This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Reference
Learn Coverage Map
Every Microsoft Learn page on Windows Server identity and Microsoft Entra, and where the workbook covers it
The Federal Modernization Workbook’s map of every Microsoft Learn identity page, on the Windows Server side and the Microsoft Entra side, to the workbook pages that cite or cover it, with counts by area and the list of gaps.
The workbook leans on Microsoft Learn: an identity migration runs from Active Directory on Windows Server to Microsoft Entra, and Microsoft documents both sides. This page lists every Learn page in the two identity folders and says, for each one, where the workbook covers it. It makes two kinds of gap visible: a Learn topic the workbook should cover and doesn’t, and a workbook page that covers a topic without linking Microsoft’s own page for it.
The two sides are the Learn folders built from Microsoft’s public documentation repositories:
- Windows Server identity: learn.microsoft.com/windows-server/identity, built from
WindowsServerDocs/identity/in MicrosoftDocs/windowsserverdocs. Active Directory Domain Services, Federation Services, Certificate Services, Rights Management, Windows LAPS and the solution guides. - Microsoft Entra: learn.microsoft.com/entra, built from
docs/in MicrosoftDocs/entra-docs. The per-application SaaS tutorials (docs/identity/saas-apps/, one page per third-party application) are left out: each covers one vendor’s single sign-on setup, not a practice the workbook teaches.
How to read it
Each side has a table of counts by area, then one table per area. An area is the page’s top folder on Learn (ad-ds, ad-fs, laps), or, under Entra’s identity/ folder, the folder below it (hybrid, conditional-access, authentication). Each row is one Learn page:
- Learn page links the page on Learn.
- Workbook home links the workbook pages that cover it: first any a reviewer named, then the pages that cite it, published pages first. A file that isn’t a published page (a kit script, a data file, a deck’s narration) links to GitHub.
- Coverage is one of five values:
| Coverage | Meaning | Set by |
|---|---|---|
| Cited | At least one workbook file links the page | The script, from the citations |
| Covered, not cited | A workbook page covers the topic but doesn’t link the Learn page | A reviewer |
| Not covered | The topic belongs in the workbook and isn’t there yet | A reviewer |
| Out of scope | The topic is outside the workbook’s subject (a consumer feature, a product the workbook doesn’t use) | A reviewer |
| Not reviewed yet | Nobody has looked at the page yet | The default for a new page |
A citation counts wherever the workbook makes it: a book chapter, a guide, a training module, an example kit, a data file, a deck’s build script or narration. A link to a page’s old address counts for the page when Microsoft’s redirect files send the old address there. The gap list at the end collects the pages marked not covered and covered, not cited.
How it’s kept current
The data lives in two files, one per side: data/learn-coverage/windows-server-identity.yml and data/learn-coverage/entra.yml. scripts/learn_coverage.py writes them and the tables on this page:
- Citations are automatic. The pull request checks run
python scripts/learn_coverage.py --checkwhenever a workbook file changes. A pull request that adds or removes a link to a Learn identity page fails the check until it carries the regenerated data and page (python scripts/learn_coverage.py --offline, which needs no network). - Coverage is reviewed by hand. A reviewer sets
coverage,noteand, for a page covered without a citation,workbook(the workbook files that cover it) in the data file, then regenerates the page with the same command. The script keeps those fields on every run. A page that gains a citation becomes Cited; a Cited page that loses its last citation goes back to Not reviewed yet. - New and retired Learn pages come from the weekly source watch. Each Monday’s source watch compares the two folders with the previous week’s and lists the pages Microsoft added or removed, under “New and retired Learn identity pages” in its issue. Running
python scripts/learn_coverage.py(with network) then adds the new pages as Not reviewed yet and marks the removed ones gone, keeping them listed until someone moves their citations and deletes the entry.
Counts
| Side | Pages | Cited | Covered, not cited | Not covered | Out of scope | Not reviewed yet |
|---|---|---|---|---|---|---|
| Windows Server identity | 561 | 165 | 22 | 12 | 362 | 0 |
| Microsoft Entra | 2,518 | 1,029 | 446 | 372 | 671 | 0 |
| Both sides | 3,079 | 1,194 | 468 | 384 | 1,033 | 0 |
Windows Server identity
From MicrosoftDocs/windowsserverdocs, folder WindowsServerDocs/identity/, at commit 2205ce8 (2026-11-09).
| Area | Pages | Cited | Covered, not cited | Not covered | Out of scope | Not reviewed yet |
|---|---|---|---|---|---|---|
| ad-cs | 41 | 31 | 9 | 0 | 1 | 0 |
| ad-ds | 227 | 102 | 10 | 4 | 111 | 0 |
| ad-fs | 246 | 13 | 1 | 4 | 228 | 0 |
| ad-rms | 1 | 1 | 0 | 0 | 0 | 0 |
| general | 3 | 1 | 0 | 0 | 2 | 0 |
| laps | 14 | 12 | 2 | 0 | 0 | 0 |
| securing-privileged-access | 1 | 1 | 0 | 0 | 0 | 0 |
| software-restriction-policies | 6 | 2 | 0 | 0 | 4 | 0 |
| solution-guides | 22 | 2 | 0 | 4 | 16 | 0 |
ad-cs
ad-ds
ad-fs
ad-rms
| Learn page | Workbook home | Coverage |
|---|---|---|
| Upgrading AD RMS to Windows Server 2016 | Book 12, Chapter 09 — Data Protection and Classification | Cited |
general
| Learn page | Workbook home | Coverage |
|---|---|---|
| Additional Resources | — | Out of scope |
| Identity and Access documentation | — | Out of scope |
| Configure LDAP Signing by Using Group Policy | Book 02, Chapter 04 — The Hidden Migration Surface | Cited |
laps
securing-privileged-access
| Learn page | Workbook home | Coverage |
|---|---|---|
| Administrative tools and logon types reference - Windows Server | Book 06, Runbook R08 — The Application Chain & Connection-String Migration | Cited |
software-restriction-policies
solution-guides
Microsoft Entra
From MicrosoftDocs/entra-docs, folder docs/, without docs/identity/saas-apps/, at commit 523f3dd (2026-11-09).
| Area | Pages | Cited | Covered, not cited | Not covered | Out of scope | Not reviewed yet |
|---|---|---|---|---|---|---|
| agent-id | 61 | 36 | 17 | 0 | 8 | 0 |
| app-provisioning | 89 | 45 | 31 | 9 | 4 | 0 |
| app-proxy | 62 | 9 | 20 | 22 | 11 | 0 |
| architecture | 150 | 80 | 26 | 17 | 27 | 0 |
| authentication | 164 | 87 | 40 | 9 | 28 | 0 |
| backup | 13 | 5 | 0 | 7 | 1 | 0 |
| conditional-access | 74 | 59 | 5 | 8 | 2 | 0 |
| devices | 58 | 25 | 9 | 23 | 1 | 0 |
| domain-services | 67 | 12 | 0 | 27 | 28 | 0 |
| enterprise-apps | 137 | 72 | 32 | 9 | 24 | 0 |
| external-id | 148 | 29 | 23 | 0 | 96 | 0 |
| fundamentals | 62 | 29 | 5 | 6 | 22 | 0 |
| general | 1 | 0 | 0 | 0 | 1 | 0 |
| global-secure-access | 199 | 81 | 3 | 108 | 7 | 0 |
| hybrid | 243 | 108 | 82 | 18 | 35 | 0 |
| id-governance | 236 | 165 | 38 | 25 | 8 | 0 |
| id-protection | 28 | 8 | 16 | 0 | 4 | 0 |
| identity | 1 | 0 | 0 | 0 | 1 | 0 |
| identity-platform | 363 | 39 | 31 | 29 | 264 | 0 |
| managed-identities-azure-resources | 40 | 12 | 15 | 1 | 12 | 0 |
| monitoring-health | 81 | 40 | 29 | 7 | 5 | 0 |
| multi-tenant-organizations | 16 | 9 | 2 | 2 | 3 | 0 |
| role-based-access-control | 40 | 30 | 7 | 0 | 3 | 0 |
| security-copilot | 25 | 0 | 0 | 0 | 25 | 0 |
| standards | 38 | 10 | 7 | 10 | 11 | 0 |
| users | 62 | 26 | 4 | 12 | 20 | 0 |
| verified-id | 44 | 2 | 0 | 23 | 19 | 0 |
| workload-id | 16 | 11 | 4 | 0 | 1 | 0 |
agent-id
app-provisioning
app-proxy
architecture
authentication
backup
conditional-access
devices
domain-services
enterprise-apps
external-id
fundamentals
general
| Learn page | Workbook home | Coverage |
|---|---|---|
| Microsoft Entra documentation | — | Out of scope |
global-secure-access
hybrid
id-governance
id-protection
identity
| Learn page | Workbook home | Coverage |
|---|---|---|
| Microsoft Entra ID documentation | — | Out of scope |
identity-platform
managed-identities-azure-resources
monitoring-health
multi-tenant-organizations
role-based-access-control
security-copilot
standards
users
verified-id
workload-id
Gaps
Pages a reviewer marked not covered (the workbook should cover the topic and doesn’t) or covered, not cited (a workbook page covers the topic but doesn’t link the Learn page).
Not covered
| Learn page | Side and area | Workbook home | Note |
|---|---|---|---|
| Upgrade domain controllers to a newer version of Windows Server | Windows Server identity, ad-ds | — | In-place DC OS upgrade (adprep, functional levels) not covered; the DC baseline is assumed |
| Command line process auditing | Windows Server identity, ad-ds | — | Process-creation and command-line auditing isn’t discussed in the workbook; the earlier Book 05 Ch08 mapping was wrong (Learn gaps pass, Nov 9, 2026) |
| Active Directory Forest Recovery - Procedures | Windows Server identity, ad-ds | — | Part of the AD forest recovery runbook; not covered anywhere (see gaps) |
| Managing RID Issuance | Windows Server identity, ad-ds | — | Part of the AD forest recovery runbook; not covered anywhere (see gaps) |
| Best Practices for Secure Planning and Deployment of AD FS | Windows Server identity, ad-fs | — | Securing AD FS and WAP while it remains in the path: not covered |
| Determine the Type of Claim Rule Template to Use | Windows Server identity, ad-fs | — | AD FS claims and claim-rule concepts: needed to inventory relying-party trusts and map claims to Entra; only mentioned in b07 ch06-07 |
| The Role of Claims | Windows Server identity, ad-fs | — | AD FS claims and claim-rule concepts: needed to inventory relying-party trusts and map claims to Entra; only mentioned in b07 ch06-07 |
| The Role of the Claims Engine | Windows Server identity, ad-fs | — | AD FS claims and claim-rule concepts: needed to inventory relying-party trusts and map claims to Entra; only mentioned in b07 ch06-07 |
| Claims Transformation Rules Language | Windows Server identity, solution-guides | — | Dynamic Access Control claims/central access policies: AD-dependent file-server access control, not covered (see gaps) |
| Deploy Claims Across Forests | Windows Server identity, solution-guides | — | Dynamic Access Control claims/central access policies: AD-dependent file-server access control, not covered (see gaps) |
| Dynamic Access Control Scenario Overview | Windows Server identity, solution-guides | — | Dynamic Access Control claims/central access policies: AD-dependent file-server access control, not covered (see gaps) |
| Scenario Central Access Policy | Windows Server identity, solution-guides | — | Dynamic Access Control claims/central access policies: AD-dependent file-server access control, not covered (see gaps) |
| Architecture overview | Microsoft Entra, architecture | — | Entra service internals (partitions, replicas, datacenters, consistency); Book 02 Ch03 doesn’t describe the service architecture |
| SSH authentication with Microsoft Entra ID | Microsoft Entra, architecture | — | SSH authentication with Entra; small addition to Book 04 Ch04 or the Arc server chapter |
| Backup Authentication System: Application Guidelines | Microsoft Entra, architecture | — | Backup Authentication System (resilience); check government-cloud availability before adding |
| Customize tokens | Microsoft Entra, architecture | — | Token claims customization (SAML/OIDC migration); small addition to Book 02 Ch04 or Ch10 |
| Microsoft Entra Suite deployment scenario - Secure internet access | Microsoft Entra, architecture | — | Global Secure Access and Entra Suite deployment guidance; new content if the agency licenses it |
| Microsoft Entra Suite deployment scenarios introduction | Microsoft Entra, architecture | — | Global Secure Access and Entra Suite deployment guidance; new content if the agency licenses it |
| Microsoft Entra Suite deployment scenario - Modernize remote access | Microsoft Entra, architecture | — | Global Secure Access and Entra Suite deployment guidance; new content if the agency licenses it |
| Microsoft Global Secure Access Deployment Guide for Microsoft Entra Internet Access | Microsoft Entra, architecture | — | Global Secure Access and Entra Suite deployment guidance; new content if the agency licenses it |
| Microsoft Global Secure Access Proof-of-Concept Guidance - Configure Microsoft Entra Internet Access | Microsoft Entra, architecture | — | Global Secure Access and Entra Suite deployment guidance; new content if the agency licenses it |
| Build resilience in external user authentication with Microsoft Entra ID | Microsoft Entra, architecture | — | Resilience of external user authentication; small addition to the partner identity chapter |
| Build resilience in your IAM infrastructure with Microsoft Entra ID | Microsoft Entra, architecture | — | Entra resilience guidance (hybrid, credentials, on-premises access, device states); contingency chapter candidate (Book 14 Ch06) |
| Build resilience in application access with Application Proxy | Microsoft Entra, architecture | — | Entra resilience guidance (hybrid, credentials, on-premises access, device states); contingency chapter candidate (Book 14 Ch06) |
| Resilience in identity and access management with Microsoft Entra ID | Microsoft Entra, architecture | — | Entra resilience guidance (hybrid, credentials, on-premises access, device states); contingency chapter candidate (Book 14 Ch06) |
| Microsoft Entra collaborating production tenants guidance | Microsoft Entra, architecture | — | Multi-tenant estate design (primary, production, nonproduction, partner tenants); needs a decision on tenant strategy |
| Microsoft Entra tenants for critical business systems guidance | Microsoft Entra, architecture | — | Multi-tenant estate design (primary, production, nonproduction, partner tenants); needs a decision on tenant strategy |
| Microsoft Entra nonproduction environments multitenant guidance | Microsoft Entra, architecture | — | Multi-tenant estate design (primary, production, nonproduction, partner tenants); needs a decision on tenant strategy |
| Microsoft Entra primary production tenant guidance | Microsoft Entra, architecture | — | Multi-tenant estate design (primary, production, nonproduction, partner tenants); needs a decision on tenant strategy |
| Create and review difference reports in Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Recover application secrets using Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Recover objects using Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Recover user authentication methods using Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Review recovery history in Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Troubleshoot Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| View available backups in Microsoft Entra Backup and Recovery | Microsoft Entra, backup | — | Entra Backup and Recovery (backup, difference reports, recovery, soft/hard deletion) is not covered; contingency text (B14 Ch06) does not name it. |
| Microsoft Entra license usage insights | Microsoft Entra, fundamentals | — | License usage insights; licensing owner is unnamed in the workbook. |
| Data protection considerations | Microsoft Entra, fundamentals | — | Entra data residency, operations and protection considerations are not summarized for the authorization package. |
| Add an existing Azure subscription to your tenant | Microsoft Entra, fundamentals | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover associating Azure subscriptions with a tenant. |
| How to find your tenant ID | Microsoft Entra, fundamentals | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t explain finding the tenant ID. |
| Manage the ‘Stay signed in?’ prompt | Microsoft Entra, fundamentals | — | Sign-in persistence is part of the reauthentication policy. Learn pass Nov 9, 2026: Book 04 Ch07 doesn’t discuss the Stay signed in prompt setting. |
| Troubleshoot inaccessible tenants | Microsoft Entra, fundamentals | — | Tenant lockout recovery relies on emergency access accounts. Reset Nov 9, 2026 (citation pass): covers tenants blocked for inactivity, not admin lockout. |
| Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Microsoft Entra Private Network Connector Groups | Microsoft Entra, global-secure-access | — | Private network connector deployment and operation |
| Explicit Forward Proxy Session Management Concepts | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Explicit Forward Proxy Overview | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Learn about Global Secure Access external user access | Microsoft Entra, global-secure-access | — | Global Secure Access for external users and guest licensing; partner identity chapter |
| Learn about the Microsoft Traffic Profile | Microsoft Entra, global-secure-access | — | Checked Nov 9: Book 01 Ch08 and Book 09 Ch12 do not describe the Microsoft traffic profile. |
| Global Secure Access: Advanced Threat Protection | Microsoft Entra, global-secure-access | — | Coexistence with other SSE, VPN, DNS and EDR products; Book 09 Ch05 names the vendors but not the coexistence |
| Microsoft Entra Private Access sign-in every time (preview) | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Proxy Automatic Configuration (PAC) | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Learn about the Global Secure Access Dashboard | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| How to access Global Secure Access audit logs (preview) | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| Apply security policies to remote network traffic | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| How to Assign a Remote Network to a Traffic Forwarding Profile for Global Secure Access | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Check web content filtering categories (preview) | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| How to configure custom HTTP headers in Global Secure Access | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| How to configure routers for remote networks | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Configure Explicit Forward Proxy HTTP Header Session Management | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Configure a Microsoft Edge Application Management Policy for Explicit Forward Proxy | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Configure Explicit Forward Proxy | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| Secure private application access with Privileged Identity Management and Global Secure Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Configure home network support for Microsoft Entra Private Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Configure Microsoft Entra Private Access sign-in every time | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| How to configure Global Secure Access web content filtering | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| How to connect a remote network when your CPE is behind NAT - Microsoft Entra Global Secure Access | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Create a remote network with a custom IKE policy | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Simulate remote network connectivity using Azure vWAN | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Create a Microsoft Entra Private Access traffic forwarding profile | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Host custom Proxy Automatic Configuration files for Explicit Forward Proxy in Microsoft Entra Internet Access | Microsoft Entra, global-secure-access | — | Explicit forward proxy (PAC files, Edge policy) |
| How to Customize Global Secure Access Block Page | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Delete a Microsoft Entra Private Access traffic forwarding profile | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Multi-Geo for Microsoft Entra Private Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Export connector logs to the Log Analytics workspace | Microsoft Entra, global-secure-access | — | Private network connector deployment and operation |
| Create a custom Data Loss Prevention profile with the Global Secure Access and Netskope integration | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Install the Global Secure Access Client for macOS | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| How to list remote networks for Global Secure Access | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| How to manage the Internet Access profile | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| How to Enable and Manage the Microsoft Profile | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Manage Private Access traffic forwarding profiles | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| How to add device links to remote networks | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| How to Update and Delete Remote Networks for Global Secure Access | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Use SSH to administer servers with Microsoft Entra Private Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Assign users and devices to traffic forwarding profiles | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Migrate web content filtering policies from V1 to V2 | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Operate Microsoft Entra Global Secure Access remote networks | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Private Access segmentation strategies for Global Secure Access | Microsoft Entra, global-secure-access | — | Private Access per-app segmentation; workbook names Private Access only as the Kerberos bridge |
| How to use the remote network health logs | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Simulate remote network connectivity using Azure VNG | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| How to access an Azure Storage account behind Azure Private Link using Microsoft Entra Private Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| How to access Azure SQL with a service endpoint using Microsoft Entra Private Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| How to use workbooks with Global Secure Access | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| View and Analyze Deployment Logs in Global Secure Access | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| How to use enriched Microsoft 365 logs | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| View Generative AI Insights logs in Global Secure Access (preview) | Microsoft Entra, global-secure-access | — | Controls for generative AI, MCP and agent traffic beyond shadow-AI discovery (Book 17 Ch07) |
| How to view Model Context Protocol (MCP) traffic logs in Global Secure Access (Preview) | Microsoft Entra, global-secure-access | — | Controls for generative AI, MCP and agent traffic beyond shadow-AI discovery (Book 17 Ch07) |
| Global Secure Access network traffic logs | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| Application Usage Analytics Overview | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| PowerShell samples for Global Secure Access | Microsoft Entra, global-secure-access | — | Global Secure Access PowerShell samples and FAQ |
| Quickstart: Install the Windows client to acquire Microsoft traffic | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Quickstart: Configure per-app access to private resources | Microsoft Entra, global-secure-access | — | Private Access per-app segmentation; workbook names Private Access only as the Kerberos bridge |
| Quickstart: Configure Quick Access to private resources | Microsoft Entra, global-secure-access | — | VPN and DirectAccess replacement with Private Access; central to remote-access retirement |
| Quickstart: Create a remote network, apply Conditional Access, and review the logs | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Global Secure Access change request template | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| Global Secure Access change communication plan template | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| Global Secure Access daily health check | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| Event enrichment in Microsoft 365 enriched logs | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| IP addresses advertised over BGP by remote network connectivity | Microsoft Entra, global-secure-access | — | Remote network (branch) connectivity to Global Secure Access; relevant to the SD-WAN and field-office chapters |
| Global Secure Access licensing for guest users | Microsoft Entra, global-secure-access | — | Global Secure Access for external users and guest licensing; partner identity chapter |
| Global Secure Access and Microsoft Defender for Cloud Apps coexistence | Microsoft Entra, global-secure-access | — | Coexistence with other SSE, VPN, DNS and EDR products; Book 09 Ch05 names the vendors but not the coexistence |
| Private Access health check checklist | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| Microsoft Global Secure Access built-in roles | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| Global Secure Access Threat intelligence threat types | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Global Secure Access Web content filtering categories | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Global Secure Access Frequently asked questions | Microsoft Entra, global-secure-access | — | Global Secure Access PowerShell samples and FAQ |
| PowerShell sample - Add Intune device compliance bypasses to Global Secure Access Internet Access | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Recover from Global Secure Access break glass scenario | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Disable traffic forwarding and disable Conditional Access policies using the compliant network condition in a break glass scenario | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Add a custom bypass rule to internet access forwarding profile | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - List Microsoft Entra Backup and Recovery snapshots for Global Secure Access recovery | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Get the auth token for registering your Microsoft Entra private network connector through Azure, AWS, or GCP Marketplaces | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Shared helper functions for Microsoft Entra Global Secure Access operations | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Run a Microsoft Entra recovery for Global Secure Access objects | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Preview a Microsoft Entra recovery for Global Secure Access objects | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Calculate the alert noise ratio for Microsoft Entra Global Secure Access detections | Microsoft Entra, global-secure-access | — | Global Secure Access logs, alerts and Sentinel integration; fits Book 12 Ch03 |
| PowerShell sample - Verify Microsoft Entra Global Secure Access configuration backup compliance | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell sample - Check Microsoft Entra Global Secure Access role assignment reviews | Microsoft Entra, global-secure-access | — | Global Secure Access operations (runbooks, health checks, roles, break-glass, backup and recovery scripts); fits Book 15 |
| PowerShell Sample - Install the Global Secure Access Windows Client as Proof of Concept | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot application access | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot problems installing the Microsoft Entra private network connector | Microsoft Entra, global-secure-access | — | Private network connector deployment and operation |
| Learn how to solve an issue where Global Secure Access fails with a Distributed File System | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the Global Secure Access Client for Windows: Advanced Diagnostics | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the Windows Global Secure Access client: Health check | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the Global Secure Access Client: Disabled by Your Organization | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the macOS Global Secure Access client: Health check | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot the Global Secure Access mobile client with Health check utility | Microsoft Entra, global-secure-access | — | Client deployment (Windows, mobile, macOS) and troubleshooting; Intune deployment candidate |
| Troubleshoot prompt injection protection | Microsoft Entra, global-secure-access | — | Controls for generative AI, MCP and agent traffic beyond shadow-AI discovery (Book 17 Ch07) |
| Tutorial: Discover applications and shadow IT | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Configure Content Policies | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Enable Internet Access Traffic Forwarding | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Tutorial: Get Started with Microsoft Entra Internet Access Labs | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Configure Threat Intelligence Policies | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Configure URL Filtering and Custom Block Pages | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Configure Web Content Filtering with the Baseline Profile | Microsoft Entra, global-secure-access | — | Internet Access policy (web filtering, threat intelligence, firewall, DLP) |
| Tutorial: Per-app access segmentation | Microsoft Entra, global-secure-access | — | Private Access per-app segmentation; workbook names Private Access only as the Kerberos bridge |
| Tutorial: Set up the Private Network Connector | Microsoft Entra, global-secure-access | — | Private network connector deployment and operation |
| Tutorial: Enable Private Access traffic forwarding | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Tutorial: Configure Intelligent Local Access | Microsoft Entra, global-secure-access | — | Private Access features (DNS, local access, sign-in frequency, PIM, Conditional Access, SSH) |
| Tutorial: Get started with Microsoft Entra Private Access labs | Microsoft Entra, global-secure-access | — | Traffic forwarding profile configuration |
| Microsoft Entra ID Governance integrations | Microsoft Entra, id-governance | — | Catalog of ID Governance application integrations; citation candidate for Book 15 Ch06 |
| Include access packages in catalog access reviews (preview) | Microsoft Entra, id-governance | — | Catalog access reviews; access review design in access governance. Learn pass Nov 9, 2026: Book 04 Ch09 doesn’t cover this task. |
| Catalog Access Reviews | Microsoft Entra, id-governance | — | Catalog access reviews; access review design in access governance. Learn pass Nov 9, 2026: Book 04 Ch09 doesn’t cover this task. |
| Include custom data provided resource in the catalog for catalog user Access Reviews | Microsoft Entra, id-governance | — | Custom-data resources in catalog access reviews (non-Entra resources) not covered |
| Create Custom Reports Using Application Data | Microsoft Entra, id-governance | — | Custom entitlement reporting with Azure Data Explorer; evidence-pipeline candidate for Book 04 Ch10 |
| Integrating Microsoft Entra Entitlement Management with Microsoft Teams using Custom Extensibility and Logic Apps | Microsoft Entra, id-governance | — | Teams creation via custom extension; low priority |
| Use entitlement management and Global Secure Access to restrict employee access to cloud apps | Microsoft Entra, id-governance | — | Entitlement management plus Private Access for governed network access; ties Book 04 Ch09 to Global Secure Access |
| Troubleshoot resource access denied in Privileged Identity Management | Microsoft Entra, id-governance | — | PIM resource access-denied troubleshooting; low priority |
| Configure custom extensions for PIM role activation (Preview) | Microsoft Entra, id-governance | — | Custom extensions on PIM activation (preview) |
| Reconciliation overview - Microsoft Entra ID Governance | Microsoft Entra, id-governance | — | Provisioning reconciliation; small addition to Book 03 Ch05 |
| Entra Suite Scenario: Using Entra Private Access with Entitlement Management | Microsoft Entra, id-governance | — | Entitlement management plus Private Access for governed network access; ties Book 04 Ch09 to Global Secure Access |
| Govern provisioning to on-premises LDAP based apps | Microsoft Entra, id-governance | — | Provisioning governed users to on-premises LDAP and SQL apps (ECMA host) |
| Govern on-premises users that are provisioned to Active Directory with Microsoft Identity Manager | Microsoft Entra, id-governance | — | Microsoft Identity Manager scenarios; MIM appears only as a legacy system |
| Govern cloud users that are provisioned from on-premises to Microsoft Entra ID with Microsoft Identity Manager | Microsoft Entra, id-governance | — | Microsoft Identity Manager scenarios; MIM appears only as a legacy system |
| Govern provisioning cloud users into on-premises SQL based applications using the ECMA Connector host | Microsoft Entra, id-governance | — | Provisioning governed users to on-premises LDAP and SQL apps (ECMA host) |
| Automatic formation of governance relationships | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Governance policy templates | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Use cross-tenant delegated administration | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Interpret tenant discovery data | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Monitor governing tenant admin activity in a governed tenant | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Set up a governance relationship | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Terminate a governance relationship | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Update a governance relationship | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Signals and metrics for tenant discovery | Microsoft Entra, id-governance | — | Tenant discovery and governance relationships (multi-tenant estate); only configuration management is covered |
| Sensitivity Labels in Lifecycle Workflows | Microsoft Entra, id-governance | — | Sensitivity labels as a Lifecycle Workflows scope or task; small addition to the lifecycle section |
| How to use Continuous Access Evaluation enabled APIs in your applications | Microsoft Entra, identity-platform | — | Continuous access evaluation and Conditional Access from the app side: Book 04 Ch03. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| App manifest (Azure AD Graph format) deprecation | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Claims challenges, claims requests and client capabilities | Microsoft Entra, identity-platform | — | Continuous access evaluation and Conditional Access from the app side: Book 04 Ch03. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Customize claims using Microsoft Graph Custom Claims Policy (preview) | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Claims customization using PowerShell and Claims Mapping Policy | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Configure token lifetime policies | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Developer guidance for Microsoft Entra Conditional Access authentication context | Microsoft Entra, identity-platform | — | Continuous access evaluation and Conditional Access from the app side: Book 04 Ch03. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Configure an app’s publisher domain | Microsoft Entra, identity-platform | — | Publisher verification feeds the consent policy (verified publisher as a consent condition); not mentioned in Book 04 Ch05 |
| Customize app JSON Web Token (JWT) claims | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Mark an app as publisher verified | Microsoft Entra, identity-platform | — | Publisher verification feeds the consent policy (verified publisher as a consent condition); not mentioned in Book 04 Ch05 |
| Support single sign-on and app protection policies in mobile apps you develop | Microsoft Entra, identity-platform | — | Device SSO (Apple SSO plug-in, shared device mode, WAM) is part of the Intune track but not walked through in the workbook |
| Migrate your JavaScript application from ADAL.js to MSAL.js | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Migrate your Node.js application from ADAL to MSAL | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Shared device mode overview | Microsoft Entra, identity-platform | — | Device SSO (Apple SSO plug-in, shared device mode, WAM) is part of the Intune track but not walked through in the workbook |
| Optional claims reference | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Updates and breaking changes | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Claims customization | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Retirement of service principal-less authentication | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| How the Microsoft identity platform uses the SAML protocol | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Code samples for authentication and authorization | Microsoft Entra, identity-platform | — | Government-cloud endpoints and clients: Book 19 Ch02 Reset Nov 9, 2026 (citation pass): chapter is about Graph SDK national-cloud snippets, not the MSAL sample catalogue. |
| Microsoft identity platform token exchange scenario with SAML and OIDC/OAuth in Microsoft Entra ID | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Directory extension attributes in claims | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Best practices to protect frontline workers | Microsoft Entra, identity-platform | — | Device SSO (Apple SSO plug-in, shared device mode, WAM) is part of the Intune track but not walked through in the workbook |
| Single sign-on SAML (Security Assertion Markup Language) protocol | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Azure Single Sign Out SAML Protocol | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Troubleshoot publisher verification | Microsoft Entra, identity-platform | — | Publisher verification feeds the consent policy (verified publisher as a consent condition); not mentioned in Book 04 Ch05 |
| Developer guidance for Microsoft Entra Conditional Access | Microsoft Entra, identity-platform | — | Continuous access evaluation and Conditional Access from the app side: Book 04 Ch03. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Exchange a SAML token issued by Active Directory Federation Services (AD FS) for a Microsoft Graph access token | Microsoft Entra, identity-platform | — | App-side migration and claims/SAML detail needed when moving AD FS and legacy apps (ADAL, AAD Graph, claims rules, token lifetimes); not in the workbook |
| Increase application security using Zero Trust principles | Microsoft Entra, identity-platform | — | Continuous access evaluation and Conditional Access from the app side: Book 04 Ch03. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Disable the SCIM Provisioning API in Microsoft Entra ID | Microsoft Entra, app-provisioning | — | SCIM provisioning to SaaS targets: Book 15 Ch06, HCM guide; building a SCIM endpoint is developer work. Learn pass Nov 9, 2026: inbound SCIM API (provisioning into Entra) isn’t covered by Book 15 Ch06, which is about outbound SaaS provisioning. Reset Nov 9, 2026 (citation pass): the HCM guide uses SCIM only as the /bulkUpload payload; no SCIM endpoint or Entra SCIM API. |
| Enable the SCIM Provisioning API in Microsoft Entra ID | Microsoft Entra, app-provisioning | — | SCIM provisioning to SaaS targets: Book 15 Ch06, HCM guide; building a SCIM endpoint is developer work. Learn pass Nov 9, 2026: inbound SCIM API (provisioning into Entra) isn’t covered by Book 15 Ch06, which is about outbound SaaS provisioning. Reset Nov 9, 2026 (citation pass): the HCM guide uses SCIM only as the /bulkUpload payload; no SCIM endpoint or Entra SCIM API. |
| Microsoft Entra ID SCIM API | Microsoft Entra, app-provisioning | — | SCIM provisioning to SaaS targets: Book 15 Ch06, HCM guide; building a SCIM endpoint is developer work. Learn pass Nov 9, 2026: inbound SCIM API (provisioning into Entra) isn’t covered by Book 15 Ch06, which is about outbound SaaS provisioning. Reset Nov 9, 2026 (citation pass): the HCM guide uses SCIM only as the /bulkUpload payload; no SCIM endpoint or Entra SCIM API. |
| Microsoft Entra ID SCIM API schema documentation | Microsoft Entra, app-provisioning | — | SCIM provisioning to SaaS targets: Book 15 Ch06, HCM guide; building a SCIM endpoint is developer work. Learn pass Nov 9, 2026: inbound SCIM API (provisioning into Entra) isn’t covered by Book 15 Ch06, which is about outbound SaaS provisioning. Reset Nov 9, 2026 (citation pass): the HCM guide uses SCIM only as the /bulkUpload payload; no SCIM endpoint or Entra SCIM API. |
| Microsoft Entra provisioning to LDAP directories for Linux authentication | Microsoft Entra, app-provisioning | — | On-premises provisioning (ECMA host, SQL, LDAP, SCIM, web services, PowerShell connectors) for legacy apps; not in the workbook |
| Preparing for Microsoft Entra provisioning to Active Directory Lightweight Directory Services | Microsoft Entra, app-provisioning | — | On-premises provisioning (ECMA host, SQL, LDAP, SCIM, web services, PowerShell connectors) for legacy apps; not in the workbook |
| Microsoft Entra provisioning into SAP ERP Central Component (SAP ECC, formerly SAP R/3) with NetWeaver AS ABAP 7.0 or later. | Microsoft Entra, app-provisioning | — | On-premises provisioning (ECMA host, SQL, LDAP, SCIM, web services, PowerShell connectors) for legacy apps; not in the workbook |
| Troubleshoot Microsoft Entra ID SCIM API errors | Microsoft Entra, app-provisioning | — | SCIM provisioning to SaaS targets: Book 15 Ch06, HCM guide; building a SCIM endpoint is developer work. Learn pass Nov 9, 2026: inbound SCIM API (provisioning into Entra) isn’t covered by Book 15 Ch06, which is about outbound SaaS provisioning. Reset Nov 9, 2026 (citation pass): the HCM guide uses SCIM only as the /bulkUpload payload; no SCIM endpoint or Entra SCIM API. |
| Microsoft Entra provisioning to SQL applications | Microsoft Entra, app-provisioning | — | On-premises provisioning (ECMA host, SQL, LDAP, SCIM, web services, PowerShell connectors) for legacy apps; not in the workbook |
| Use Microsoft Entra application proxy with a Network Device Enrollment Service (NDES) server | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Use Application Gateway WAF to protect your application | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Use Azure Front Door for geo-acceleration with Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Troubleshoot Kerberos constrained delegation | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Complex applications for Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Work with existing on-premises proxy servers and Microsoft Entra ID | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Application proxy cookie settings | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Custom home page for published apps using Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Claims-aware apps - Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Debug application proxy issues | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Broken links in an application | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Remove personal data - Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Security considerations for Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Resolve a ‘Corporate app can’t be accessed’ error | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Troubleshoot Application Proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Resolve cross-origin resource sharing issues | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| Wildcard applications in Microsoft Entra application proxy | Microsoft Entra, app-proxy | — | Microsoft Entra application proxy / private network connectors for on-premises web apps; relevant to retiring AD FS/WAP, not in the workbook (Book 04 Ch06 names only the admin roles) |
| PowerShell sample - Assign group to a Microsoft Entra application proxy app | Microsoft Entra, app-proxy | — | PowerShell inventory samples for App Proxy; App Proxy itself is not covered |
| PowerShell sample - Assign user to a Microsoft Entra application proxy app | Microsoft Entra, app-proxy | — | PowerShell inventory samples for App Proxy; App Proxy itself is not covered |
| PowerShell sample - Microsoft Entra application proxy apps with identical certs | Microsoft Entra, app-proxy | — | PowerShell inventory samples for App Proxy; App Proxy itself is not covered |
| PowerShell sample - Replace certificate in Microsoft Entra application proxy apps | Microsoft Entra, app-proxy | — | PowerShell inventory samples for App Proxy; App Proxy itself is not covered |
| PowerShell sample - Move Microsoft Entra application proxy apps to another group | Microsoft Entra, app-proxy | — | PowerShell inventory samples for App Proxy; App Proxy itself is not covered |
| Verified ID identity verification overview in Microsoft Entra ID | Microsoft Entra, authentication | — | Verified ID identity verification not covered. |
| Combined password policy and check for weak passwords in Microsoft Entra ID | Microsoft Entra, authentication | — | Entra Password Protection (cloud and on-premises DC agent, banned list) is not covered. |
| Estimate Cost Savings for Account Recovery in Microsoft Entra ID | Microsoft Entra, authentication | — | Entra account recovery with identity verification (Verified ID) not covered. |
| Perform Account Recovery in Microsoft Entra ID | Microsoft Entra, authentication | — | Entra account recovery with identity verification (Verified ID) not covered. |
| How to use the MFA Server Migration Utility to migrate to Microsoft Entra multifactor authentication | Microsoft Entra, authentication | — | MFA Server to Entra MFA migration not covered (product retired 2024). |
| Migrate to Microsoft Entra multifactor authentication with federations | Microsoft Entra, authentication | — | MFA Server to Entra MFA migration not covered (product retired 2024). |
| How to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory multifactor authentication (MFA) requirement for the Azure portal, Microsoft Entra admin center, or Microsoft Intune admin center | Microsoft Entra, authentication | — | Mandatory MFA enforcement for Azure and admin portals not covered. |
| Configure the Microsoft Entra multifactor authentication NPS extension | Microsoft Entra, authentication | — | Checked Nov 9: alternate login ID and IP exceptions are not described in Book 09 Ch07. |
| Password protection agent release history | Microsoft Entra, authentication | — | Entra Password Protection (cloud and on-premises DC agent, banned list) is not covered. |
| What are Microsoft Entra Conditional Access policy plans? (preview) | Microsoft Entra, conditional-access | — | Conditional Access policy plans (preview) not covered. |
| Continuous access evaluation for workload identities in Microsoft Entra ID | Microsoft Entra, conditional-access | — | Continuous access evaluation. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Create a Conditional Access policy plan (preview) | Microsoft Entra, conditional-access | — | Conditional Access policy plans (preview) not covered. |
| Migrate Conditional Access policies to a policy plan (preview) | Microsoft Entra, conditional-access | — | Conditional Access policy plans (preview) not covered. |
| Require MFA for device registration | Microsoft Entra, conditional-access | — | Policy template or example in the Conditional Access library. Learn pass Nov 9, 2026: the policy library has no matching policy. Learn pass Nov 9, 2026: the policy library has no matching policy. |
| Block unsupported platforms with Conditional Access | Microsoft Entra, conditional-access | — | Policy template or example in the Conditional Access library. Learn pass Nov 9, 2026: the policy library has no matching policy. Learn pass Nov 9, 2026: the policy library has no matching policy. |
| Require Terms of Use at sign-in to Microsoft Admin Portals | Microsoft Entra, conditional-access | — | Policy template or example in the Conditional Access library. Learn pass Nov 9, 2026: the policy library has no matching policy. Learn pass Nov 9, 2026: the policy library has no matching policy. |
| Conditional Access - Require app protection policy for Windows | Microsoft Entra, conditional-access | — | Policy template or example in the Conditional Access library. Learn pass Nov 9, 2026: the policy library has no matching policy. Learn pass Nov 9, 2026: the policy library has no matching policy. |
| Browser access guidance for third party mobile device management providers | Microsoft Entra, devices | — | Browser access for third-party mobile devices not covered. |
| Security update to remove support for KDFv1 algorithm for authentication | Microsoft Entra, devices | — | Token protection. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Enable Kerberos SSO to on-premises Active Directory and Microsoft Entra ID Kerberos Resources in Platform SSO | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Join a Mac device with Microsoft Entra ID and configure it for shared device scenarios | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Join a Mac device with Microsoft Entra ID during the out of box experience with macOS PSSO | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Join a Mac device with Microsoft Entra ID using Company Portal | Microsoft Entra, devices | — | Token protection. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Join Windows 11 Devices to Microsoft Entra ID During OOBE | Microsoft Entra, devices | — | Token protection. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Group Policy and MDM settings for ESR | Microsoft Entra, devices | — | Enterprise State Roaming not covered. |
| Troubleshoot Enterprise State Roaming in Microsoft Entra ID | Microsoft Entra, devices | — | Enterprise State Roaming not covered. |
| Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID | Microsoft Entra, devices | — | Entra sign-in to Azure Windows VMs not covered. |
| Add Your Work or School Account to a macOS Device | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Manage preferences for Microsoft Single Sign-on for macOS | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Architecture and authentication flow for macOS Platform SSO with Microsoft Entra ID | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Configuring macOS Platform SSO (PSSO) to meet NIST SP 800-63 and EO 14028 Requirements | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Integrate macOS Platform Single Sign-On (PSSO) into your MDM solution | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| macOS Platform Single Sign-on (PSSO) overview | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| TLS 1.2 enforcement - Microsoft Entra Registration Service | Microsoft Entra, devices | — | Token protection. Learn pass Nov 9, 2026: no sentence in Book 04 Ch03 says what this page says. |
| Admin Control for SSO prompts | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Microsoft single sign-on for Linux | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Troubleshoot Device Registration Command Tool on Linux | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Troubleshooting the Microsoft Enterprise SSO Extension plugin on Apple devices | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| macOS Platform single sign-on known issues and troubleshooting | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| What’s new in Microsoft single sign-on for Linux | Microsoft Entra, devices | — | macOS and Linux platform single sign-on and join not covered (books are Windows- and Intune-centered). |
| Create and manage custom attributes for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Domain Services custom attributes; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| Replica sets concepts for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Domain Services replica sets; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| Create a Microsoft Entra Domain Services forest trust using Azure PowerShell | Microsoft Learn | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Create an organizational unit (OU) in Microsoft Entra Domain Services | Microsoft Docs’ | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Microsoft Entra Domain Services feature availability in Azure Government | Microsoft Entra, domain-services | — | Domain Services availability in Azure Government; no workbook page states it (candidate for Book 02 Ch04 if the bridge is planned) |
| Restore group policy objects from backups in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Instructions for data retrieval from Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Domain Services data retrieval; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| Administer Group Policy in a Microsoft Entra Domain Services managed domain | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Network planning and connections for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Create and use password policies in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Domain Services password and lockout policies; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| Enable Microsoft Entra Domain Services using PowerShell | Microsoft Learn | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Scoped synchronization using PowerShell for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| RC4 deprecation advance dependency test in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Domain Services RC4 dependency test; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| How to migrate to Transport Layer Security (TLS) 1.2 enforcement for Microsoft Entra Domain Services | Microsoft Learn | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Scoped synchronization for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Secure remote VM access in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Secure Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| SAM Account Name | Microsoft Entra, domain-services | — | Domain Services SAM account names; Book 02 Ch04 treats Domain Services only as an LDAP/Kerberos bridge |
| Enable Azure DS Domain Services using a template | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Configure LDAPS for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Configure virtual networking for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Enable password hash sync for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Create a forest trust in Microsoft Entra Domain Services | Microsoft Learn | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Create a customized Microsoft Entra Domain Services managed domain | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Create a management VM for Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Create a replica set in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Tutorial - Perform a disaster recovery drill in Microsoft Entra Domain Services | Microsoft Docs | Microsoft Entra, domain-services | — | Entra Domain Services build and operation steps: the books treat it as a bridge and do not give deployment steps. |
| Configure sign-in auto-acceleration | Microsoft Entra, enterprise-apps | — | AD FS application (relying party) migration to Entra; workbook covers the AD FS authentication cutover (Book 02 Ch10) but not moving AD FS-secured applications |
| Tutorial to configure Datawiza to enable Microsoft Entra multifactor authentication and single sign-on to Oracle Hyperion EPM | Microsoft Entra, enterprise-apps | — | Secure hybrid access (header, Kerberos, LDAP SSO through partner gateways) for legacy on-premises apps; not in the workbook. Oracle/PeopleSoft/EBS recipes apply to the HR platform path |
| Configure Datawiza Access Proxy for Microsoft Entra SSO and MFA for Outlook Web Access | Microsoft Entra, enterprise-apps | — | Secure hybrid access (header, Kerberos, LDAP SSO through partner gateways) for legacy on-premises apps; not in the workbook. Oracle/PeopleSoft/EBS recipes apply to the HR platform path |
| Configure F5 BIG-IP Easy Button for SSO to SAP ERP | Microsoft Entra, enterprise-apps | — | Secure hybrid access (header, Kerberos, LDAP SSO through partner gateways) for legacy on-premises apps; not in the workbook. Oracle/PeopleSoft/EBS recipes apply to the HR platform path |
| Configure F5 BIG-IP SSL-VPN solution in Microsoft Entra ID | Microsoft Entra, enterprise-apps | — | Secure hybrid access (header, Kerberos, LDAP SSO through partner gateways) for legacy on-premises apps; not in the workbook. Oracle/PeopleSoft/EBS recipes apply to the HR platform path |
| Home Realm Discovery Policy for an Application | Microsoft Entra, enterprise-apps | — | AD FS application (relying party) migration to Entra; workbook covers the AD FS authentication cutover (Book 02 Ch10) but not moving AD FS-secured applications |
| Phase 4: Plan management and insights | Microsoft Entra, enterprise-apps | — | AD FS application (relying party) migration to Entra; workbook covers the AD FS authentication cutover (Book 02 Ch10) but not moving AD FS-secured applications |
| Resources for migrating apps to Microsoft Entra ID | Microsoft Entra, enterprise-apps | — | AD FS application (relying party) migration to Entra; workbook covers the AD FS authentication cutover (Book 02 Ch10) but not moving AD FS-secured applications |
| Disable auto-acceleration sign-in | Microsoft Entra, enterprise-apps | — | AD FS application (relying party) migration to Entra; workbook covers the AD FS authentication cutover (Book 02 Ch10) but not moving AD FS-secured applications |
| Install Microsoft Entra Connect by using an existing ADSync database | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect Sync: Get started by using express settings | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect: Select your installation type | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Re-running the Microsoft Entra Connect install wizard | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect: Next steps and how to manage Microsoft Entra Connect | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect - Pass-through Authentication - Upgrade auth agents | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover upgrading preview PTA agents. |
| User Privacy and Microsoft Entra pass-through authentication | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover PTA user privacy or log data. |
| User Privacy and Microsoft Entra seamless single sign-on | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover Seamless SSO user privacy or log data. |
| Microsoft Entra Connect: Configure preferred data location for Microsoft 365 resources | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover preferred data location. |
| Factors influencing the performance of Microsoft Entra Connect | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect: ADSyncTools PowerShell Reference | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra pass-through authentication: Version release history | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t track PTA agent versions. |
| Troubleshoot Microsoft Entra Connect install issues’ | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| Microsoft Entra Connect - LargeObject errors caused by userCertificate attribute | Microsoft Entra, hybrid | Book 02, Chapter 09 — Building the Entra ID Target | Chapter 09 doesn’t cover userCertificate LargeObject errors. |
| Microsoft Entra Connect: Troubleshoot SQL connectivity issues | Microsoft Entra, hybrid | — | Connect Sync operation (install, upgrade, database, accounts, PowerShell references, troubleshooting) not covered step by step. |
| How to clean up unused Active Directory Domain Services (AD DS) groups in a single domain | Microsoft Entra, hybrid | — | AD group cleanup (scream test); Book 02 Ch04 covers group SOA conversion, not group cleanup |
| How to audit and monitor Group Source of Authority (SOA) in Microsoft Entra ID | Microsoft Entra, hybrid | — | Auditing group SOA changes; Book 02 Ch04 covers the conversion, not its audit events |
| Set up self-service group management after Group SOA conversion | Microsoft Entra, hybrid | — | Self-service group management after SOA conversion; not in Book 02 Ch04 |
| Configure Isolation Scope For User Assigned Managed Identities | Microsoft Entra, managed-identities-azure-resources | — | Isolation scope and assignment restriction for user-assigned identities: controls for sharing managed identities across subscriptions; not in Book 04 Ch05 or the NPI path |
| How to configure Health notifications (preview) | Microsoft Entra, monitoring-health | — | Entra Health monitoring scenarios and alerts (preview) not covered. |
| How to configure Microsoft Entra recommendation emails | Microsoft Entra, monitoring-health | — | Entra Health monitoring scenarios and alerts (preview) not covered. |
| How to investigate the internet applications blocked by Entra Internet Access policy | Microsoft Entra, monitoring-health | — | Entra Health monitoring scenarios and alerts (preview) not covered. |
| How to investigate private application access requiring Microsoft Entra Private Access connector | Microsoft Entra, monitoring-health | — | Entra Health monitoring scenarios and alerts (preview) not covered. |
| How to investigate the Global Secure Access remote network connectivity | Microsoft Entra, monitoring-health | — | Entra Health monitoring scenarios and alerts (preview) not covered. |
| Recommendation to minimize MFA prompts from known devices | Microsoft Entra, monitoring-health | — | MFA recommendations. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss MFA prompt frequency from known devices. |
| Turn off per user MFA in Microsoft Entra ID | Microsoft Entra, monitoring-health | — | MFA recommendations. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss per-user MFA. |
| Multitenant organization identity provisioning for Microsoft 365 | Microsoft Entra, multi-tenant-organizations | — | Multitenant organization (MTO) as a construct for agencies with several tenants; workbook covers cross-tenant sync and access settings only |
| Multitenant organization capabilities in Microsoft Entra ID | Microsoft Entra, multi-tenant-organizations | — | Multitenant organization (MTO) as a construct for agencies with several tenants; workbook covers cross-tenant sync and access settings only |
| Clean up unmanaged Microsoft Entra accounts | Microsoft Entra, users | — | Custom domains and unmanaged accounts/self-service sign-up posture. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss unmanaged (viral) accounts. |
| Convert external users to internal users | Microsoft Entra, users | — | Converting external users to internal not covered. |
| Delegated administration in Microsoft Entra ID | Microsoft Entra, users | — | Page covers Cloud Solution Provider partner relationships (DAP and GDAP), which the workbook doesn’t discuss; Book 02 Ch05 covers in-tenant delegation with administrative units, not partner delegation. |
| Admin takeover of an unmanaged directory | Microsoft Entra, users | — | Custom domains and unmanaged accounts/self-service sign-up posture. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss taking over unmanaged directories. |
| Change subdomain authentication type using PowerShell and Graph | Microsoft Entra, users | — | Custom domains and unmanaged accounts/self-service sign-up posture. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss subdomain authentication types. |
| Change Static Groups to Dynamic Membership Groups | Microsoft Entra, users | — | Dynamic groups and dynamic rules as code. Reset Nov 9, 2026 (citation pass): module never converts static groups to dynamic. |
| Group expiration policy quickstart | Microsoft Entra, users | — | Group naming, expiration, self-service management and restore not covered. |
| Group naming policy quickstart | Microsoft Entra, users | — | Group naming, expiration, self-service management and restore not covered. |
| Set up self-service group management | Microsoft Entra, users | — | Group naming, expiration, self-service management and restore not covered. |
| Characteristics of multitenant interaction | Microsoft Entra, users | — | Group-based licensing; licensing owner is unnamed in the workbook. |
| PowerShell examples for group-based licensing | Microsoft Entra, users | — | Group-based licensing; licensing owner is unnamed in the workbook. |
| Close a work or school account in an unmanaged Microsoft Entra organization | Microsoft Entra, users | — | Custom domains and unmanaged accounts/self-service sign-up posture. Learn pass Nov 9, 2026: Book 02 Ch10 doesn’t discuss unmanaged organizations. |
| Configure CMMC Level 1 controls | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure CMMC Level 2 Access Control (AC) controls | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure identity access controls to meet CMMC Level 2 | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure CMMC Level 2 Identification and Authentication (IA) controls | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure Microsoft Entra ID for CMMC compliance | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure Microsoft Entra HIPAA access control safeguards | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure Microsoft Entra HIPAA audit control safeguards | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure Microsoft Entra ID for HIPAA compliance | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Microsoft Entra configuration recommendations for HITRUST controls | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Configure Microsoft Entra HIPAA additional safeguards | Microsoft Entra, standards | — | Framework named in the federal framework crosswalk; control-level Entra mapping is left to Learn. Reset Nov 9, 2026 (citation pass): crosswalk only names the framework; no configuration content. |
| Customize your Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Introduction to Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Link your domain to your decentralized identifier (DID) - Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Revoke a verifiable credential as an issuer - Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Opt out of Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Rotate signing keys | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Tutorial - Issue a Microsoft Entra Verified ID credential for directory-based claims | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Use the Microsoft Entra Verified ID Network | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Microsoft Entra Verified ID - IDV partner gallery | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Microsoft Entra Verified ID architecture overview | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Plan your Microsoft Entra Verified ID issuance solution | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Plan your Microsoft Entra Verified ID verification solution | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Onboard new remote employees using ID verification | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Service Partner gallery for Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Upgrade signing keys | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Tutorial - Set up and use Microsoft Authenticator with VerifiedID | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Tutorial - Use Face Check with Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Tutorial - Issue Microsoft Entra Verified ID credentials from an application | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Tutorial - Quick setup of your tenant for Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Tutorial - Advanced Microsoft Entra Verified ID setup | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Tutorial - Configure Microsoft Entra Verified ID verifier | Microsoft Entra, verified-id | — | Verified ID tenant setup and credential operations; only needed if the program adopts Verified ID |
| Frequently asked questions - Microsoft Entra Verified ID | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |
| Microsoft Entra Verified ID-supported standards | Microsoft Entra, verified-id | — | Verified ID for identity proofing and remote onboarding; workbook cites only the verified help desk pattern (Book 15 Ch03); check government-cloud availability |