identity-lifecycle.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Program alignment 1 1

1

2027-01-04T08:00:00 2027-02-05T17:00:00 2 2 I0.1 Integration-point inventory, naming the HR-driven identity feed 1.1 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 HR 2.0 project team point of contact Owner or approver: HR 2.0 project team point of contact Source: ../books/b03-hr-identity/12-execution-plan.md#phase-0-program-alignment 3 3 I0.2 Entra migration plan names HR as the source for each population 1.2 2 2027-01-06T08:00:00 2027-01-08T17:00:00 PT24H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b03-hr-identity/12-execution-plan.md#phase-0-program-alignment 2 3 9600 7 4 4 I0.3 Legacy identity data to retain identified 1.3 2 2027-01-04T08:00:00 2027-01-07T17:00:00 PT32H0M0S 7 0 Records officer Owner or approver: Records officer Source: ../books/b03-hr-identity/12-execution-plan.md#phase-0-program-alignment 5 5 I0.4 Privacy basis: routine use, PIA update, minimized attribute set 1.4 2 2027-01-04T08:00:00 2027-02-05T17:00:00 PT200H0M0S 7 0 Privacy officer Owner or approver: Privacy officer Source: ../books/b03-hr-identity/appendix-b-security-and-privacy.md 6 6 IG0 Gate 0 — Inventory signed and submitted 1.5 2 2027-01-08T17:00:00 2027-01-08T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: The integration-point inventory is signed by the ISSO and submitted to the agency's HR 2.0 team Source: ../books/b03-hr-identity/12-execution-plan.md#phase-0-program-alignment 2 1 0 7 3 1 0 7 4 1 0 7 7 7 Phase 1 — Attribute authority and schema 2 1

1

2027-01-11T08:00:00 2027-02-05T17:00:00 8 8 D-I1 Enterprise person key, and how source keys map to it 2.1 2 2027-01-08T17:00:00 2027-01-08T17:00:00 PT0H0M0S 7 1 ICAM governance body, with HR and identity engineering Owner or approver: ICAM governance body, with HR and identity engineering Options: The HCM person number; another HR key; a minted enterprise key If decided late: The authority map can't be signed; the critical path waits Source: ../books/b03-hr-identity/04-attribute-authority.md 6 1 0 7 9 9 I1.1 Standard-attribute crosswalk and nature-of-action trigger table 2.2 2 2027-01-11T08:00:00 2027-01-15T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md 6 1 0 7 10 10 I1.2 Attribute authority map signed (HR's part is program decision D02) 2.3 2 2027-01-18T08:00:00 2027-01-20T17:00:00 PT24H0M0S 7 0 ICAM governance body Owner or approver: ICAM governance body Source: ../books/b03-hr-identity/04-attribute-authority.md 9 1 0 7 8 1 0 7 11 11 I1.3 Canonical schema finalized and validated against a sandbox extract 2.4 2 2027-01-21T08:00:00 2027-01-26T17:00:00 PT32H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md 10 1 0 7 12 12 D-I2 Worker-type taxonomy and the three access-attribute code lists 2.5 2 2027-01-20T17:00:00 2027-01-20T17:00:00 PT0H0M0S 7 1 HR Owner or approver: HR Options: Employee, contractor, intern, volunteer, vendor, external, each with a license, access ceiling and retention If decided late: Naming, placement and scoping rules wait Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 10 1 0 7 13 13 I1.4 UPN, sAMAccountName, OU placement and scoping rules 2.6 2 2027-01-21T08:00:00 2027-01-25T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 12 1 0 7 14 14 I1.5 HR data baselined; employeeId populated; orphan candidates owned 2.7 2 2027-01-11T08:00:00 2027-01-26T17:00:00 PT96H0M0S 7 0 HR Owner or approver: HR Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 6 1 0 7 15 15 I1.6 PIV issuing CAs' CRLs checked against Entra's limits 2.8 2 2027-01-11T08:00:00 2027-01-13T17:00:00 PT24H0M0S 7 0 PIV credentialing office Owner or approver: PIV credentialing office Source: ../books/b03-hr-identity/09-credentials-and-certificates.md 6 1 0 7 16 16 IG1 Gate 1 — Authority and schema signed 2.9 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Identifier decision, authority map and schema signed; privacy basis (routine use, PIA update, minimized attribute set) in place; correlation measured on the pilot cohort (the threshold itself is decided and tested at Gate 2 of the Attribute-Driven Migration plan, ATG2); every enabled account correlated or on a dated exception list Source: ../books/b03-hr-identity/12-execution-plan.md#phase-1-attribute-authority-and-schema 11 1 0 7 13 1 0 7 14 1 0 7 15 1 0 7 5 1 0 7 17 17 Phase 2 — Pipeline build and test 3 1

1

2027-01-26T08:00:00 2027-02-11T17:00:00 18 18 I2.1 Workforce identity service (middleware) built in-boundary 3.1 2 2027-01-27T08:00:00 2027-02-03T17:00:00 PT48H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/05-the-provisioning-pipeline.md 11 1 0 7 19 19 I2.2 API-driven provisioning apps; least-privilege permissions; throttling sized 3.2 2 2027-01-27T08:00:00 2027-01-29T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/05-the-provisioning-pipeline.md 11 1 0 7 20 20 I2.3 Joiner, mover and leaver workflows and custom task extensions 3.3 2 2027-01-26T08:00:00 2027-02-02T17:00:00 PT48H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/08-joiner-mover-leaver.md 13 1 0 7 21 21 I2.4 End-to-end proof in the test tenant, including device retire and test-CA revocation 3.4 2 2027-02-08T08:00:00 2027-02-11T17:00:00 PT32H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-2-pipeline-build-and-test 18 1 0 7 19 1 0 7 20 1 0 7 16 1 0 7 22 22 IG2 Gate 2 — Pipeline proven end to end 3.5 2 2027-02-11T17:00:00 2027-02-11T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Joiner, mover and leaver each run end to end in the test tenant with a provenance record and a workflow run Source: ../books/b03-hr-identity/12-execution-plan.md#phase-2-pipeline-build-and-test 21 1 0 7 23 23 Phase 3 — Hybrid go-live (pilot) 4 1

1

2027-02-08T08:00:00 2027-02-26T17:00:00 24 24 I3.1 Two provisioning agents under a gMSA with OU-scoped rights 4.1 2 2027-02-08T08:00:00 2027-02-09T17:00:00 PT16H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b03-hr-identity/05-the-provisioning-pipeline.md 16 1 0 7 25 25 I3.2 Initial full sync with scoping filters; mismatches reconciled 4.2 2 2027-02-12T08:00:00 2027-02-16T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-3-hybrid-go-live-pilot 22 1 0 7 24 1 0 7 5 1 0 7 26 26 I3.3 Shadow mode on the pilot cohort; every difference explained 4.3 2 2027-02-17T08:00:00 2027-02-23T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-3-hybrid-go-live-pilot 25 1 0 7 27 27 D-I4 Let the pipeline act on the pilot cohort 4.4 2 2027-02-23T17:00:00 2027-02-23T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Options: Act; extend shadow mode If decided late: The go-live waits, and with it the program's G1 Source: ../books/b03-hr-identity/12-execution-plan.md#phase-3-hybrid-go-live-pilot 26 1 0 7 28 28 I3.4 Delta feeds live; first joiner/mover/leaver cycle closes with evidence 4.5 2 2027-02-24T08:00:00 2027-02-26T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-3-hybrid-go-live-pilot 27 1 0 7 29 29 IG3 Gate 3 — HR feed live for the foundation scope 4.6 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: The observation period's differences explained and fixed; a full joiner/mover/leaver cycle on the pilot cohort closed with evidence; zero unmatched-record creations Source: ../books/b03-hr-identity/12-execution-plan.md#phase-3-hybrid-go-live-pilot 28 1 0 7 30 30 Phase 4 — Lifecycle automation and derived access 5 1

1

2027-03-01T08:00:00 2027-04-23T17:00:00 31 31 I4.1 Leaver automation on for covered populations; block and revocation intervals measured 5.1 2 2027-03-01T08:00:00 2027-03-12T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-4-lifecycle-automation-and-attribute-derived-access 29 1 0 7 32 32 I4.2 Exception routes: emergency terminations, litigation holds 5.2 2 2027-03-01T08:00:00 2027-03-05T17:00:00 PT40H0M0S 7 0 Help desk Owner or approver: Help desk Source: ../books/b03-hr-identity/12-execution-plan.md#phase-4-lifecycle-automation-and-attribute-derived-access 29 1 0 7 33 33 I4.3 Joiner and mover automation; rehire and conversion matching validated 5.3 2 2027-03-15T08:00:00 2027-03-26T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/08-joiner-mover-leaver.md 31 1 0 7 34 34 I4.4 Hand-kept groups converted to rules, shadow-compared one by one 5.4 2 2027-03-08T08:00:00 2027-04-09T17:00:00 PT200H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b03-hr-identity/10-from-attributes-to-access.md 31 3 24000 7 35 35 I4.5 Access packages re-based on the supervisor of record 5.5 2 2027-03-29T08:00:00 2027-04-09T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-4-lifecycle-automation-and-attribute-derived-access 33 1 0 7 36 36 I4.6 A full pay-period cycle with zero missed leavers; test reorganization 5.6 2 2027-04-12T08:00:00 2027-04-23T17:00:00 PT80H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b03-hr-identity/12-execution-plan.md#phase-4-lifecycle-automation-and-attribute-derived-access 33 1 0 7 34 1 0 7 35 1 0 7 32 1 0 7 37 37 IG4 Gate 4 — Lifecycle automated 5.7 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Zero missed leavers across a pay period; block within threshold; account-creation tickets retired for covered populations; a test reorganization propagates with zero manual changes Source: ../books/b03-hr-identity/12-execution-plan.md#phase-4-lifecycle-automation-and-attribute-derived-access 36 1 0 7 38 38 Phase 5 — Cutover, population by population 6 1

1

2027-02-08T08:00:00 2027-07-02T17:00:00 39 39 D-I3 Source of authority for contractors and other non-employees 6.1 2 2027-02-05T17:00:00 2027-02-05T17:00:00 PT0H0M0S 7 1 ICAM governance body Owner or approver: ICAM governance body Options: Core HCM contingent workers; the PIV sponsorship system; the contractor suitability register; a combination with one authority per fact If decided late: Contractors stay on COR spreadsheets; their cutover can't be planned Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md 16 1 0 7 40 40 D-I5 Order of populations to cut over, aligned to the Core HCM onboarding 6.2 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: Follow the program's waves; follow the agency's Core HCM go-live If decided late: Retargeting can't be scheduled Source: ../books/b03-hr-identity/12-execution-plan.md#phase-5-cutover-population-by-population 37 1 0 7 41 41 I5.1 Employee populations retargeted to the Entra app, one by one, evidence-gated 6.3 2 2027-04-26T08:00:00 2027-06-18T17:00:00 PT320H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/12-execution-plan.md#phase-5-cutover-population-by-population 40 1 0 7 42 42 I5.2 Contractor populations onboarded from their decided source and retargeted 6.4 2 2027-05-10T08:00:00 2027-06-18T17:00:00 PT240H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b03-hr-identity/06-canonical-attribute-schema.md 39 1 0 7 41 3 48000 7 43 43 I5.3 OU-bound policy retired; rollback path tested once 6.5 2 2027-06-21T08:00:00 2027-07-02T17:00:00 PT80H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b03-hr-identity/12-execution-plan.md#phase-5-cutover-population-by-population 41 1 0 7 42 1 0 7 44 44 IG5 Gate 5 — Populations cloud-mastered 6.6 2 2027-07-02T17:00:00 2027-07-02T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Cloud-mastered populations run the full lifecycle cloud-native with evidence; no AD writes for migrated populations; rollback tested once Source: ../books/b03-hr-identity/12-execution-plan.md#phase-5-cutover-population-by-population 43 1 0 7