{
  "_comment": "A fictional production environment for contoso.example (Chapter 11). Names and IDs only, never a credential: the deployment and reader identities sign in with a certificate whose private key stays in the operator's certificate store. The same runbook commands run against this file and its test twin; only the file changes.",
  "environment": "production",
  "cloud": "gcc",
  "tenantId": "c0ffee00-0000-4000-8000-0000000000f1",
  "initialDomain": "contosoexample.onmicrosoft.com",
  "changeRecord": "CHG-2026-1116-P",
  "deployIdentity": {
    "clientId": "d0000000-0000-4000-8000-0000000000f1",
    "credential": "certificate",
    "certificateThumbprint": "B1B2C3D4E5F60718293A4B5C6D7E8F9012345678",
    "certificatePemPath": "C:/certs/npi-deploy-prod.pem",
    "federatedIssuer": "",
    "federatedSubject": ""
  },
  "readerIdentity": {
    "clientId": "d0000000-0000-4000-8000-0000000000f2",
    "certificateThumbprint": "D1B2C3D4E5F60718293A4B5C6D7E8F9012345678"
  },
  "operators": [
    {
      "name": "Identity engineer",
      "upn": "idm-engineer@contoso.example",
      "objectId": "0b000000-0000-4000-8000-0000000000f1",
      "roles": [
        "Cloud Application Administrator",
        "Security Administrator"
      ],
      "steps": [
        "app management policy",
        "federated credentials",
        "smoke test"
      ]
    },
    {
      "name": "Conditional Access administrator",
      "upn": "ca-admin@contoso.example",
      "objectId": "0b000000-0000-4000-8000-0000000000f2",
      "roles": [
        "Conditional Access Administrator"
      ],
      "steps": [
        "workload Conditional Access",
        "rollback"
      ]
    }
  ],
  "azure": {
    "environment": "AzureCloud",
    "subscriptionId": "dd000000-0000-4000-8000-0000000000f1",
    "resourceGroup": "rg-npi-prod",
    "location": "eastus2"
  },
  "ad": {
    "domain": "corp.contoso.example",
    "server": "dc01.corp.contoso.example",
    "gmsaName": "gmsa-hrsync",
    "gmsaTestHost": "APP-PRD-01",
    "gmsaRetrieverGroup": "gg-gmsa-hrsync-hosts",
    "gmsaService": "HRSyncSvc",
    "kerberosInputs": "inputs/kerberos-prod"
  },
  "pilot": {
    "name": "Payroll Export",
    "ownerUpn": "payroll.owner@contoso.example",
    "appObjectId": "0a000000-0000-4000-8000-0000000000f3",
    "appClientId": "1a000000-0000-4000-8000-0000000000f3",
    "spObjectId": "5b000000-0000-4000-8000-0000000000f3",
    "managedIdentityName": "id-payroll-export",
    "repository": "contoso-example/payroll-export",
    "federatedIssuer": "https://token.actions.githubusercontent.com",
    "federatedSubject": "repo:contoso-example/payroll-export:environment:production",
    "conversionsPath": "inputs/conversions-prod.json",
    "cutoverLogPath": "inputs/cutover-prod.csv",
    "legacyAdAccounts": [
      "svc-payexport"
    ]
  },
  "smoke": {
    "appObjectId": "0a000000-0000-4000-8000-0000000000f4",
    "appClientId": "1a000000-0000-4000-8000-0000000000f4",
    "spObjectId": "5b000000-0000-4000-8000-0000000000f4",
    "adAccount": "svc-npi-smoke",
    "repository": "contoso-example/npi-smoke",
    "federatedIssuer": "https://token.actions.githubusercontent.com",
    "federatedSubject": "repo:contoso-example/npi-smoke:environment:production"
  },
  "appManagementPolicy": {
    "configPath": "inputs/app-management-policy-prod.json",
    "pilotPolicyId": "a9000000-0000-4000-8000-0000000000f1",
    "pilotPolicyName": "npi-pilot-block-secrets"
  },
  "conditionalAccess": {
    "scopePath": "inputs/wca-scope-prod.json",
    "policies": [
      {
        "id": "ca000000-0000-4000-8000-0000000f0015",
        "name": "CA015-ServiceAccounts-LocationRestriction-Ring1",
        "ring": "Ring1"
      },
      {
        "id": "ca000000-0000-4000-8000-0000000f0037",
        "name": "CA037-WorkloadIdentities-HighRisk-Block-Ring1",
        "ring": "Ring1"
      }
    ]
  },
  "rings": [
    {
      "name": "Ring1",
      "servicePrincipals": [
        "5b000000-0000-4000-8000-0000000000f3",
        "5b000000-0000-4000-8000-0000000000f4"
      ]
    },
    {
      "name": "Ring2",
      "servicePrincipals": [
        "5b000000-0000-4000-8000-0000000000f5"
      ]
    }
  ],
  "inputs": {
    "ownership": "inputs/ownership-prod",
    "pipelineIdentities": "inputs/pipeline-identities-prod.csv"
  },
  "outputRoot": "out/deploy-prod"
}
