{
  "planVersion": 1,
  "task": "orphan-apply",
  "generated": "2026-10-29T06:00:00.0000000Z",
  "asOf": "2026-10-29",
  "cloud": "gcc",
  "tenantId": "c0ffee00-0000-4000-8000-000000000001",
  "registerSha256": "44b2c80e2edd56a9d1c2b053089abddd19da9efb618c86bd07339fc62b3e6c35",
  "claimWindowDays": 30,
  "actions": [
    {
      "ActionId": "Disable:ad:ad000000-0000-4000-8000-000000000003",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000003",
      "Name": "svc-backup",
      "Type": "Traditional",
      "Action": "Disable",
      "Write": true,
      "Call": "ad-disable-account",
      "Method": "WRITE",
      "Target": "Disable-ADAccount -Identity ad000000-0000-4000-8000-000000000003",
      "Body": null,
      "Precheck": "ad-recheck-user: still enabled",
      "ConfirmedBy": "igo@contoso.example",
      "ConfirmedOn": "2026-10-28",
      "ClaimWindowEnds": "30 days after the disable is applied",
      "Reason": "Confirmed orphan: disable, never delete"
    },
    {
      "ActionId": "AwaitConfirmation:ad:ad000000-0000-4000-8000-000000000004",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000004",
      "Name": "svc-oldftp",
      "Type": "Traditional",
      "Action": "AwaitConfirmation",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "",
      "ConfirmedOn": "",
      "ClaimWindowEnds": "",
      "Reason": "The identity governance officer confirms the finding before anything is disabled"
    },
    {
      "ActionId": "RetirementCandidate:ad:ad000000-0000-4000-8000-000000000005",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000005",
      "Name": "svc-reports",
      "Type": "Traditional",
      "Action": "RetirementCandidate",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "igo@contoso.example",
      "ConfirmedOn": "2026-09-10",
      "ClaimWindowEnds": "2026-10-12",
      "Reason": "The claim window closed with no claim: retire through the reviewed decommission process. This code never deletes."
    },
    {
      "ActionId": "ClaimWindowOpen:ad:ad000000-0000-4000-8000-000000000006",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000006",
      "Name": "sa-printsvc",
      "Type": "Traditional",
      "Action": "ClaimWindowOpen",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "igo@contoso.example",
      "ConfirmedOn": "2026-10-15",
      "ClaimWindowEnds": "2026-11-15",
      "Reason": "Disabled; the office has until 2026-11-15 to name an owner or retire it"
    },
    {
      "ActionId": "Exception:ad:ad000000-0000-4000-8000-000000000024",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000024",
      "Name": "gmsa-ops$",
      "Type": "gMSA",
      "Action": "Exception",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "igo@contoso.example",
      "ConfirmedOn": "2026-10-20",
      "ClaimWindowEnds": "",
      "Reason": "Dated exception until 2026-12-31"
    },
    {
      "ActionId": "Disable:app:1a000000-0000-4000-8000-000000000003",
      "IdentityId": "app:1a000000-0000-4000-8000-000000000003",
      "Name": "Legacy Reports",
      "Type": "AppRegistration",
      "Action": "Disable",
      "Write": true,
      "Call": "graph-sp-disable",
      "Method": "PATCH",
      "Target": "https://graph.microsoft.com/v1.0/servicePrincipals/5b000000-0000-4000-8000-000000000003",
      "Body": {
        "accountEnabled": false
      },
      "Precheck": "graph-application-owners 0a000000-0000-4000-8000-000000000003: still no owner",
      "ConfirmedBy": "igo@contoso.example",
      "ConfirmedOn": "2026-10-27",
      "ClaimWindowEnds": "30 days after the disable is applied",
      "Reason": "Confirmed orphan: sign-in disabled in this tenant (accountEnabled false), never deleted"
    },
    {
      "ActionId": "AwaitConfirmation:sp:5b000000-0000-4000-8000-000000000012",
      "IdentityId": "sp:5b000000-0000-4000-8000-000000000012",
      "Name": "Old SAML Connector",
      "Type": "LegacyServicePrincipal",
      "Action": "AwaitConfirmation",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "",
      "ConfirmedOn": "",
      "ClaimWindowEnds": "",
      "Reason": "The identity governance officer confirms the finding before anything is disabled"
    },
    {
      "ActionId": "AddOwner:app:1a000000-0000-4000-8000-000000000002:gina@contoso.example",
      "IdentityId": "app:1a000000-0000-4000-8000-000000000002",
      "Name": "HR Connector",
      "Type": "AppRegistration",
      "Action": "AddOwner",
      "Write": true,
      "Call": "graph-app-owner-add",
      "Method": "POST",
      "Target": "https://graph.microsoft.com/v1.0/applications/0a000000-0000-4000-8000-000000000002/owners/$ref",
      "Body": {
        "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/5a000000-0000-4000-8000-000000000007"
      },
      "Precheck": "graph-application-owners 0a000000-0000-4000-8000-000000000002: not already an owner",
      "ConfirmedBy": "",
      "ConfirmedOn": "",
      "ClaimWindowEnds": "",
      "Reason": "Claimed by HR systems office on 2026-10-29"
    },
    {
      "ActionId": "NomineeRefused:app:1a000000-0000-4000-8000-000000000004:dave_partner.example#EXT#@contosoexample.onmicrosoft.com",
      "IdentityId": "app:1a000000-0000-4000-8000-000000000004",
      "Name": "Build Pipeline",
      "Type": "AppRegistration",
      "Action": "NomineeRefused",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "",
      "ConfirmedOn": "",
      "ClaimWindowEnds": "",
      "Reason": "dave_partner.example#EXT#@contosoexample.onmicrosoft.com is guest; owners are enabled members"
    },
    {
      "ActionId": "RecordOwner:ad:ad000000-0000-4000-8000-000000000004:carol@contoso.example",
      "IdentityId": "ad:ad000000-0000-4000-8000-000000000004",
      "Name": "svc-oldftp",
      "Type": "Traditional",
      "Action": "RecordOwner",
      "Write": false,
      "Call": "",
      "Method": "",
      "Target": "",
      "Body": null,
      "Precheck": "",
      "ConfirmedBy": "",
      "ConfirmedOn": "",
      "ClaimWindowEnds": "",
      "Reason": "Record carol@contoso.example in the owners file in a reviewed change; there is no owner to add in the directory for a Traditional"
    }
  ]
}
