endpoint-device.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Observe 1 1

1

2027-01-04T08:00:00 2027-01-29T17:00:00 2 2 E0.1 Hybrid-join state checked (SCP, sync scope); fleet run against the loss ledger 1.1 2 2027-01-04T08:00:00 2027-01-13T17:00:00 PT64H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/02-the-hybrid-join-trap.md#what-to-do-first 3 3 E0.2 Every GPO exported to Group Policy analytics, triaged to Intune or Arc scope; baseline per tier captured 1.2 2 2027-01-04T08:00:00 2027-01-19T17:00:00 PT96H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-1-inventory-and-classify 4 4 E0.3 NTLM audit (stage 1) and SPN inventory, duplicates and stale owners flagged 1.3 2 2027-01-04T08:00:00 2027-01-29T17:00:00 PT160H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#phase-1-baseline-the-estate 5 5 D-E1 Path: manual, governed or retrofit 1.4 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: Manual (small estate or pilot, no control plane yet); governed (larger estate, or the authorizing official must sign); retrofit (estate already modernized by hand) If decided late: Nobody knows who holds the decision record; co-management for the pilot can't start Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#how-to-choose 2 1 0 7 6 6 EG0 Gate 0 — Observation signed off 1.5 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Criteria: Every linked GPO and setting inventoried; the NTLM audit window closed; SPNs inventoried with duplicates flagged; device records correlated and the loss ledger run Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#four-phases-observe-first 2 1 0 7 3 1 0 7 4 1 0 7 7 7 Phase 1 — Classify and author 2 1

1

2027-01-11T08:00:00 2027-02-26T17:00:00 8 8 E1.1 Every setting classified and given a disposition; a decision record per setting 2.1 2 2027-01-11T08:00:00 2027-01-22T17:00:00 PT80H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/07-the-gpo-sunset-program.md#step-2-classify-each-setting 3 3 24000 7 9 9 D-E2 Settings with no Intune equivalent 2.2 2 2027-01-22T17:00:00 2027-01-22T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Options: A Remediation script, reviewed later for a native replacement; a Configuration Manager baseline on co-managed devices; a dated exception with its GPO linked for that population only; a standing exception, accepted by the authorizing official If decided late: Decision records stay open and the baseline review can't sign off Source: ../books/b05-devices/07-the-gpo-sunset-program.md#step-2-classify-each-setting 8 1 0 7 10 10 D-E3 Windows 10 posture 2.3 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Options: Upgrade to Windows 11 before the device's wave; keep the device as an exception with an upgrade date If decided late: The compliance policies can't set their OS floor, so baseline authoring waits Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md 6 1 0 7 11 11 D-E4 Windows provisioning for net-new devices 2.4 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Endpoint engineering Owner or approver: Endpoint engineering Options: Classic Windows Autopilot, user-driven, Entra join, OEM or reseller registration with a group tag (the program's GCC default); Autopilot device preparation, with the attribute carried by the serial-number mapping table If decided late: New hardware has no governed path and keeps arriving as tomorrow's migration Source: ../books/b05-devices/04-intune-first-onboarding.md#which-one-in-a-gcc-tenant 6 1 0 7 12 12 D-E6 Update model: Windows Autopatch or program-managed rings 2.5 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Options: Autopatch groups configured to the program's ring table, where the license allows; Intune update rings built from SC-005 If decided late: The Windows Update wave can't be built, and WSUS stays Source: ../books/b05-devices/10-operating-and-evidencing-the-fleet.md#windows-autopatch 6 1 0 7 13 13 E1.2 Policy library built unassigned: compliance, configuration, endpoint security, app protection; groups, filters and scope tags 2.6 2 2027-02-01T08:00:00 2027-02-19T17:00:00 PT120H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-3-baseline-authoring 8 1 0 7 10 1 0 7 14 14 E1.3 Peer review against the decision records; lab ring reports Succeeded for every setting 2.7 2 2027-02-22T08:00:00 2027-02-25T17:00:00 PT32H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#testing-at-each-gate 13 1 0 7 9 1 0 7 15 15 E1.4 Co-management on for the pilot collection; MDMWinsOverGP decided per population 2.8 2 2027-01-25T08:00:00 2027-02-05T17:00:00 PT80H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-2-coexistence-planning 8 1 0 7 5 1 0 7 16 16 E1.5 Intune-first intake: procurement fields, Autopilot registration with group tags, enrollment restrictions 2.9 2 2027-02-01T08:00:00 2027-02-12T17:00:00 PT80H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/04-intune-first-onboarding.md#the-five-phase-process 11 1 0 7 17 17 EG1 Gate 1 — Policy library authored and reviewed 2.10 2 2027-02-25T17:00:00 2027-02-25T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Criteria: A decision record for every setting; every required setting owned by exactly one policy; peer review signed off; lab devices report Succeeded; pilot devices co-managed and syncing Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#testing-at-each-gate 14 1 0 7 15 1 0 7 16 1 0 7 18 18 X-G1 Program G1 — Foundation Complete 2.11 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: The pilot can't start: groups, AUs and the Conditional Access baseline aren't in place Source: program-master-schedule.md 4 2027-02-26T17:00:00 14 1 0 7 19 19 Phase 2 — Pilot 3 1

1

2027-03-01T08:00:00 2027-04-23T17:00:00 20 20 X-D06 Program decision D06: device pattern for each pilot cohort 3.1 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Program office (program) Owner or approver: Program office (program) If decided late: Pilot devices can't move, and this plan's pilot waits Source: program-master-schedule.md 4 2027-02-26T17:00:00 21 21 D-E7 Cut date for each hybrid-joined pilot device 3.2 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: The device's refresh date; an OS upgrade; a troubleshooting rebuild (each needs a reset to reach Entra join) If decided late: The pilot fails its no-hybrid-join-without-a-cut-date criterion, and so does the program's G2 Source: ../books/b05-devices/02-the-hybrid-join-trap.md#the-governed-path 20 1 0 7 22 22 E2.1 Pilot devices moved by pattern, with device attributes populated 3.3 2 2027-03-22T08:00:00 2027-03-31T17:00:00 PT64H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/02-the-hybrid-join-trap.md#the-governed-path 23 1 0 7 17 1 0 7 18 1 0 7 20 1 0 7 23 23 E2.2 Sliders at Pilot Intune; policies assigned to the pilot cohort with a 7-day grace period; GPOs left linked 3.4 2 2027-03-15T08:00:00 2027-03-19T17:00:00 PT40H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-4-pilot 18 1 48000 7 24 24 E2.3 Conflicts measured (gpresult against per-setting status); application and user tests against the baseline 3.5 2 2027-03-22T08:00:00 2027-04-16T17:00:00 PT160H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-4-pilot 23 1 0 7 25 25 E2.4 Compliant-device Conditional Access in report-only for the pilot; coverage reconciled 3.6 2 2027-03-22T08:00:00 2027-04-02T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b05-devices/10-operating-and-evidencing-the-fleet.md#compliance-and-the-conditional-access-hand-off 23 1 0 7 26 26 E2.5 First setting class retired: GPO backed up, evidence checked, links disabled on the pilot OUs 3.7 2 2027-04-19T08:00:00 2027-04-23T17:00:00 PT40H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/07-the-gpo-sunset-program.md#freezing-and-unlinking-gpos 24 1 0 7 27 27 E2.8 SPNs repaired for pilot applications; NTLM restriction plan per application 3.8 2 2027-04-01T08:00:00 2027-04-14T17:00:00 PT80H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#phase-3-repair-spns-before-enforcing-kerberos 22 1 0 7 6 1 0 7 28 28 EG2 Gate 2 — Pilot clean 3.9 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Endpoint engineering Owner or approver: Endpoint engineering Criteria: No unexplained Conflict or Error; no application regressions against the baseline; one setting class retired with evidence; every hybrid-joined pilot device has a cut date; an NTLM restriction plan per application Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#testing-at-each-gate 26 1 0 7 25 1 0 7 27 1 0 7 21 1 0 7 29 29 X-G2 Program G2 — Pilot Clean 3.10 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Steward and executive sponsor (co-signed; program) Owner or approver: Steward and executive sponsor (co-signed; program) If decided late: The workload waves can't start Source: program-master-schedule.md 4 2027-04-23T17:00:00 28 1 0 7 30 30 Phase 3 — Workload cutover 4 1

1

2027-04-26T08:00:00 2027-09-10T17:00:00 31 31 E3.1 Workload wave 1, compliance policies: slider to Intune; CP-001 to CP-003 and CP-005 in rings, each watched 72 hours 4.1 2 2027-04-26T08:00:00 2027-05-14T17:00:00 PT120H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-5-workload-cutover-in-waves 28 1 0 7 29 1 0 7 32 32 E3.2 Workload wave 2, Endpoint Protection: ES-001 to ES-006; matching GPO links disabled 4.2 2 2027-05-17T08:00:00 2027-06-04T17:00:00 PT120H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-5-workload-cutover-in-waves 31 1 0 7 33 33 E3.3 Workload wave 3, device configuration: the settings catalog profiles; matching GPO links disabled 4.3 2 2027-06-07T08:00:00 2027-06-25T17:00:00 PT120H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-5-workload-cutover-in-waves 32 1 0 7 34 34 E3.4 Workload wave 4, Windows Update policies: update rings assigned; WSUS stopped for migrated devices 4.4 2 2027-06-28T08:00:00 2027-07-16T17:00:00 PT120H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-5-workload-cutover-in-waves 33 1 0 7 12 1 0 7 35 35 E3.6 NTLM stage 2 per application, after owner sign-off: LM and NTLMv1 refused 4.5 2 2027-04-26T08:00:00 2027-06-04T17:00:00 PT240H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#phase-3-restrict-ntlm-in-stages 27 1 0 7 29 1 0 7 36 36 E3.7 Weekly inventory reconciliation and daily drift export running; alerts set 4.6 2 2027-04-26T08:00:00 2027-05-07T17:00:00 PT80H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/10-operating-and-evidencing-the-fleet.md#device-inventory-reconciliation 28 1 0 7 37 37 E3.8 Residual cleanup: remaining links disabled after 7 clean days; tattooed preference items cleared or owned 4.7 2 2027-07-19T08:00:00 2027-07-30T17:00:00 PT80H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-6-verification-and-residual-cleanup 34 1 0 7 38 38 X-P35 Program P3.5: GPO links off migrated OUs after 7 clean days 4.8 2 2027-08-25T17:00:00 2027-08-25T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The 90-day hold on the disabled GPOs starts late, and so does their deletion Source: program-master-schedule.md 4 2027-08-25T17:00:00 37 1 0 7 39 39 EG3 Gate 3 — Workloads cut over 4.9 2 2027-07-30T17:00:00 2027-07-30T17:00:00 PT0H0M0S 7 1 Endpoint engineering Owner or approver: Endpoint engineering Criteria: Each wave's settings report success on its population; no migrated device processes an in-scope GPO; every preference item cleared or owned; evidence filed Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#testing-at-each-gate 37 1 0 7 35 1 0 7 36 1 0 7 40 40 X-G3 Program G3 — Rollout Complete 4.10 2 2027-09-10T17:00:00 2027-09-10T17:00:00 PT0H0M0S 7 1 Executive sponsor and steering committee (program) Owner or approver: Executive sponsor and steering committee (program) If decided late: Formal retirement and NTLM stage 3 can't close Source: program-master-schedule.md 4 2027-09-10T17:00:00 41 41 Phase 4 — Servers under Azure Arc 5 1

1

2027-01-04T08:00:00 2027-07-16T17:00:00 42 42 E4.1 Arc resource groups per owning team; Onboarding role to the service principal only, Resource Administrator to server operations, scoped and held through PIM 5.1 2 2027-02-01T08:00:00 2027-02-05T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#roles 6 1 0 7 43 43 E4.2 Tag taxonomy fixed from the asset record: Environment, Workload, Criticality, Owner, CostCenter, PatchGroup, ArcOnboardedDate; SQL Server opt-out tag where needed 5.2 2 2027-02-01T08:00:00 2027-02-05T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#resource-groups-and-tags 6 1 0 7 44 44 E4.3 Network readiness per site: Arc service tags or a private link scope; azcmagent check from a representative server 5.3 2 2027-02-01T08:00:00 2027-02-12T17:00:00 PT80H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#network 6 1 0 7 45 45 D-E5 Arc onboarding method 5.4 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Server infrastructure Owner or approver: Server infrastructure Options: A certificate-based service principal through the tool the server team already runs (Configuration Manager, Ansible or Group Policy); the portal script for a handful of servers or a pilot; Arc-enabled VMware vSphere; the multicloud connector for AWS If decided late: The pilot server wave can't create its credential Source: ../books/b05-devices/09-servers-under-azure-arc.md#choose-a-method 6 1 0 7 46 46 E4.4 Certificate-based onboarding service principal at resource-group scope, created as a recorded change and handed to the chosen tool 5.5 2 2027-02-08T08:00:00 2027-02-09T17:00:00 PT16H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#create-the-onboarding-service-principal 45 1 0 7 42 1 0 7 47 47 E4.5 Policy baseline as code: machine configuration prerequisites, Azure compute security baselines, Update Manager schedules by PatchGroup, Defender for Servers Plan 2, extension allowlists 5.6 2 2027-02-08T08:00:00 2027-02-19T17:00:00 PT80H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#the-day-one-baseline 43 1 0 7 48 48 E4.6 Any Windows Server 2016 exception hosts: connected for ESUs before end of support (January 12, 2027), Allow/None allowlist; each with a signed risk acceptance and a retirement date 5.7 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#extended-security-updates 49 49 E4.7 Pilot server wave: connected with tags through the chosen tool, licensing attested, certificate file removed, agent local controls set 5.8 2 2027-02-15T08:00:00 2027-02-18T17:00:00 PT32H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#connect 44 1 0 7 46 1 0 7 50 50 E4.8 Pilot baseline attached on the same change and evaluated: machine configuration compliance, Update Manager assessment, Defender for Servers Plan 2 onboarded 5.9 2 2027-02-22T08:00:00 2027-02-25T17:00:00 PT32H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#the-day-one-baseline 49 1 0 7 47 1 0 7 51 51 X-P113 Pilot servers connected through Arc with machine configuration applied (program P1.13) 5.10 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The program's pilot has no governed servers, and the Data Platform plan's pilot SQL Server host has no Arc pattern to follow Source: program-master-schedule.md 4 2027-02-26T17:00:00 50 1 0 7 52 52 E4.9 Pilot wave closed: credential rotated or removed, onboarding GPO disabled; rollback rehearsed on a test server (extensions, disconnect, uninstall) 5.11 2 2027-02-26T08:00:00 2027-03-02T17:00:00 PT24H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#rollback 50 1 0 7 53 53 E4.10 Estate waves: each creates its credential, connects, attests, attaches the baseline, verifies and closes by removing what onboarding needed 5.12 2 2027-04-26T08:00:00 2027-07-02T17:00:00 PT400H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#onboarding 29 1 0 7 52 1 0 7 54 54 E4.11 Update Manager across the estate: periodic assessment on every server; scheduled patching in maintenance windows scoped by PatchGroup 5.13 2 2027-05-10T08:00:00 2027-05-21T17:00:00 PT80H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#azure-update-manager 53 3 48000 7 55 55 E4.12 Servers Arc doesn't reach recorded and tiered; Windows Server 2012 hosts migrated, upgraded or isolated with the risk accepted 5.14 2 2027-04-26T08:00:00 2027-05-14T17:00:00 PT120H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#which-servers-arc-reaches 29 1 0 7 56 56 E4.13 Estate monitoring: connection-state alerts, agent currency, the three baselines watched together, ESU coverage reported 5.15 2 2027-07-05T08:00:00 2027-07-09T17:00:00 PT40H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b05-devices/09-servers-under-azure-arc.md#monitoring-the-server-estate 53 1 0 7 57 57 EG4 Gate 4 — Servers under Arc 5.16 2 2027-07-09T17:00:00 2027-07-09T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Criteria: Every in-scope server Connected with the full tag taxonomy, or in the exception register with its tier; machine configuration baseline assigned and evaluated, noncompliance filed as findings; Update Manager assessing every server and patching on its PatchGroup schedule; Defender for Servers Plan 2 onboarded; no onboarding credential or certificate file left after any wave; no Windows Server 2016 host remains, or each one is a recorded exception with ESU coverage, a signed risk acceptance and a retirement date; rollback rehearsed Source: ../books/b05-devices/09-servers-under-azure-arc.md#what-this-chapter-establishes 53 1 0 7 54 1 0 7 55 1 0 7 56 1 0 7 48 1 0 7 58 58 X-P37 Every server Arc-connected or excepted (program P3.7) 5.17 2 2027-07-16T17:00:00 2027-07-16T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The program's G3 fails its every-server-Arc-connected-or-excepted criterion Source: program-master-schedule.md 4 2027-07-16T17:00:00 57 1 0 7 59 59 Phase 5 — Formal retirement 6 1

1

2027-04-26T08:00:00 2027-11-30T17:00:00 60 60 X-D08 Program decision D08: end dates for legacy authentication and NTLM 6.1 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Authorizing official (program) Owner or approver: Authorizing official (program) If decided late: NTLM stage 3 has no date for application owners to plan against Source: program-master-schedule.md 4 2027-04-23T17:00:00 61 61 E5.1 Migrated GPOs disabled and held 90 days as the rollback net 6.2 2 2027-08-26T08:00:00 2027-11-23T17:00:00 PT512H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-7-formal-retirement 39 1 0 7 38 1 0 7 62 62 E5.2 Backups restore-tested; GPOs archived and deleted; exception register closed 6.3 2 2027-11-24T08:00:00 2027-11-30T17:00:00 PT40H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/08-gpo-to-intune-policy-migration.md#phase-7-formal-retirement 61 1 0 7 40 1 0 7 63 63 E5.3 NTLM stage 3: deny all; exceptions removed as each dependency retires 6.4 2 2027-09-13T08:00:00 2027-10-08T17:00:00 PT160H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b05-devices/05-the-governed-manual-and-retrofit-paths.md#phase-3-restrict-ntlm-in-stages 35 1 0 7 60 1 0 7 40 1 0 7 64 64 E5.4 Evidence for CM-2, CM-6, CM-7, CM-8 and SI-2, workstations and servers, handed to the ISSO 6.5 2 2027-09-13T08:00:00 2027-09-17T17:00:00 PT40H0M0S 7 0 Endpoint engineering Owner or approver: Endpoint engineering Source: ../books/b05-devices/10-operating-and-evidencing-the-fleet.md#reporting-and-the-evidence-an-assessor-reads 36 1 0 7 57 1 0 7 40 1 0 7 65 65 EG5 Gate 5 — GPOs retired 6.6 2 2027-11-30T17:00:00 2027-11-30T17:00:00 PT0H0M0S 7 1 CISO / ISSO Owner or approver: CISO / ISSO Criteria: No GPO in scope linked to an OU with migrated devices; every retired GPO backed up with a decision record; only dated exceptions remain, each with an owner and review date; workload sliders at Intune Source: ../books/b05-devices/07-the-gpo-sunset-program.md#the-end-state 62 1 0 7 63 1 0 7 64 1 0 7