data-platform.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Prerequisites and the consolidation gate 1 1

1

2027-01-04T08:00:00 2027-02-02T17:00:00 2 2 D0.1 Toolchain installed; evidence model and dated output directories under version control 1.1 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r01-prerequisites.md#step-2-the-evidence-model 3 3 D0.2 Estate inventory, read-only: the audit seed, the SPN trail and the wider sweep, fused into one inventory 1.2 2 2027-01-06T08:00:00 2027-01-19T17:00:00 PT80H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r02-estate-discovery-and-consolidation-gate.md#step-1-build-the-estate-inventory-read-only 2 3 9600 7 4 4 D0.3 Three rationalization lenses applied; consolidation constraints recorded 1.3 2 2027-01-20T08:00:00 2027-02-02T17:00:00 PT80H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r02-estate-discovery-and-consolidation-gate.md#step-2-apply-the-three-rationalization-lenses-read-only 3 1 0 7 5 5 D-D1 Retain, consolidate or retire, instance by instance 1.4 2 2027-02-02T17:00:00 2027-02-02T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Options: Retain; consolidate into a target (the source is then retired); retire If decided late: No login may be touched: the audit, Arc and login work all wait on the classified inventory Source: ../books/b06-data-platform/06-retain-consolidate-retire.md#the-three-classifications 4 1 0 7 6 6 D-D2 Consolidation target for each consolidated workload 1.5 2 2027-02-02T17:00:00 2027-02-02T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Options: SQL Server 2022 or 2025 on an Arc-enabled host; Azure SQL Managed Instance; Azure SQL Database or elastic pools. A dedicated target where a constraint blocks shared hosting If decided late: Authentication would be migrated twice, once on the source and again on the target Source: ../books/b06-data-platform/06-retain-consolidate-retire.md#target-state-options 4 1 0 7 7 7 DG0 Gate 0 — Consolidation gate passed 1.6 2 2027-02-02T17:00:00 2027-02-02T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Criteria: One row per instance, classified retain, consolidate or retire and justified by the three lenses; a target named for every consolidated workload; collation, vendor-version, compliance-isolation, failover-cluster and dependency constraints recorded; only retain instances and targets go on Source: ../books/b06-data-platform/r02-estate-discovery-and-consolidation-gate.md#step-3-the-retain-consolidate-retire-decision-the-gate 5 1 0 7 6 1 0 7 8 8 Phase 1 — The authentication audit 2 1

1

2027-02-03T08:00:00 2027-03-02T17:00:00 9 9 D1.1 Authentication audit of the surviving set: discovery pass, then the deep audit 2.1 2 2027-02-03T08:00:00 2027-02-12T17:00:00 PT64H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r03-the-authentication-audit.md#the-primary-script-spec3-d1.8-get-sqlserverauthaudit.ps1 7 1 0 7 10 10 D1.2 Audit read: Category 1, 2 or 3 per instance; blockers listed; failover cluster instances flagged 2.2 2 2027-02-15T08:00:00 2027-02-18T17:00:00 PT32H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r03-the-authentication-audit.md#reading-the-result-migration-readiness 9 1 0 7 11 11 D1.3 NTLM Phase A baseline: SPN map and collisions, auth_scheme, host Security logs, Restrict NTLM audit policies, enhanced NTLM logging 2.3 2 2027-02-03T08:00:00 2027-03-02T17:00:00 PT160H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/15-the-three-phases-of-ntlm-elimination.md#phase-a-discovery 7 1 0 7 12 12 D-D3 Upgrade or retire each pre-2022 retain instance 2.4 2 2027-02-18T17:00:00 2027-02-18T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Options: Upgrade to SQL Server 2022 or later and follow the Category 2-to-1 path; retire or consolidate it; keep it on a sunset-dated exception with the certificate-based interim posture (the authorizing official decides the exception) If decided late: Category 3 instances have no path to Entra logins, and the exception long tail can't be sized Source: ../books/b06-data-platform/12-the-engine-authentication-decision.md#decision-4-pre-2022-instances-are-upgrade-or-except 10 1 0 7 13 13 D-D4 The engine authentication standard 2.5 2 2027-02-18T17:00:00 2027-02-18T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: SQL authentication refused and sa disabled and renamed on every production instance, with break-glass as an empty Windows group; a type-S login kept past migration only as a dated exception with a named compensating control. Open-ended retention isn't an option If decided late: Instances have no standard to cut over against, and the pilot can't be signed off Source: ../books/b06-data-platform/12-the-engine-authentication-decision.md#decision-3-sql-authentication-eliminated-sa-disabled-and-renamed 10 1 0 7 14 14 DG1 Gate 1 — Audit read and NTLM baselined 2.6 2 2027-03-02T17:00:00 2027-03-02T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every retain instance and target audited and placed in Category 1, 2 or 3 with its blockers; failover cluster instances treated as Category 3; the Phase A NTLM baseline ingested by compliance monitoring; the authentication standard set Source: ../books/b06-data-platform/08-reading-the-audit.md 11 1 0 7 12 1 0 7 13 1 0 7 15 15 Phase 2 — The pilot instance 3 1

1

2027-03-01T08:00:00 2027-04-22T17:00:00 16 16 X-ARC Pilot servers connected through Arc with machine configuration applied (program P1.13) 3.1 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The pilot SQL Server host has no Arc pattern to follow, and the pilot waits Source: program-master-schedule.md 4 2027-02-26T17:00:00 17 17 D2.1 Pilot host on Arc: egress confirmed, onboarding service principal, managed-identity token validated, SQL Server extension deployed 3.2 2 2027-03-03T08:00:00 2027-03-09T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b06-data-platform/r04-arc-deployment-and-managed-identity.md#step-1-enroll-the-host 14 1 0 7 16 1 0 7 18 18 D2.2 Graph permissions (SQL Server 2025) or admin consent (SQL Server 2022) granted by a Privileged Role Administrator 3.3 2 2027-03-10T08:00:00 2027-03-11T17:00:00 PT16H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b06-data-platform/r04-arc-deployment-and-managed-identity.md#roles-and-permissions 17 1 0 7 19 19 D2.3 Entra authentication on; Entra admin group set; Entra logins and users created beside the Windows ones 3.4 2 2027-03-12T08:00:00 2027-03-18T17:00:00 PT40H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r05-login-migration-and-parallel-run.md#step-2-create-the-entra-database-users-beside-the-windows-users 18 1 0 7 20 20 D2.4 Parallel run: 30-day observation, recorded with SQL Server Audit 3.5 2 2027-03-19T08:00:00 2027-04-19T17:00:00 PT176H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r05-login-migration-and-parallel-run.md#step-3-the-parallel-run 19 1 0 7 21 21 D-D5 Disable the superseded Windows logins on the pilot instance 3.6 2 2027-04-19T17:00:00 2027-04-19T17:00:00 PT0H0M0S 7 1 Data platform team Owner or approver: Data platform team Options: Disable, don't drop, once the window's exit criteria are met; extend the observation window If decided late: The pilot can't cut over, and the estate waves have no proven pattern Source: ../books/b06-data-platform/r05-login-migration-and-parallel-run.md#step-4-cutover 20 1 0 7 22 22 D2.5 Cutover: Windows logins disabled, not dropped; sa disabled and renamed; scheduled audit started 3.7 2 2027-04-20T08:00:00 2027-04-22T17:00:00 PT24H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r05-login-migration-and-parallel-run.md#the-sa-account 21 1 0 7 23 23 DG2 Gate 2 — Pilot instance on Entra authentication 3.8 2 2027-04-22T17:00:00 2027-04-22T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Arc agent Connected; token audience https://database.windows.net/; SQL Server extension Succeeded; Entra admin set; every application and job seen on its Entra login; no remote NTLM rows; no connection arriving only on a legacy Windows login Source: ../books/b06-data-platform/r04-arc-deployment-and-managed-identity.md#verification-checklist 22 1 0 7 24 24 Phase 3 — The estate: logins, NTLM restriction, access layer 4 1

1

2027-03-01T08:00:00 2027-07-15T17:00:00 25 25 X-G1 G1 — Foundation Complete: groups and AUs drift-clean, Conditional Access baseline enforced (program) 4.1 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: The DBA administrative unit and the SQL group logins have no foundation to build on Source: program-master-schedule.md 4 2027-02-26T17:00:00 26 26 D3.1 DBA administrative unit with restricted management; Groups Administrator scoped to it, eligible through PIM 4.2 2 2027-03-03T08:00:00 2027-03-05T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b06-data-platform/r07-groups-aus-and-the-conditional-access-perimeter.md#sequencing-the-administrative-unit-comes-first 25 1 0 7 14 1 0 7 27 27 D3.2 Access groups and dynamic rules verified; group logins bound; Conditional Access perimeter confirmed on the pilot 4.3 2 2027-04-23T08:00:00 2027-05-13T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b06-data-platform/r07-groups-aus-and-the-conditional-access-perimeter.md#provision-attribute-based-dynamic-groups-entra-dynamic-groups 26 1 0 7 23 1 0 7 28 28 D3.3 Estate waves: every retain instance and target through Arc, Entra authentication, the parallel run and cutover 4.4 2 2027-04-23T08:00:00 2027-07-15T17:00:00 PT480H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/11-three-principal-types.md#the-parallel-run-migration-pattern 23 1 0 7 29 29 D3.4 Phase B, step 1: SPNs registered and collisions repaired, linked-server passthrough replaced, LM and NTLMv1 refused 4.5 2 2027-03-03T08:00:00 2027-03-30T17:00:00 PT160H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r06-ntlm-detection-and-remediation.md#phase-2-remediation-review-required-patterns 14 1 0 7 30 30 X-D08 End dates for legacy authentication and NTLM (program D08) 4.6 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Authorizing official (program) Owner or approver: Authorizing official (program) If decided late: Phase B's deny step and the Phase C block have no date to plan against Source: program-master-schedule.md 4 2027-04-23T17:00:00 31 31 D-D6 Move Restrict NTLM from audit to deny, with exceptions from the Phase A baseline 4.7 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: Deny, with the excepted instances in the domain controller and client lists; stay in audit; if a missed dependency surfaces, relax to audit or add a scoped exception If decided late: NTLMv2 stays open, and Phase C has no restricted baseline to tighten Source: ../books/b06-data-platform/15-the-three-phases-of-ntlm-elimination.md#phase-b-restriction 29 1 0 7 30 1 0 7 32 32 D3.5 Phase B, step 2: Restrict NTLM deny settings staged on clients, servers and domain controllers 4.8 2 2027-04-26T08:00:00 2027-05-14T17:00:00 PT120H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b06-data-platform/r06-ntlm-detection-and-remediation.md#phased-group-policy-restriction 31 1 0 7 33 33 DG3 Gate 3 — Estate on Entra logins, NTLM restricted 4.9 2 2027-07-15T17:00:00 2027-07-15T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every retain instance and target cut over after a clean parallel run; zero critical SPN collisions; Restrict NTLM deny in place with only documented exceptions; DBA administrative unit and group logins verified; a non-compliant sign-in to the SQL resource denied a token Source: ../books/b06-data-platform/15-the-three-phases-of-ntlm-elimination.md#phase-b-restriction 27 1 0 7 28 1 0 7 32 1 0 7 34 34 Phase 4 — The application chain 5 1

1

2027-03-03T08:00:00 2027-10-22T17:00:00 35 35 D4.1 LDAP-bind inventory over 30 days; each application placed on both axes 5.1 2 2027-03-03T08:00:00 2027-04-08T17:00:00 PT216H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b06-data-platform/r08-application-chain-and-connection-strings.md#phase-1-inventory-the-ldap-bind-dependency-read-only-script-backed 14 1 0 7 36 36 D-D7 Class and database-axis column for each application 5.2 2 2027-04-08T17:00:00 2027-04-08T17:00:00 PT0H0M0S 7 1 Application owners Owner or approver: Application owners Options: User axis: Class 3 OIDC, Class 2 SAML, Class 1 Application Proxy, Class 4 Entra Domain Services (last resort). Database axis: A configuration only, B code change, C vendor-dependent, D no Entra path today If decided late: Neither migration track can be sequenced for the application Source: ../books/b06-data-platform/18-the-four-class-pattern-for-applications.md#two-axes-user-sign-in-and-the-database-connection 35 1 0 7 37 37 D4.2 Gate conditions prepared: identity holds its database role; change tested on a production-matching Arc stack 5.3 2 2027-04-23T08:00:00 2027-05-13T17:00:00 PT120H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b06-data-platform/r08-application-chain-and-connection-strings.md#the-three-gate-conditions 36 1 0 7 23 1 0 7 38 38 D-D8 Connection-string cutover, application by application 5.4 2 2027-05-20T17:00:00 2027-05-20T17:00:00 PT0H0M0S 7 1 Application owners Owner or approver: Application owners Options: Cut over in a change window once all three gate conditions hold; fund the code change (column B); carry a dated exception (columns C and D, and Class 4) If decided late: The application keeps its stored credential, and its host instance can't close Source: ../books/b06-data-platform/19-connection-string-migration.md#the-gate-conditions 37 1 0 7 28 3 96000 7 39 39 D4.3 Connection strings cut over; prior configuration kept; legacy logins disabled, not dropped 5.5 2 2027-05-21T08:00:00 2027-07-22T17:00:00 PT360H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b06-data-platform/r08-application-chain-and-connection-strings.md#verification-and-rollback 38 1 0 7 40 40 D4.4 Exceptions filed for Class 4 and deferred applications, sunset dates reconciled against the NTLM block 5.6 2 2027-04-09T08:00:00 2027-04-15T17:00:00 PT40H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b06-data-platform/r08-application-chain-and-connection-strings.md#the-four-class-triage 36 1 0 7 41 41 DG4 Gate 4 — Application chain on Entra principals 5.7 2 2027-07-22T17:00:00 2027-07-22T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every application in Classes 1 to 3 connects as its Entra principal, with no NTLM or KERBEROS rows; every Class 4 or deferred application's host instance carries a dated exception; no stored secret left in a production connection string outside a documented exception Source: ../books/b06-data-platform/r08-application-chain-and-connection-strings.md#verification-and-rollback 39 1 0 7 40 1 0 7 42 42 X-P46 AD-bound service principal names migrated, retired or islanded (program P4.6) 5.8 2 2027-10-22T17:00:00 2027-10-22T17:00:00 PT0H0M0S 7 1 Application owners (program) Owner or approver: Application owners (program) If decided late: SQL Server's applications still hold Windows-authenticated connections when the program measures AD authentication for G4 Source: program-master-schedule.md 4 2027-10-22T17:00:00 41 1 0 7 43 43 Phase 5 — Elimination, closure and the long tail 6 1

1

2027-03-03T08:00:00 2027-12-02T17:00:00 44 44 D5.1 Certificate audit; SQL Server's three AD CS dependencies mapped; CA-migration order derived 6.1 2 2027-03-03T08:00:00 2027-03-16T17:00:00 PT80H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b06-data-platform/r10-certificate-discovery-for-adcs.md#step-2-map-the-audit-to-sql-servers-three-dependencies 14 1 0 7 45 45 D-D9 Replacement CA and the AD CS decommission date for SQL Server's certificates 6.2 2 2027-03-16T17:00:00 2027-03-16T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Options: Book 07's issuers: the retained AD CS hierarchy through CyberArk Certificate Manager, moving to a standalone AD CS issuing CA under the same root when the forest retires; Microsoft Cloud PKI, which would need another enrollment path for SQL Server hosts. Either way, no decommission date until the replacement is issuing If decided late: No decommission date can be set, and the certificate-based interim posture has no assured issuer Source: ../books/b06-data-platform/22-where-sql-server-touches-adcs.md#book-07-has-since-made-the-decision 44 1 0 7 46 46 D-D10 Phase C rule for instances whose interim posture isn't in place 6.3 2 2027-04-15T17:00:00 2027-04-15T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: The Phase C date holds for them; dated exceptions with network-level isolation If decided late: The long tail has no rule on the block date, and its exceptions can't be closed Source: ../books/b06-data-platform/15-the-three-phases-of-ntlm-elimination.md#phase-c-elimination 40 1 0 7 45 1 0 7 47 47 D5.2 Validation period: closure records and the six evidence sets live and satisfied; drift treated as a violation 6.4 2 2027-07-23T08:00:00 2027-09-16T17:00:00 PT320H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/r09-continuous-monitoring-and-closure.md#the-six-live-evidence-sets 33 1 0 7 41 1 0 7 46 1 0 7 48 48 D5.3 Phase C: Restrict NTLM set to deny across the estate 6.5 2 2027-09-17T08:00:00 2027-09-23T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b06-data-platform/15-the-three-phases-of-ntlm-elimination.md#phase-c-elimination 47 1 0 7 30 1 0 7 49 49 DG5 Gate 5 — Estate closed 6.6 2 2027-09-23T17:00:00 2027-09-23T17:00:00 PT0H0M0S 7 1 CIO and data leadership Owner or approver: CIO and data leadership Criteria: All five closure conditions hold at once on every production instance; the six evidence sets satisfied across the validation period; every excepted instance in the registry with its justification, sunset date and own closure record; the scheduled audit still running Source: ../books/b06-data-platform/20-the-closure-condition.md#the-five-closure-conditions 48 1 0 7 50 50 D5.4 Exception long tail: pre-2022 and Class 4 instances upgraded, re-platformed or retired by their sunset dates 6.7 2 2027-09-24T08:00:00 2027-12-02T17:00:00 PT400H0M0S 7 0 Data platform team Owner or approver: Data platform team Source: ../books/b06-data-platform/21-what-done-looks-like.md#a-consequence-not-a-completion-date 49 1 0 7 12 1 0 7