-02-08T08:00:00 2027-12-03T17:00:00 80 80 D-AT8 Drift severity and response times 10.1 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Book 03's classes (missing identity, stale access, orphan account, attribute drift, unauthorized write, credential drift, contractor credential drift, schema drift), which the program's own drift model, Book 13's five classes, groups (the mapping is not yet specified here), with high severity closed in days and the rest on a dated plan; a stricter clock for unauthorized writes to the access slots If decided late: Drift findings pile up with nobody obliged to close them Source: ../books/b03-hr-identity/11-drift-metrics-and-evidence.md#drift-between-hr-and-the-directory 27 1 0 7 81 81 AT9.1 Drift scans scheduled: HR against the directory, the unit and role registry against the tenant, membership deltas; each track's own reconciliation pointed at the same findings queue 10.2 2 2027-03-01T08:00:00 2027-03-05T17:00:00 PT40H0M0S 7 0 Security operations Owner or approver: Security operations Source: ../books/guides/attribute-driven-migration.md#stage-8-detect-and-correct-drift 38 1 0 7 32 1 0 7 80 1 0 7 82 82 X-P211 Drift-clean hold on the pilot (program P2.11, its start) 10.3 2 2027-04-09T17:00:00 2027-04-09T17:00:00 PT0H0M0S 7 1 Program office (program) Owner or approver: Program office (program) If decided late: The drift-clean hold has no scan to measure it Source: program-master-schedule.md 4 2027-04-09T17:00:00 81 1 0 7 83 83 AT9.2 Limits register: dynamic group and rule limits, the 100-workflow Lifecycle Workflows budget, administrative unit limits, dynamic units' cloud availability; reviewed with every design change 10.4 2 2027-02-08T08:00:00 2027-02-10T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#limits 38 1 0 7 84 84 AT9.3 A full drift cycle on the whole estate: findings closed at the source; the nightly plan zero-action 10.5 2 2027-09-27T08:00:00 2027-10-08T17:00:00 PT80H0M0S 7 0 Security operations, with HR Owner or approver: Security operations, with HR Source: ../books/b01-transformation-arc/04-identity-transformation.md#verification 81 1 0 7 74 1 0 7 85 85 ATG9 Gate 9 — Attributes kept true 10.6 2 2027-10-08T17:00:00 2027-10-08T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Valid attributes for every HR-listed worker; every group on one of the two patterns; every unit rule mirroring its group with processing on; every policy targeting only governed groups; zero open high-severity drift findings; logs outside Entra ID; the six lifecycle metrics on the ConMon cadence Source: ../books/b03-hr-identity/12-execution-plan.md#phase-6-sustained-posture 83 1 0 7 84 1 0 7 77 1 0 7 86 86 X-G5 Program G5 — AD Retired 10.7 2 2027-12-03T17:00:00 2027-12-03T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO (program) Owner or approver: Executive sponsor and CIO (program) If decided late: AD is retired with attribute drift still open Source: program-master-schedule.md 4 2027-12-03T17:00:00 85 1 0 7