This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Training

Labs

Every hands-on lab in the workbook: what it needs, where it runs, and a direct link

Every developer workbook lab and learning path exercise in one place. Lab 1 runs on the kit’s fixtures on a laptop, with no tenant; Lab 2 repeats it in a non-production tenant, instance or subscription. Each row links straight to the lab, with what it needs and the training module that uses it.

Every developer workbook chapter except the deployment runbooks ends with two labs, and every learning path module has an exercise built on them. The runbooks are not gates, so they have no labs of their own; three learning path modules still carry exercises for them: Non-Person Identity, Module 11, Attribute-Driven Migration, Module 9 and Provider Notices, Module 9.

• Lab 1: fixtures, no tenant. It runs on a laptop against the kit’s fictional fixtures. Nothing signs in, and nothing leaves the machine. Where a chapter shows a terminal image after a command, that image is the kit’s real output on those fixtures.
• Lab 2. It repeats the chapter in a non-production tenant, instance or subscription, never production. The authors haven’t run the Lab 2s; each says so, and says how to back out what it built.

Every lab opens with the list of every command it runs, in order: follow it top to bottom. commands in the tables below links straight to that list. Start with Lab 1. Each workbook’s code downloads as one zip from its section below, or from Downloads.

Building Ticket-to-Machine

The workbook · its implementation guide · its learning path · the code: ticket-to-machine-code.zip

Building Ticket-to-Machine: labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 The Loop and the Typed Task	Lab 1 · commands	Python 3.10 or later with pytest and requests, and Node	a ServiceNow developer instance · commands	Module 1
02 The ServiceNow Client and Least Privilege	Lab 1 · commands	Python 3.10 or later, pytest and requests	a ServiceNow developer instance · commands	Module 2
03 The SailPoint Client and Its Scopes	Lab 1 · commands	Python 3.10 or later, pytest and requests	a SailPoint sandbox tenant · commands	Module 2
04 Drift to a Typed Task	Lab 1 · commands	Python 3.10 or later and Node	a SailPoint sandbox and a ServiceNow developer instance · commands	Module 5
05 The Re-read Rule	Lab 1 · commands	Python 3.10 or later and Node	a ServiceNow developer instance · commands	Module 6
06 Drift Reconciliation	Lab 1 · commands	Python 3.10 or later, pytest and requests	a test tenant and a SailPoint sandbox · commands	Module 4
07 Evidence Records for Book 13 and the ISSO	Lab 1 · commands	Python 3.10 or later and pytest	a ServiceNow developer instance · commands	Module 7
08 One Writer per Attribute	Lab 1 · commands	Python 3.10 or later and pytest	exports from a test tenant and a SailPoint sandbox · commands	Module 3

Building HR-Driven Identity

The workbook · its implementation guide · its learning path · the code: hr-driven-identity-code.zip

Building HR-Driven Identity: labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 The Writer Register as Code	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 1
02 Contractor Sources and Enforced End Dates	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 2
03 Joiner Workflows as Code and the Temporary Access Pass Bridge	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 3
04 Access from Attributes and the Mover’s Residual Review	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 4
05 Certificate-Based Authentication Checks	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 5
06 Separation Timing from the Logs	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 6
07 Lifecycle Drift, Metrics and Evidence	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 7

Building the Attribute-Driven Migration (Book 19)

The workbook · its implementation guide · its learning path · the code: attribute-driven-migration-code.zip

Building the Attribute-Driven Migration (Book 19): labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 The HR-to-Entra Middleware	Lab 1 · commands	PowerShell 7 with Pester 5 (and Python 3.10 or later for the Python client)	test tenant · commands	Module 1
02 Graph Clients for the Government Clouds	Lab 1 · commands	Python 3.10 or later with pytest, and PowerShell 7.5 or later with Pester 5	test tenant · commands	Microsoft Automation, Module 1
03 Writing a Validation Kit Check	Lab 1 · commands	PowerShell 7 and Pester 5.5 or later	test tenant · commands	Module 2
04 Dynamic Rules as Code	Lab 1 · commands	PowerShell 7.1 or later and Pester 5	test tenant · commands	Module 3
05 Lifecycle Workflows Custom Extensions	Lab 1 · commands	Python 3.10 or later	test tenant · commands	Module 7
06 Moving Group Policy as Code	Lab 1 · commands	PowerShell 7.1 or later and Pester 5	test tenant · commands	Module 4
07 Machine Configuration Packages	Lab 1 · commands	Windows with PowerShell 7.1 or later and Pester 5	test subscription and a disposable server · commands	Module 5
08 Ansible Beside Arc	Lab 1 · commands	a Linux control node, or WSL, with Python 3.10 or later, ansible-core, ansible-lint, yamllint and pytest	test subscription and a disposable server · commands	Module 6
09 Drift Pipelines and Evidence to the ISSO	Lab 1 · commands	Python 3.10 or later with PyYAML and pytest, and a shell with sha256sum (Linux, macOS or Git Bash)	test tenant and test subscription · commands	Module 8

Building Privileged Access

The workbook · its implementation guide · its learning path · the code: privileged-access-code.zip

Building Privileged Access: labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 Privileged Inventory as Code	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 1
02 Emergency Access Accounts as Code	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 2
03 Conditional Access for Administrators and the Activation Gate	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 3
04 PIM for Microsoft Entra Roles as Code	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 4
05 PIM for Groups and the PRV Groups	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 5
06 PIM for Azure Resources	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 6
07 Access Reviews of Privileged Roles	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 7
08 Evidence and Drift for the ISSO	Lab 1 · commands	PowerShell 7.1 or later with Pester 5, Python 3.10 or later with pytest and PyYAML, and a shell with sha256sum (Linux, macOS or Git Bash)	test tenant · commands	Module 8

Building Non-Person Identity

The workbook · its implementation guide · its learning path · the code: non-person-identity-code.zip

Building Non-Person Identity: labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 Non-Person Identity Inventory as Code	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 1
02 Ownership and the Orphan Rule	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 2
03 The Migration Path Matrix as Code	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 3
04 App Management Policies and Certificate Rotation	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 4
05 Workload Identity Federation and Managed Identities	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 7, Module 12
06 gMSAs, dMSAs and the Kerberos Island	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test domain · commands	Module 8, Module 12
07 Least Privilege for Service Principals	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 5
08 Conditional Access for Workload Identities	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 6
09 AI Agent Identities	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	test tenant · commands	Module 9
10 Drift and Evidence for the ISSO	Lab 1 · commands	PowerShell 7.1 or later with Pester 5, Python 3.10 or later with pytest and PyYAML, and a shell with sha256sum (Linux, macOS or Git Bash)	test tenant · commands	Module 10

Building Provider Notices

The workbook · its implementation guide · its learning path · the code: provider-notices-code.zip

Building Provider Notices: labs by chapter

Chapter	Lab 1, no tenant	You need	Lab 2 runs in	Module
01 The Notice Record and Azure Service Health	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test subscription · commands	Module 1, Module 2
02 Microsoft 365 Message Center and Service Health	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test tenant · commands	Module 3
03 Oracle Cloud Infrastructure Announcements	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test tenancy · commands	Module 4
04 AWS Health	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test account · commands	Module 5
05 Google Cloud Personalized Service Health	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test project · commands	Module 6
06 Routing to Owners and Ticket-to-Machine Tasks	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a ServiceNow developer instance · commands	Module 7
07 The Weekly Digest and Evidence	Lab 1 · commands	PowerShell 7.1 or later with Pester 5	a test environment’s runs · commands	Module 8

Microsoft Automation learning path

The learning path · the code: microsoft-automation-code.zip

Microsoft Automation: labs by module

Module	Lab 1, no tenant	Lab 2
Module 1: Graph and Azure Foundations	Lab 1	Lab 2
Module 2: Microsoft Entra ID through Microsoft Graph	Lab 1	Lab 2
Module 3: Intune through Microsoft Graph	Lab 1	Lab 2
Module 4: Azure Arc through Azure Resource Manager and Resource Graph	Lab 1	Lab 2

The Zero Trust Assessment learning path

The learning path · its implementation guide · the code: zta-results.zip

The Zero Trust Assessment: labs by module

Module	Lab 1, no tenant	Lab 2
Module 1: Evidence, not a verdict	Lab 1	—
Module 2: Running the assessment safely	—	Lab 2
Module 3: From results to a closure register	Lab 1	Lab 2
Module 4: Reconcile, re-run and keep the evidence	Lab 1	Lab 2

What Lab 2 needs

Each Lab 2 names its environment and its prerequisites in its first paragraph. Use synthetic data like the kit’s fixtures, and never production:

• A Microsoft Entra test tenant, in the worldwide or GCC cloud for learning, with the licenses the lab names; then rehearse in the agency’s own cloud, as Book 16’s two-step lab path describes. Some labs add an Azure test subscription or a disposable server.
• A ServiceNow Personal Developer Instance, free to members of ServiceNow’s Developer Program, or a sub-production instance. Chapter 01 of Building Ticket-to-Machine says how its instance is reset.
• A SailPoint Identity Security Cloud sandbox tenant, the agency’s own.