This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Training module · Draft

Learning path: HR-Driven Identity in Microsoft Entra ID

Seven modules, one per gate of the HR-driven identity implementation guide, each with a lab on fixtures and a lab in your own test tenant

A learning path in seven modules for identity engineers, developers, HR systems analysts and ISSO reviewers: name one writer for every account state, run contractors from their own source, make joiners ready on day one, assign access from HR attributes and review what a move leaves, check certificate-based authentication, time separations, and find lifecycle drift and file the evidence. Each module links the guide’s gate, the developer workbook’s chapter and Book 03, runs the chapter’s Lab 1 with no tenant, points to Lab 2 for a test tenant, and ends with a knowledge check.

Status — Draft

This page is still being written. Expect gaps and changes; it is not part of the workbook's production guidance. Last reviewed 2026-11-08.

The HR pipeline makes an account exist. This learning path teaches what happens to that account afterward: how the HR record decides every change, and how you prove that it did. You work through the seven gates of HR-Driven Identity: An Implementation Guide in order. In each module you run the tested code from the developer workbook Building HR-Driven Identity on your laptop, then read what the same step takes in a test tenant.

Like a Microsoft Learn learning path, it is a short series of modules, each built on the one before. The modules don’t repeat the guide, the workbook or Book 03. They tell you what to read, in what order, what to run, and what to check you understood.

Who this path is for

Role	What you get from the path
Identity engineer	The order of work in the tenant for each gate, and the checks that prove it
Developer	The code in examples/hr-lifecycle: what each tool reads, the rules it applies and the output it writes
HR systems analyst	Which HR and contractor facts drive each account change, and what goes wrong when they arrive late or wrong
ISSO reviewer	The federal requirements each gate supports, and the evidence you keep for them

Level: intermediate. Product: Microsoft Entra ID, with Microsoft Entra ID Governance. Scope: a civilian agency at FedRAMP Moderate, in Microsoft 365 GCC with commercial Azure, as the workbook assumes.

Prerequisites

• Book 03, HR-Driven Identity: at least its overview. The modules link its chapters for the design; you don’t need to read the whole book first.
• Microsoft Automation, Module 1: Graph and Azure Foundations: the clouds and endpoints, signing in from a script, permissions and paging.
• Microsoft Automation, Module 2: Microsoft Entra ID through Microsoft Graph: reading users, groups, Conditional Access and logs through Graph.
• Python basics: you can run a script from a shell and read JSON. If you’re new to Python, start with the Python tutorial.
• The guide’s path on one page: five minutes, and every module refers back to it.

What you’ll be able to do

When you finish the path, you’ll be able to:

• name one writer for every account-state transition and HR-mastered value, and find writes by anyone else in the audit log;
• compute each contractor’s earliest end and reconcile the contractor register, the card system and the directory without changing anything;
• keep Lifecycle Workflows definitions as reviewed code, plan each change as a new workflow or a new version, and measure day-one readiness;
• lint access package assignment policies before they reach the tenant, and list what a move leaves behind for review;
• check the certificate-based authentication trust store and each CRL against your cloud’s limits;
• measure separation-to-block and separation-to-revocation for every leaver;
• turn the lifecycle drift classes and the six metrics into a hash-chained evidence package an ISSO can verify.

Modules

Work through them in order. Module 7 reads what Modules 1, 2, 3, 4 and 6 produce.

The modules of the HR-Driven Identity learning path

#	Module	Gate	Workbook chapter	Time
1	Name one writer for every account state	G1 Writers	01	50 min
2	Run contractors from their own source	G2 Sources	02	50 min
3	Make joiners ready on day one	G3 Joiners	03	50 min
4	Assign access from attributes and review what a move leaves	G4 Access and movers	04	50 min
5	Check certificate-based authentication	G5 Credentials	05	50 min
6	Time separations from the logs	G6 Separation	06	50 min
7	Find lifecycle drift and file the evidence	G7 Drift and evidence	07	60 min

Total time: about 6 hours, with each module’s Lab 1. Lab 2, in your own test tenant, isn’t counted: how long it takes depends on your tenant and your approvals.

Each module follows the same units: an introduction with the federal requirements it supports, learning objectives, prerequisites, one to three concept units, Lab 1, Lab 2, a knowledge check and a summary.

What you need for the labs

Lab 1: a laptop, no tenant. Every module’s Lab 1 runs the code in examples/hr-lifecycle against fictional fixtures. Its README asks for Python 3.10 or later and the standard library; the step that runs the tests also needs pytest. Clone the repository, and work in examples/hr-lifecycle. Module 2 also calls examples/hcm-entra, and Module 7 calls examples/drift-pipeline, both from the same clone. The commands are written for a bash shell, as in the workbook. Nothing in Lab 1 signs in to anything or sends a request.

Lab 2: your own test tenant. Lab 2 needs a Microsoft Entra test tenant in the worldwide or GCC cloud for learning, never production (before a gate passes, rehearse once in your agency’s own cloud, as Book 16 describes), and Microsoft Entra ID Governance trial or test licenses for the modules that use Lifecycle Workflows, entitlement management or access reviews. Module 5 also needs certificate-based authentication configured for a test CA. The workbook has no hosted sandbox: you bring the tenant. The authors didn’t run the Lab 2 steps. They are written from Microsoft Learn’s procedures, and each one ends with a way to back it out. Read the guide’s prerequisites for the licenses and roles before you start.

How this path fits with the other pieces

The guide is finished when it has four pieces: the guide, a narrated deck series, a developer workbook and a training path. This path is the training piece. The guide’s two-part narrated deck series is published, and each module links its own narrated deck and video.

Where each piece of HR-driven identity lives

Piece	Where
The design	Book 03
The gates	HR-Driven Identity: An Implementation Guide
The code and its labs	Building HR-Driven Identity, on Book 19
The gate-level narrated decks	Two-part deck series
The schedule	Identity Lifecycle & Provisioning plan
The federal sources	Federal framework crosswalk

Modules in this path

---

Original content for project use. Every fact is carried by link from the guide, the workbook and the books; the claims log is in the repository.