This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Federal Modernization Workbook
Workbook Map
Every page, deck, video and kit: what it does, where it lands and when it last changed
This page lists every object in the workbook, so you can scan or search (Ctrl/Cmd+F) all of it at once. Each entry links to where the object lands. Use the contents on the right to jump between sections.
| Date | What it means |
|---|---|
| Baseline | One date for everything, set by the baseline edition (Release 2.0) once the books have been checked against each other |
| Last updated | The last time the object itself changed. Edition numbers in links and review records don’t count |
| Last verified | The last time the page was reviewed, or its claims were checked against their sources |
A Last updated date later than Last verified means the page has changed since it was last checked.
Note
This map is generated on every site build by scripts/generate_workbook_map.py, so it always matches the site. To regenerate it locally without a full build:
python scripts/generate_workbook_map.py532 pages, 182 narrated decks with their videos and 21 kits.
Baseline: Release 2.0, the baseline edition, 2026-11-08
Last verified: 472 pages carry a verification date, and 60 don’t. 281 pages changed after their last verification date.
Project
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Home | — | 2026-11-11 | — | — |
| Page not found | The page you were looking for isn’t on this site. | 2026-11-06 | — | — |
| Downloads | One place for every Federal Modernization Workbook download: the read-only Start Kit assessment scripts, the read-only validation kit for the track… | 2026-11-12 | — | — |
| Start Here | The starting point for the Federal Modernization Workbook: a narrated executive briefing of about 7 minutes on why modernization begins with… | 2026-11-11 | — | — |
The Workbook Books
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| The Workbook Books | The Federal Modernization Workbook organized as twenty topic books. | 2026-11-12 | — | — |
Book 00 — Orientation & Program
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Modernize, and Why Now | Why the federal client/server estate has to be modernized as one governed program: the governance Active Directory supplied without anyone writing it… | 2026-11-09 | 2026-11-05 | Baseline |
| Chapter 02 — How to Use This Workbook | How the Federal Modernization Workbook is built and organized: twenty topic books, each framed Why / What / Who / How; how every external claim is… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 03 — The Program Charter | The Federal Modernization Program’s charter: purpose, problem, six objectives, scope, guiding principles, measurable success criteria tied to the… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 04 — The Modernization Principles | The fifteen principles of the Federal Modernization Program, from the single source of truth to the modernization journey, each stated as rules… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 05 — The Program Plan: Phases and Gates | How the Federal Modernization Program is planned: the constraints every phase obeys, the seven phases and six gates that Book 01 sets, how the… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 06 — The Complementary Projects | The seven chartered projects that turn the program’s largest gaps into executable work, and an eighth, Content Delivery Modernization, that draws on… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 07 — Who Runs the Program | How the Federal Modernization Program is run day to day: the roles in the charter and plans reconciled with the program-wide decision matrix, who… | 2026-11-09 | 2026-10-22 | Baseline |
| Chapter 08 — Pre-Flight: Platform and Assessment | The program-level view of Phase 0 and gate G0: the platform host as the reference design, the repository conventions every artifact follows, the… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 09 — Design, Pilot and Rollout | The program-level view of Phases 1 to 3 and gates G1 to G3: turning the approved plans into designs and a working foundation, proving the whole… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 10 — Retirement, Steady State and Measuring Success | The last stretch of the program: retiring legacy infrastructure under gate G4, retiring AD DS under gate G5, running the steady state that follows… | 2026-11-10 | 2026-11-10 | Baseline |
| Appendix A — Risk Register and Control Traceability | The program’s risk register, re-keyed to Book 01’s phases and gates and corrected, and the traceability from each phase’s milestones to the NIST SP… | 2026-11-09 | 2026-10-22 | Baseline |
| Appendix B — The Engagement Archetype (Illustrative) | An illustrative framing pattern for an end-to-end federal modernization engagement: the typical starting state, the five-step intervention mapped… | 2026-11-09 | 2026-10-21 | Baseline |
| Appendix C — Funding and Acquiring the Program | How the program’s phases, charters and gates become the investment record federal capital planning requires; the program as the agency’s enterprise… | 2026-11-11 | 2026-11-09 | Baseline |
| Appendix D — Control States, Authority Labels and Evidence | The workbook’s implementation guidance conventions, defined once: the five control states, the How-section template, sources and last-verified dates… | 2026-11-11 | 2026-11-11 | Draft |
| Book 00 — Orientation & Program | Book 00 of the Federal Modernization Workbook: why the client/server estate has to be modernized now, how the workbook is built and how to read it… | 2026-11-11 | — | — |
Book 01 — The Transformation Arc
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Modernization Is Hard | A plain-language account of how federal IT reached its current shape, why the move to cloud identity keeps stalling, what the session-to-token shift… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — The Problem: Governance Hidden in the Directory | Why Active Directory was the implicit governance model for every Windows-era service, the eleven categories of object it governs silently, why the OU… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 03 — The Platform Foundation | The single governed host that runs every analysis, plan, delivery and evidence step: its five roles, why one authoritative writer matters, how… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 04 — Identity Transformation | How the OU tree’s hidden governance becomes explicit in a flat cloud directory: HR-sourced attributes, dynamic groups, administrative units and… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 05 — Policy Transformation | How twenty-five years of Group Policy is regenerated, not copied, into Intune configuration and compliance policies, Conditional Access and Azure… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 06 — Network Services: DNS, DHCP and IPAM | Why DNS, DHCP and IP address management move together and with the directory, how AD-integrated DNS gives way to governed on-premises authority and… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 07 — Compute Transformation | How domain-joined PCs move to Microsoft Entra join and Intune, how servers come under Azure Arc and machine configuration, why hybrid join is a… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 08 — The Access Plane | How the identity-bound access plane replaces the Active Directory network perimeter: Zero Trust as the model, Conditional Access as the decision… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 09 — Who Leads the Transformation | Who leads, decides and does the work across the whole modernization program: the executive sponsor and CIO, the CISO and authorizing official, the… | 2026-11-09 | 2026-10-23 | Baseline |
| Chapter 10 — Analyzing the Estate | How the Federal Modernization Program inventories a client/server estate before anything moves: a read-only, least-privilege, provenance-bound… | 2026-11-09 | 2026-11-05 | Baseline |
| Chapter 11 — Analysis, Plan, Delivery | The transformation engine: how a committed assessment becomes governed change on the target surface through three stages (Analyze, Plan, Deliver)… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 12 — The Migration Roadmap | The program view of the whole transformation: the structural move and five principles behind it, seven gated phases with five parallel workstreams… | 2026-11-09 | 2026-11-08 | Baseline |
| Appendix A — Requirements Mapping | A compliance-enabling map, not a compliance claim: each federal requirement the transformation touches (EO 14028, OMB M-22-09 and M-26-14, CISA BOD… | 2026-11-09 | 2026-11-05 | Baseline |
| Appendix B — Applicability | Which environments the Book 01 target state assumes and where it doesn’t apply as written: commercial cloud and GCC Moderate, GCC High and DoD… | 2026-11-09 | 2026-11-05 | Baseline |
| Book 01 — The Transformation Arc | Book 01 of the Federal Modernization Workbook: the end-to-end move from a domain-joined client/server estate to cloud identity, cloud device… | 2026-11-11 | 2026-10-21 | — |
Book 02 — Identity & Directory
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Identity Matters | Why identity is now the control plane for access, what twenty-five years of Active Directory accumulated, why the move to Entra ID is forced by… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 02 — The Structural Problem | Why Active Directory’s forest, domain, OU and Group Policy hierarchy doesn’t map onto a flat Entra ID tenant governed by attributes, why… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 03 — Active Directory and Entra ID, Side by Side | The foundational crosswalk between the Active Directory world and the Microsoft Entra ID world: trust roots, protocols, cryptography, tooling, the… | 2026-11-10 | 2026-10-20 | Baseline |
| Chapter 04 — The Hidden Migration Surface | Everything that depends on Active Directory beyond users and groups: the eleven dependency object types, the eight migration adapters and their… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 05 — Delegation Without OUs | How administrative delegation works once the OU tree is gone: the three-tier model, administrative units including dynamic and restricted management… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 06 — Who Owns the Migration | Who decides, who does the work and who is consulted in an Active Directory to Entra ID migration, and which Microsoft-native tools the program… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 07 — Read-Only Discovery | How to start an Active Directory assessment before any elevated access is granted: what a standard account can and can’t read by default, how to… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 08 — Assessing the Forest | The full forest assessment: prerequisites, topology and operations master discovery, OU and delegation extraction, GPO, DNS and AD CS analysis… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 09 — Building the Entra ID Target | How to decompose the Active Directory identity model and rebuild it in Microsoft Entra ID: the object model and licensing, the sync engine and… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 10 — Migrating and Governing | How to govern the Entra ID target and move onto it: lifecycle workflows, access packages and reviews, cross-tenant collaboration, phishing-resistant… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 11 — Reference Deployment | A reference deployment pattern for a federal civilian agency moving two Active Directory forests and a SQL Server estate to Microsoft Entra ID… | 2026-11-09 | 2026-10-21 | Baseline |
| Appendix A — Federal Requirements Crosswalk | Microsoft’s Entra security checklist scored for a federal agency with a long Active Directory history, crossed with the CISA BOD 25-01 required SCuBA… | 2026-11-10 | 2026-10-20 | Baseline |
| Appendix B — Forest Assessment Module | The complete FMPADAssessment PowerShell module that Chapter 08 describes, restored and corrected, with installation steps and the assessment output… | 2026-11-09 | 2026-10-27 | Baseline |
| Appendix C — Identity Assessment Module | Reference material for Chapters 09 and 10: the full Active Directory to Microsoft Entra ID attribute mapping, Conditional Access policy templates in… | 2026-11-10 | 2026-11-10 | Baseline |
| Appendix D — Migrating AD FS Applications | How to move the applications that still sign in through AD FS to Microsoft Entra ID before the farm retires: the relying-party and claim-rule… | 2026-11-11 | 2026-11-11 | Draft |
| Book 02 — Identity & Directory | Book 02 of the Federal Modernization Workbook: why identity is the control plane of a modern federal estate, how Active Directory and Entra ID… | 2026-11-11 | — | — |
Book 03 — HR-Driven Identity
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Overview and Applicability | The proposal: use Federal HR 2.0 and the Active Directory to Entra ID migration together to start HR-driven Entra ID, Active Directory and ICAM… | 2026-11-09 | 2026-11-01 | Baseline |
| Chapter 02 — Why HR Is the Source of Authority | Fragmented identity truth, the orphaned account as its structural output, the federal policy and guidance that support a designated source, why the… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 03 — Federal HR 2.0 and the Core HCM Platform | What OPM HRIT is, the Federal HR 2.0 memo and the Oracle Core HCM award, the wave clock that sets an agency’s provisioning deadline, why EHRI-shaped… | 2026-11-09 | 2026-11-01 | Baseline |
| Chapter 04 — Attribute Authority | What the HR system of record owns and what the identity platform owns, effective dating, the authoritative-versus-derived rule for every attribute… | 2026-11-10 | 2026-10-20 | Baseline |
| Chapter 05 — Provisioning Services | Provisioning services end to end, with API-driven inbound provisioning as the Microsoft implementation: the Oracle HCM source surfaces, the five… | 2026-11-10 | 2026-10-20 | Baseline |
| Chapter 06 — The Canonical Workforce Identity Model | The standard-attribute layer — OPM data elements and nature-of-action codes as the contract — and the one attribute schema the whole site uses: each… | 2026-11-10 | 2026-10-20 | Baseline |
| Chapter 07 — Who Owns Workforce Identity | Who owns the workforce data (HR, the OPM Federal HR 2.0 program and the contractor sources), who uses it, who guards it, the data architect’s role as… | 2026-11-09 | 2026-11-02 | Baseline |
| Chapter 08 — Joiner, Mover, Leaver | The five lifecycle events and the identity actions each one causes; who creates accounts (provisioning) and who acts on them (Lifecycle Workflows)… | 2026-11-11 | 2026-10-20 | Baseline |
| Chapter 09 — Credentials and Certificates Across Joiner, Mover, Leaver | How identity-based credentials follow the workforce lifecycle: PIV issuance, certificate binding, revocation checking, derived PIV credentials… | 2026-11-11 | 2026-10-20 | Baseline |
| Chapter 10 — From Attributes to Access | The derivation chain from worker record to entitlement: rules for dynamic membership written against the canonical schema, administrative units for… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 11 — Drift, Metrics and Evidence | The lifecycle metrics an event-driven pipeline makes measurable, the classes of drift between HR and the directory and how to detect each one, the… | 2026-11-09 | 2026-11-01 | Baseline |
| Chapter 12 — Execution Plan | The HR track’s phase model, Phase 0 to Phase 6, mapped to the program plan’s phases, with the work and the exit gate for each: program alignment… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 13 — Reference Deployment (Illustrative) | An illustrative walk-through of the book for a mid-size federal civilian agency in Wave 2: the starting estate, what each phase does and finds, the… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 14 — Privacy for Workforce Identity | Privacy as a design obligation of HR-driven identity: which identity data is PII, whether the HR-to-directory flow is covered by an existing… | 2026-11-09 | 2026-11-02 | Baseline |
| Chapter 15 — External Partner Identity | The External Partner Person as a workforce identity class: people whose affiliation record and primary credential belong to another organization… | 2026-11-10 | 2026-11-10 | Baseline |
| Appendix A — Lifecycle Rules | The rules that keep HR-driven lifecycle automation safe: scope, leave versus leaver, event precedence, rescinded offers, cancellations, partial… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix B — Security and Privacy Assessment | The data-flow security and privacy assessment for HR-driven identity: the Privacy Act disclosure basis and the PIA, attribute minimization… | 2026-11-09 | 2026-11-01 | Baseline |
| Appendix C — Acceptance and Cutover | How a population moves to HR-driven identity: acceptance tests in business terms, a signed validation report, a dry run, cutover with rollback, proof… | 2026-11-11 | 2026-11-11 | Baseline |
| Appendix D — Partner Identity Record | The reusable record for one External Partner Person relationship: partner and authority, risk, agreement and assurance, route and user type… | 2026-11-09 | — | Baseline |
| Book 03 — HR-Driven Identity | Book 03 of the Federal Modernization Workbook, one book for HR-driven identity modernization in a federal civilian agency: the modernization… | 2026-11-11 | — | — |
Book 04 — Access & Privilege
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Access Is a Policy Decision | Why Zero Trust turns every access request into a decision made against policy, how Conditional Access serves as that policy engine in Microsoft Entra… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 02 — Why Standing Privilege Fails | Why always-on administrative rights are the main path from one stolen credential to control of the estate, what least privilege requires under NIST… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 03 — The Conditional Access Model | How Microsoft Entra Conditional Access evaluates a sign-in: assignments and conditions, grant and session controls, authentication strengths… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 04 — Privileged Roles and Tiers | Which Microsoft Entra roles and cloud permissions are privileged, how the program sorts them into tiers built on Microsoft’s enterprise access model… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 05 — Applications and Workload Identities | How applications become principals in Microsoft Entra ID, how consent, ownership and credentials grant them access, and how the program governs app… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 06 — Who Decides Access | Who decides and who does the work for application and access changes: application owners, business approvers, the identity governance office… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 07 — The Conditional Access Policy Library | The program’s Conditional Access policy library: each policy’s intent, targeting, controls, exclusions, rollout from report-only through pilot to… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 08 — PIM Self-Request with Approval | The operating model for approval-gated, just-in-time activation of Microsoft Entra administrative roles: eligibility, activation requirements… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 09 — Access Governance: Packages, Reviews and Lifecycle | How the program grants, re-confirms, and removes access over time: entitlement management catalogs, access packages and policies, access reviews… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 10 — Access as Code, and the Evidence It Produces | How the program holds Conditional Access, PIM settings, groups, access packages and access reviews as versioned code, applies them through change… | 2026-11-11 | 2026-11-11 | Baseline |
| Appendix A — Conditional Access Policy Templates | Microsoft Graph JSON templates for the Conditional Access policy library in Chapter 07, with the supporting named locations and authentication… | 2026-11-12 | 2026-11-09 | Baseline |
| Appendix B — PIM Role Settings Reference | The program’s Privileged Identity Management role settings for each Microsoft Entra administrative role: tier, maximum activation, approval and… | 2026-11-12 | 2026-11-09 | Baseline |
| Appendix C — Partner Access Profile (Microsoft Entra) | The Microsoft Entra implementation profile for the External Partner Person class: the default route through a connected organization and an access… | 2026-11-12 | 2026-11-11 | Baseline |
| Appendix D — Phishing-Resistant Authentication Runbooks | Rollout runbooks for the three phishing-resistant methods the program deploys, passkeys (FIDO2), Windows Hello for Business and certificate-based… | 2026-11-12 | 2026-11-11 | Draft |
| Book 04 — Access & Privilege | Book 04 of the Federal Modernization Workbook: why access is a policy decision and why standing privilege fails, the Conditional Access model… | 2026-11-11 | — | — |
Book 05 — Devices & Endpoints
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Group Policy Can’t Come to the Cloud | What Group Policy did implicitly for a domain-joined fleet, why none of that machinery exists on an Entra-joined, Intune-managed device, and the… | 2026-11-09 | 2026-10-29 | Baseline |
| Chapter 02 — The Hybrid Join Trap | Why converting a large domain-joined fleet to Microsoft Entra hybrid join is close to a tenant-wide switch, what an ungoverned flip spends in… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 03 — Where Device and Server Data Lives | Which system is authoritative for each fact about a device or server (procurement and CMDB records, Microsoft Entra ID device objects, Intune… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — Intune-First Onboarding | How net-new devices enter governance from day zero: the doctrine, the five-phase procure-to-validate process, Windows Autopilot and Autopilot device… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 05 — The Governed, Manual and Retrofit Paths | The three ways a workstation or server reaches the target state (governed, manual and retrofit), what each needs, produces and risks, the runbook… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 06 — Who Owns the Endpoint | Who decides, who does the work and who is consulted when workstations and servers move from Group Policy to Intune and Azure Arc, with a… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 07 — The GPO Sunset Program | The Group Policy sunset run as a program: inventory and parse, classify every setting, crosswalk, decide, sequence by population, freeze and disable… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 08 — GPO to Intune Policy Migration | The technical side of the GPO sunset: seven phases with tasks, durations, gates, rings, testing and rollback, and the program’s library of Intune… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 09 — Servers Under Azure Arc | How to bring on-premises servers under cloud governance with Azure Arc: the Connected Machine agent, onboarding methods, least-privilege service… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 10 — Operating and Evidencing the Fleet | Run-state for the Intune-managed fleet: compliance and the Conditional Access hand-off, the compliance architecture by platform and ownership… | 2026-11-12 | 2026-11-11 | Baseline |
| Appendix A — GPO to Intune Crosswalk | The Group Policy to Intune crosswalk: each GPO area mapped to its Intune mechanism with notes and limits, the program’s 50-row setting reference, the… | 2026-11-09 | 2026-11-09 | Baseline |
| Book 05 — Devices & Endpoints | Book 05 of the Federal Modernization Workbook: why Group Policy can’t come to the cloud, the hybrid-join trap, where device and server data lives… | 2026-11-11 | 2026-10-29 | — |
Book 06 — Data Platform: SQL Server Identity
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — What Windows Authentication Actually Is | Why the database is where legacy authentication hides, and a precise account of SQL Server Windows Authentication: Kerberos through SSPI, SPN… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 02 — Why the Inheritance Must End | The three drivers that require replacing SQL Server Windows Authentication (NTLM elimination, zero trust and service-account identity), what is and… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 03 — The Shape of Twenty Years | The three forms of sprawl that accumulate in a SQL Server estate over two decades across an Active Directory forest, and why the estate must be… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 04 — The Estate Inventory | What a complete SQL Server estate inventory must capture, the independent discovery instruments that find the instances no inventory records, and the… | 2026-11-09 | 2026-11-02 | Baseline |
| Chapter 05 — Rationalization: Utilization, Versions and Dependencies | The three lenses that turn a raw SQL Server inventory into a rationalization judgment: utilization and zombie detection, version and end-of-support… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 06 — The Retain, Consolidate, Retire Decision | How the rationalization lenses resolve into one per-instance classification, the consolidation targets and what each means for Microsoft Entra… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 07 — The Authentication Audit | What the authentication-audit script measures on every surviving SQL Server instance, the three-category Arc-eligibility classification it assigns… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 08 — Reading the Audit: Classification and Triage | How to read each Arc-eligibility category, how the audit output orders work within a category, and why SQL Server engine Entra authentication… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 09 — What Arc Provides to SQL Server | What the Connected Machine agent and its managed identity give a SQL Server host, which Entra identity the instance uses on SQL Server 2022 and 2025… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 10 — Arc Deployment Sequencing for SQL Server Hosts | The ordered prerequisites that turn a domain-joined SQL Server host into an Arc-enabled, identity-ready instance: egress, the Connected Machine… | 2026-11-09 | 2026-11-01 | Baseline |
| Chapter 11 — Three Principal Types: User, Group, Service Principal | The FROM EXTERNAL PROVIDER syntax that creates token-validated logins, the three Entra principal types those logins map to, and the three-phase… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 12 — What the Engine-Authentication Decision Settles | The five governance positions the SQL Server engine-authentication decision records: consolidation gates migration, the parallel run is required, SQL… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 13 — Who Owns the Data Platform | Who decides, who does the work and who is consulted when SQL Server moves from Windows authentication to Microsoft Entra ID: the data platform team… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 14 — NTLMv1, NTLMv2 and the Patterns That Generate NTLM | Why NTLMv1 and NTLMv2 sit on different clocks, what Microsoft has and hasn’t changed, and the four SQL Server connection patterns that generate NTLM. | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 15 — The Three Phases of NTLM Elimination for SQL Server | How the program’s discover, restrict and eliminate phases apply to SQL Server, which Windows controls each phase uses, and why Entra-authenticated… | 2026-11-11 | 2026-10-20 | Baseline |
| Chapter 16 — Groups, Roles and How Membership Reaches the Engine | How an Entra security group becomes a SQL Server login and one database role, why the group model stays flat, when membership changes take effect… | 2026-11-09 | 2026-10-29 | Baseline |
| Chapter 17 — Dynamic Membership, Delegation and Privileged Access | What makes attribute-driven SQL Server access safe: the attribute source, rule design and testing, administrative-unit delegation, PIM for Groups… | 2026-11-09 | 2026-10-29 | Baseline |
| Chapter 18 — The Four-Class Pattern Applied to SQL-Consuming Applications | Why the SQL Server transformation isn’t finished until the applications upstream of it are, how the four-class taxonomy sorts them, and how the… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 19 — Connection String Migration: The Last Mile | The connection-string change that ends the application-chain migration, the Entra options each Microsoft driver offers, the gates in front of the… | 2026-11-11 | 2026-11-09 | Baseline |
| Chapter 20 — The Closure Condition | The five conditions that together close the SQL Server authentication transformation, the continuous audit and per-instance compliance record that… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 21 — What Done Looks Like | The six evidence sets that close the SQL Server authentication transformation, why each is a live output of continuous monitoring, and the correct… | 2026-11-09 | 2026-11-05 | Baseline |
| Chapter 22 — Where SQL Server Touches AD CS | The three SQL Server capabilities that can depend on certificates from Active Directory Certificate Services (TLS for client connections… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 23 — Epilogue: The Platform Question | Once the estate is rationalized and its authentication migrated, the platform question asks what to do with each retained data domain: stay on SQL… | 2026-11-09 | 2026-11-08 | Baseline |
| Appendix A — Requirements Mapping | A compliance-enabling crosswalk, not a compliance claim: for each part of the book, the control it puts in place and the evidence it produces, mapped… | 2026-11-09 | 2026-10-20 | Baseline |
| Appendix B — Security-Approval (ATO) Kit | Material a system owner and ISSO can adapt for the system security plan when SQL Server moves to Microsoft Entra authentication through Azure Arc… | 2026-11-09 | 2026-10-20 | Baseline |
| Appendix C — Applicability | Where the book applies as written: SQL Server 2022 and 2025 on Windows, standalone or in availability groups, connected to Microsoft’s commercial… | 2026-11-09 | 2026-10-20 | Baseline |
| Book 06 — Data Platform: SQL Server Identity | Book 06 of the Federal Modernization Workbook: what Windows Authentication is and why the inheritance must end, the estate and its rationalization… | 2026-11-11 | — | — |
| Runbook R01 — Prerequisites & Using This Companion | Where to start with the runbooks: the program’s toolchain (the read-only discovery Spec scripts and the FMPSqlServerMigration, FMPIdentityAssessment… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R02 — Estate Discovery & the Consolidation Gate | How to assess and consolidate a twenty-year SQL Server estate before any login is touched: the discovery the audit family provides (Spec3-D1.8… | 2026-11-09 | 2026-10-20 | Baseline |
| Runbook R03 — The Authentication Audit | The read-only foundation of the SQL Server transformation: the program’s Get-SQLServerAuthAudit script (Spec3-D1.8) and the SPN inventory… | 2026-11-09 | 2026-10-20 | Baseline |
| Runbook R04 — Arc Deployment & the Managed Identity | The runbook for giving an on-premises SQL Server instance its Microsoft Entra identity through Azure Arc: which Azure cloud a GCC-Moderate tenant… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R05 — Login Migration & Parallel-Run Validation | A review-required runbook for migrating SQL Server authentication to Microsoft Entra ID: take the login inventory from Runbook R03, codify the… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R06 — NTLM Detection & Remediation | How to find every NTLM-generating pattern at the SQL layer with the program’s read-only SPN and protocol audits, then work the review-required… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R07 — Groups, Administrative Units & the Conditional Access Perimeter | How to move SQL Server’s access-control layer from Active Directory groups to Microsoft Entra: inventory the groups and Conditional Access policies… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R08 — The Application Chain & Connection-String Migration | How to complete the authentication chain upstream of SQL Server: inventory the LDAP-bind dependency with the program’s read-only audit, correlate and… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R09 — Continuous Monitoring & the CCM-BIR Closure Record | How to prove and keep the transformed posture: run the instance audit on a schedule, project each run onto the per-instance closure record, treat… | 2026-11-11 | 2026-10-20 | Baseline |
| Runbook R10 — Certificate Discovery for SQL Server’s AD CS Dependencies | How to discover, ahead of any Active Directory Certificate Services decommission, the certificate dependencies that break SQL Server if the… | 2026-11-09 | 2026-10-20 | Baseline |
Book 07 — PKI & Certificates
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Certificates Outlive Every Migration | Why certificates are a naming and trust function that every other migration leans on, why shrinking lifetimes and changing rules make manual… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 02 — What AD CS Holds Up | The typical Active Directory Certificate Services topology and its directory footprint, the certificate template categories and autoenrollment… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 03 — Hardening What Stays | How to harden the AD CS estate that keeps running during the transition: the ESC1–ESC8 misconfiguration classes as a detection and remediation… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 04 — The Target PKI: Cloud PKI, AD CS and Federal PKI | The target certificate architecture: what Microsoft Cloud PKI can and can’t issue, its two deployment models and the decision matrix between them… | 2026-11-11 | 2026-11-09 | Baseline |
| Chapter 05 — Who Owns the Certificate Estate | Who decides, who does the work and who is consulted across the certificate estate: CA administrators, identity, endpoint, server and network teams… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 06 — Device and User Certificates: Intune and Entra CBA | How Intune delivers device and user certificates through trusted certificate, SCEP and PKCS profiles, what strong certificate mapping now requires of… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 07 — Coexistence and Migration | How AD CS and the cloud issuers run side by side during the migration (domain controller and LDAPS certificates, trust in both directions, CRL… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 08 — Lifecycle, Monitoring and Decommissioning | How the certificate estate is kept alive after migration: renewal at scale as public lifetimes shrink, ACME where it applies, CLM inventory and… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 09 — Federal Workforce Credentials: PIV, Derived PIV and Cloud Authentication | The PIV credential as the federal workforce credential that cloud authentication sits under: HSPD-12 and FIPS 201-3, the PIV authentication… | 2026-11-11 | 2026-11-11 | Baseline |
| Appendix A — Cloud PKI and CBA Deployment Checklists | Two working checklists, verified against Microsoft documentation as of October 2026: deploying Microsoft Cloud PKI with Intune, and configuring… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix B — Certificate Template Migration Matrix | The starting classification for common AD CS certificate templates (MIGRATE, BRIDGE, RETAIN or RETIRE), with the target issuer or Intune profile for… | 2026-11-09 | 2026-10-22 | Baseline |
| Appendix C — Anatomy of the CLM Platform | What the certificate lifecycle management platform is made of: the component types every CLM platform has, how they map to CyberArk Certificate… | 2026-11-09 | 2026-11-09 | Baseline |
| Book 07 — PKI & Certificates | Book 07 of the Federal Modernization Workbook: why certificates outlive every migration, what AD CS holds up, hardening the CAs that stay, the target… | 2026-11-11 | — | — |
Book 08 — DNS, DHCP & IPAM
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — DNS Is Now the Control Plane | Why DNS, DHCP and IPAM can no longer be run as a commodity utility: what DNS now does in a hybrid multi-cloud agency, how fragmented it has become… | 2026-11-09 | 2026-10-30 | Baseline |
| Chapter 02 — Split-Brain DNS: The Structural Problem | What split-brain DNS is, how it breaks private connectivity, SaaS endpoint selection and security policy without producing a DNS error, why process… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 03 — Federal Requirements: NIST SP 800-81, FedRAMP and Zero Trust | What federal policy actually requires of the name layer: OMB M-22-09 encrypted DNS, CISA Protective DNS, M-26-14 event logging, DNSSEC, IPv6, TIC… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 04 — The Active Directory DNS Departure | What AD-integrated DNS and Windows DHCP actually do for a domain — zones stored in the directory, domain controller locator records, secure dynamic… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 05 — Edge Interception, Encrypted DNS and Rogue DHCP | The three ways a query escapes the governed resolver path: an SD-WAN edge that redirects DNS to the wrong place, encrypted DNS that terminates at an… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 06 — DNS Identity, Certificates and DNSSEC | Why the name layer is the first link in the trust chain for certificates, FQDN-based policy and tokens: how the move from Kerberos to Entra ID tokens… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 07 — Cloud Private Endpoints, SDN and IPAM Consistency | How each cloud and VMware implements private DNS, logs queries and fails, how Azure private endpoints and the Azure DNS Private Resolver must be… | 2026-11-09 | 2026-10-30 | Baseline |
| Chapter 08 — Reference Architecture and the Five Critical Decisions | The end-to-end governed resolution path, the five configuration decisions that carry most of its operational risk and how to check each one, the… | 2026-11-09 | 2026-10-29 | Baseline |
| Chapter 09 — Who Owns DNS, DHCP and IPAM | Who decides, who does the work and who is consulted when DNS, DHCP and IPAM move from Active Directory and per-cloud silos to one policy plane, with… | 2026-11-09 | 2026-10-20 | Baseline |
| Chapter 10 — The Migration Sequence | The six-phase sequence from AD-integrated DNS and DHCP to a single authoritative policy plane: what to inventory, how coexistence works, how… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 11 — Operating the Control Plane: Delegation, Automation and Evidence | What the single DDI policy plane must support once it is running: scoped delegation for divisions, API-first automation, ITSM and identity… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 12 — Platform Selection, Cost and Residual Risk | How to choose a DDI platform model against evidence rather than a vendor list, what it costs to run, what to ask vendors before committing, and which… | 2026-11-09 | 2026-10-29 | Baseline |
| Appendix A — DNS Record Types and Ecosystem Integrations | A practitioner catalog of the DNS record types that matter to federal hybrid multi-cloud security, certificate governance and service routing, with… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix B — Requirements Mapping and Sources | A compliance-enabling crosswalk, not a compliance claim: each federal requirement that touches DNS, DHCP and IPAM (OMB M-22-09, M-26-14, M-08-23 and… | 2026-11-09 | 2026-10-29 | Baseline |
| Appendix C — Applicability | Which parts of the book apply as written at FedRAMP Moderate, in commercial regions with GCC Moderate and in the AWS GovCloud (US) and Azure… | 2026-11-09 | 2026-10-29 | Baseline |
| Book 08 — DNS, DHCP & IPAM | Book 08 of the Federal Modernization Workbook: why DNS is now the control plane, split-brain DNS, federal requirements, the Active Directory DNS… | 2026-11-11 | — | — |
Book 09 — Network & Transport
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Physics Decides the Architecture | Why latency is a physical constraint no product removes: the pendulum back toward logical centralization, the speed-of-light floor, what the 150 ms… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — Transport Is Physics, Control Is Compliance | Why “SD-WAN versus DIA” is a false choice: what direct internet access solves and what it leaves undone, the transport menu and the one control… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 03 — What TIC 3.0 and Federal Policy Actually Require | What TIC 3.0 and the surrounding federal instruments require of a branch network as of October 2026, read from the documents themselves: the TIC 3.0… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — Logical Centralization and Token-Based Security | Why one logical source of truth beats many authoritative copies, why token-based security is what makes a shared store safe, and how choosing the… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 05 — SD-WAN, SASE and Governed-Path Transport | What SD-WAN’s differentiated transport can and can’t do against the propagation floor, how SASE security services sit above it under TIC 3.0, the… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 06 — Legacy Protocols on Re-Routed Paths | What actually breaks when an enforcement point sits in the path or the path changes, the real network dependencies of Kerberos and NTLM, why round… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 07 — Network Access Control: 802.1X and RADIUS | How port-based network access control with 802.1X, EAP-TLS and RADIUS proves which device is on the wire, why Network Policy Server is an Active… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 08 — Reference Architecture: Consistency Classes Meet Network Classes | The book’s reference architecture: the rule that aligns each data flow’s consistency class with a network class, the program’s SaaS data plane as the… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 09 — Who Owns the Network and Its Transport | Who decides, who does the work and who is consulted when an agency changes its transport, its branch control layer, its TIC 3.0 posture and its… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 10 — The Long Interim | The posture for an agency that can’t buy SD-WAN or adopt a TIC 3.0 use case for years: why each alternative to a branch-edge policy layer has closed… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 11 — Field Office WAN Transformation | Why a per-office distribution point refresh treats a transport problem as a content problem, and how SD-WAN, direct internet access and a 12-hub… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 12 — Microsoft 365 Traffic and the Optimize Inspection Exemption | What Microsoft’s Optimize, Allow and Default endpoint categories mean, why Microsoft’s bypass-inspection guidance collides with an inspect-everything… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 13 — Sequencing, Cost and Evidence | The decision sequence and the technical dependencies behind it, the phase-inversion failure mode and the evidence for and against it, how to measure… | 2026-11-09 | 2026-10-23 | Baseline |
| Appendix A — Optimize Exemption Decision Instruments | Templates for the three documents that exempt the Microsoft 365 Optimize endpoint set from TLS break-and-inspect at branch direct internet egress… | 2026-11-09 | 2026-10-21 | Baseline |
| Appendix B — Requirements Mapping and Sources | A compliance-enabling crosswalk, not a compliance claim: each federal requirement that touches branch network and transport design (TIC 3.0, OMB… | 2026-11-09 | 2026-10-21 | Baseline |
| Appendix C — Glossary | Plain definitions of the network, transport, policy and control terms used across Book 09, with corrections to terms the sources got wrong. | 2026-11-09 | 2026-11-08 | Baseline |
| Book 09 — Network & Transport | Book 09 of the Federal Modernization Workbook: the speed-of-light floor, transport versus control, what TIC 3.0 and M-26-14 actually require, logical… | 2026-11-11 | — | — |
Book 10 — Cloud Boundary & Landing Zone
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why the Boundary Decides What You Can Use | Why the FedRAMP certification, the provider’s published exclusions for the agency’s cloud environment and the agency’s own authorization decide which… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — The Invisible Boundary | Why much of what the boundary removes stays invisible until a design depends on it, a corrected version of the most-cited GCC example, the program’s… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 03 — What Changed at FedRAMP | What FedRAMP’s Consolidated Rules for 2026 changed about the cloud boundary: certification classes in place of impact levels, a rulebook with no… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 04 — GCC, GCC High and the Commercial Feature Gap | What Microsoft 365 GCC is in Microsoft’s own documentation, why its feature gaps are published one feature at a time and run in both directions, what… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 05 — The Landing Zone | What a cloud landing zone is, how management groups, subscriptions and Azure Policy turn the authorization boundary into enforceable structure, the… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 06 — IPAM and Network as Code | Why the address plan is the join key for inventory and boundary evidence, how the enterprise IPAM stays the authority while Azure Virtual Network… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 07 — The Landing Zone Front Door | The governed request that turns landing-zone code into an approved, evidenced and reconciled provisioning event: subscription vending, the six-step… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 08 — Who Owns the Boundary | Who decides, who does the work and who is consulted when an agency draws, changes and evidences the boundary around its use of a certified cloud… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 09 — In-Boundary Equivalents and Documented Exceptions | What an agency does when a capability is outside its cloud boundary: inventory the exclusions feature by feature, probe what actually works, build… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 10 — Alternative Collaboration Paths | When the tenant’s own suite isn’t the right answer for a workload, an agency can move collaboration to a different certified service while keeping… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 11 — Evidencing the Boundary in the Authorization Package | What the cloud boundary means for the agency’s own authorization: what the package contains, how the boundary becomes a named artifact that the… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix A — What to Ask a Cloud Provider For | Specific, evidenced requests an agency can put to a cloud provider about its government offering, each tied to a FedRAMP 2026 rule or to the… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix B — Platform Host Interface Reference | Every interface the program’s Git-based platform host on Windows Server 2025 exposes, grouped into six families and mapped to its boundary… | 2026-11-09 | 2026-11-09 | Baseline |
| Book 10 — Cloud Boundary & Landing Zone | Book 10 of the Federal Modernization Workbook: the invisible boundary, FedRAMP’s 2026 rules, GCC and the commercial feature gap, the landing zone… | 2026-11-11 | 2026-10-21 | — |
Book 11 — Zero Trust & Assessment
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Zero Trust Is a Whole-Agency Property | Why Zero Trust maturity belongs to the whole agency rather than to any tool or tenant: what the federal guidance actually describes, why stapled… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — Governance Principles for Zero Trust | Why programs stall below the Advanced stage of CISA’s Zero Trust Maturity Model, and five governance principles that move them past it: identity as a… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 03 — What CISA’s Maturity Model and M-22-09 Actually Require | What the federal Zero Trust instruments require, read from the documents themselves as of October 2026: the kind of authority each carries, the… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — SCuBA and BOD 25-01 | What CISA’s SCuBA project provides, what Binding Operational Directive 25-01 requires of federal civilian agencies for their cloud tenants, which… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 05 — ScubaGear and Microsoft’s Zero Trust Assessment | The two free, read-only assessments agencies run against their Microsoft cloud, what each one checks, where they overlap and where they don’t, and… | 2026-11-12 | 2026-11-08 | Baseline |
| Chapter 06 — Beyond Microsoft 365: Networks, Other Clouds and Virtualized Estates | Why a whole-agency Zero Trust score needs the network, every cloud service provider and the virtualized estate to resolve against one inventory and… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 07 — Who Owns Zero Trust | Who decides, who does the work and who is consulted when an agency sets its Zero Trust posture, runs its assessments and acts on the findings, with… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 08 — Close Before You Assess | Why the program builds the architecture a BOD 25-01 finding depends on before it runs ScubaGear and the Zero Trust Assessment as confirmation, how it… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 09 — Running the Assessment and Ingesting the Evidence | How to run CISA’s ScubaGear and Microsoft’s Zero Trust Assessment against a federal tenant, handle what they produce, and carry their findings into… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 10 — Evidence, Not Verdicts: From Findings to a Program | How to read ScubaGear and Zero Trust Assessment results correctly, score and rank the real findings, keep exceptions where the tools and the… | 2026-11-11 | 2026-11-11 | Baseline |
| Appendix A — Requirements Mapping: Pillars, Controls and Books | A compliance-enabling map, not a compliance claim: CISA’s Zero Trust Maturity Model pillars and cross-cutting capabilities, OMB M-22-09’s objectives… | 2026-11-11 | 2026-11-11 | Baseline |
| Book 11 — Zero Trust & Assessment | Book 11 of the Federal Modernization Workbook: Zero Trust as a whole-agency property, governance principles, what CISA’s maturity model and M-22-09… | 2026-11-11 | — | — |
Book 12 — Security Operations & Telemetry
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — You Can’t Defend What You Can’t See | Why visibility is the precondition for defense: the difference between storing logs and detecting with them, the six planes that must emit telemetry… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 02 — Telemetry Is the Precondition: The Evidence Contract | The one evidence contract every source emits into: its fields and what AU-3 requires of them, the join key of authoritative asset identity plus time… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 03 — Identity Telemetry from Entra ID | How to emit Microsoft Entra ID audit, sign-in, provisioning, Graph activity and ID Protection logs through diagnostic settings: which categories to… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 04 — Azure Platform and Microsoft 365 Audit Telemetry | How to emit the Azure activity log and resource logs, why resource-specific tables beat AzureDiagnostics, how Azure Policy keeps new resources from… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 05 — From Log Warehouse to Detection: SIEM and XDR | Why a log store does not satisfy AU-6, what turns collected telemetry into detections an assessor can trace, how Microsoft Sentinel’s connectors land… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 06 — Vulnerability Management | Why a scan report and a patch policy don’t answer an assessor; what RA-5 and SI-2 ask for; how CISA BOD 26-04 replaced BOD 22-01 and BOD 19-02 with a… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 07 — Patch, Configuration and Hardening Baselines | How flaw remediation and configuration state are closed across every platform an agency runs: the shared-responsibility line as the SI-2 scoping… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 08 — Cloud-Native Posture | Why host scanning misses the risks that live in the cloud control plane and the container layer, how cloud security posture management supports CM-6… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 09 — Data Protection and Classification | Why network and identity controls can’t tell a press release from a Privacy Act record, what the federal CUI framework in 32 CFR Part 2002 actually… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 10 — Who Runs Security Operations | Who decides, who does the work and who is consulted across security operations: the CIO, the CISO, the authorizing official, system owners and ISSOs… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 11 — Detection Engineering and Response Automation | How the program builds and keeps a detection rule library inside its own authorization boundary, manages it as code through a tested lifecycle, and… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 12 — Evidence, Metrics and Continuous Monitoring | How security operations proves itself: CA-7 and the RMF Monitor step, the continuous-monitoring pipeline from emission to plan of action and… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix A — Requirements Mapping: Controls, Mandates and Books | A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. | 2026-11-11 | 2026-10-21 | Baseline |
| Appendix B — Identity and Application Detections for Zero Trust Findings | The detections a Zero Trust assessment’s identity and application findings need behind them, as a rule pack for the library in Chapter 11: emergency… | 2026-11-11 | 2026-11-11 | Draft |
| Book 12 — Security Operations & Telemetry | Book 12 of the Federal Modernization Workbook: why visibility comes first, the evidence contract and its join key, identity, platform and Microsoft… | 2026-11-11 | — | — |
Book 13 — Governance, Drift & Evidence
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why Compliance Decays the Day After the Audit | Why federal IT governance fails for structural reasons rather than lack of effort: four failure modes, the compliance paradox of point-in-time… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — Drift Is the Primary Threat | Why drift, the silent divergence between the authoritative record and the running estate, is the main way controls fail between assessments: where it… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 03 — One Authoritative Record: Single Source of Truth and the Six Planes | What the program’s authoritative record is and where it lives, how runtime systems consume it without copying it, the provenance chain that ties… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 04 — Change Control and Provenance | The five-clause path every move, add, change, deletion and reset travels; where work comes from; pull-request-based change to the authoritative… | 2026-11-09 | 2026-10-25 | Baseline |
| Chapter 05 — Deterministic Governance: The Three-Layer Rule Model | Why governance rules have to evaluate deterministically, the three layers the program keeps them in (authoritative rules, policy mappings and runtime… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 06 — The Drift Engine | The program’s one drift model: what the drift engine compares, its five drift classes and how the drift checks in Books 00 to 03 and Book 05 map onto… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 07 — Evidence Over Attestation | Why evidence the systems produce is a stronger basis for an authorization than a person’s signed statement; what NIST and FedRAMP already say about… | 2026-11-09 | 2026-11-02 | Baseline |
| Chapter 08 — The Adapter Model | What an adapter is (a translator from one platform’s native state into the program’s common record and evidence), the two kinds and five missions… | 2026-11-09 | 2026-10-26 | Baseline |
| Chapter 09 — Who Governs | Who keeps the authoritative record and who decides what it says, who approves changes to the rules, who reviews drift and accepts exceptions, the… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 10 — Operational Tempo: Ticket to Machine, Not Ticket to Human | The tempo at which detection, remediation and escalation run; why routine remediation should be a ticket that authorizes a machine rather than one… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 11 — Reciprocity, Indicators and One Authorization | What reciprocity and reuse of authorizations mean under NIST SP 800-37, OMB Circular A-130, OMB M-24-15 and FedRAMP’s Consolidated Rules for 2026… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 12 — Governance at Scale and the Continuous-Monitoring Program | How the program runs governance across many systems, teams, programs and authorization boundaries without per-program exceptions: what it keeps small… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 13 — Records, Evidence and Retention | Four things the workbook calls a record (the authoritative technical record, audit evidence, a federal record and operational data) and how they… | 2026-11-11 | 2026-11-11 | Baseline |
| Chapter 14 — Applications, Secrets and Configuration Drift | The governance record every application and service principal carries (business owner, technical owner, data classification, permissions… | 2026-11-12 | 2026-11-11 | Draft |
| Appendix A — Requirements Mapping: Controls, Mandates and Books | A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. | 2026-11-11 | 2026-10-21 | Baseline |
| Appendix B — Ticket-to-Machine Reference | The reference tables and worked examples behind Chapter 10: the coordination loop and the five-clause request chain, which operation classes go to a… | 2026-11-09 | 2026-11-08 | Baseline |
| Book 13 — Governance, Drift & Evidence | Book 13 of the Federal Modernization Workbook: why point-in-time compliance decays, drift as the primary threat, one authoritative record and its six… | 2026-11-11 | — | — |
Book 15 — Compliance Automation & Day-2 Operations
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Modernization Succeeds or Fails at the Help Desk | Why a modernized estate is judged on day two rather than at cutover: the help desk holds the most dangerous routine actions in identity, attackers… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — Day Two Is Where Compliance Lives or Dies | Why a control that is designed and deployed still decays unless the day-two work that touches it is routed, authorized and evidenced by automation… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 03 — Intake, Triage and Routing | How a request reaches the help desk, how it is triaged by the authority the task needs, who approves and who executes, how it is routed to the ITSM… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — Help Desk Authority in Entra ID | The help desk’s authority model in Microsoft Entra ID: which built-in roles fit help desk work and whose credentials each can touch, scoping with… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 05 — The Service Catalogs: ITSM and Teams Telephony | The help-desk catalog that turns everyday identity work into typed, approved and evidenced requests; the five verbs every identity change reduces to… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 06 — SaaS Integration Governance | Why connecting a third-party SaaS application to Entra ID is the densest control-closing moment in the identity estate; the authorization check… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 07 — The CMDB and Asset Identity | The CMDB as the operational inventory every ticket, change and finding routes to: how it is populated by discovery and service graph connectors, how… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 08 — Control Compliance Automation: Microsoft 365 and Azure | How control evidence is collected automatically from Microsoft 365 (ScubaGear, Microsoft Graph, Purview audit, Purview Compliance Manager) and Azure… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 09 — Control Compliance Automation: AWS and VMware | How control evidence is collected automatically from AWS (AWS Config conformance packs, Security Hub CSPM and the new Security Hub, Systems Manager… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 10 — Who Runs Day Two | The roles that run day-two operations (the service desk lines, identity operations, platform owners, the ITSM platform team, the CMDB owner, the… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 11 — Attestation, Evidence and the Compliance Application | How a closed remediation task becomes an assessed control: system evidence first and human attestation only where no system can prove the control… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 12 — The Day-Two Operator Runbook and Validation | The operator’s runbook for a governed estate: the daily, weekly, monthly and quarterly steps, what each proves and which control it supports, the… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 13 — Building Day-Two Automation In-House | When there is no funding for new licenses or a vendor, how federal staff can build the compliance application on the ServiceNow instance the agency… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 14 — Provider Notices in Day-Two Operations | The notices cloud providers send about the agency’s own tenant, account, tenancy or project, and why they go unread: the six kinds of notice… | 2026-11-09 | 2026-11-09 | Draft |
| Appendix A — Help Desk Task Reference | Task-by-task reference for help desk identity work in Microsoft Entra ID: the least-privileged role, scope, approval, verification and evidence for… | 2026-11-12 | 2026-11-08 | Baseline |
| Appendix B — Recovery and Escalation Runbooks | Identity-proofing and escalation runbooks for the help desk’s six hardest calls: a lost passkey, a Windows Hello for Business reset, a replaced… | 2026-11-11 | 2026-11-11 | Draft |
| Book 15 — Compliance Automation & Day-2 Operations | Book 15 of the Federal Modernization Workbook: why a modernized estate is judged on day two, intake, triage and routing, help-desk authority and… | 2026-11-12 | — | — |
Book 16 — People: Training & Education
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — People, Not Tools, Close the Gap | Why the modernized estate is run by people rather than by its tools: what each earlier book changes in someone’s daily work, why education comes… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 02 — What Federal Workforce Rules Require | The federal workforce requirements behind training: FISMA’s duties to train and staff, OPM’s training rule at 5 CFR 930.301, OMB Circular A-130’s… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 03 — The Compliance Track | The curriculum for ISSOs, compliance staff, control assessors and authorizing officials: the Risk Management Framework and who owes which proof, the… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — The Implementation Track | The curriculum for the engineers and administrators who build and run the modernized estate: a foundations module, ten build modules for DDI… | 2026-11-09 | 2026-10-23 | Baseline |
| Chapter 05 — Assessment and Certification | How the program assesses that people can do the work: a four-level rubric scored the way an assessor would score it, the two track capstones, a… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 06 — Vendor Training and Lab Environments | Where product skill comes from and where people practice it safely: choosing vendor training, the vendors whose products the books configure, the… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 07 — End-User Training for the Modernized Estate | What every user has to learn when the estate changes: phishing-resistant sign-in with PIV, Windows Hello for Business and passkeys, self-service… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 08 — Who Owns Workforce Readiness | Who owns the workforce’s readiness for the modernized estate: the sponsor and CIO, the CISO, the Chief Human Capital Officer and workforce office… | 2026-11-09 | 2026-10-23 | Baseline |
| Chapter 09 — Building and Running the Curriculum | How the program schedules training against Book 01’s phases and gates, trains each wave just before it moves, builds its own instructors, keeps the… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 10 — Measuring Readiness and Evidencing It | How the program measures whether people are ready for each role and each gate: completion set against demonstrated competence, training records as… | 2026-11-09 | 2026-11-09 | Baseline |
| Appendix A — The Curriculum Map: Role, Book and Track | A role-by-role map of the workbook: for each role named in Books 00, 01, 13, 14 and 15, the books and chapters it must read, its track, how it is… | 2026-11-09 | 2026-11-09 | Baseline |
| Book 16 — People: Training & Education | Book 16 of the Federal Modernization Workbook: why people close the gap, what FISMA, 5 CFR 930.301, the NICE Framework and federal cyber workforce… | 2026-11-11 | — | — |
Book 17 — AI Identity Governance
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Why AI Agents Need Identities and Owners | Why an AI system that can act, not just answer, is an identity like any other: it signs in, holds permissions and touches agency records; how most AI… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 02 — What Federal AI Rules Require, and What They Don’t | The federal AI rule set in force in October 2026: what OMB M-25-21 requires of agencies (the Chief AI Officer, the annual inventory, compliance plans… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 03 — The AI Use-Case Inventory as an Identity Source | What the Federal AI Use Case Inventory records under OMB’s 2025 guidance and how many use cases it holds; which of its fields can anchor an identity… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 04 — Kinds of AI Identity: Workloads, Agents and Delegated Access | The ways an AI system obtains access, sorted by whose token it presents; Microsoft Entra workload identities, managed identities and workload… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 05 — Owners, Sponsors and the AI Identity Lifecycle | Who is accountable for an AI identity and how its lifecycle runs: the owner, sponsor and manager relationships in Microsoft Entra Agent ID, the… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 06 — Credentials, Least Privilege and Access Policy for AI | How AI systems and agents authenticate without stored secrets (managed identities, workload identity federation and certificates on the agent… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 07 — Monitoring, Drift and Shadow AI | How the program watches AI identities once they exist: the sign-in, audit and risk signals for workload and agent identities, how to find AI systems… | 2026-11-10 | 2026-11-10 | Baseline |
| Chapter 08 — Who Owns AI Identity Governance | Who decides and who does the work when AI systems get identities: the Chief AI Officer’s duties under OMB M-25-21, the CIO, the CISO, the authorizing… | 2026-11-09 | 2026-10-26 | Baseline |
| Chapter 09 — Running the Inventory Scan, Agency and Central | How the program scans an AI use-case inventory for identity-governance gaps, step by step at agency level (load a vintage, detect, prioritize… | 2026-11-09 | 2026-10-21 | Baseline |
| Chapter 10 — Evidence and Authorization for AI Systems | Why AI systems go through the agency’s existing authorization process rather than an AI-specific one; what evidence an authorizing official needs… | 2026-11-09 | 2026-11-08 | Baseline |
| Appendix A — Requirements Mapping: AI Rules to Identity Controls | A compliance-enabling map, not a compliance claim: the duties in OMB M-25-21 and M-25-22, the NIST AI Risk Management Framework functions and… | 2026-11-09 | 2026-11-08 | Baseline |
| Book 17 — AI Identity Governance | Book 17 of the Federal Modernization Workbook: why AI systems and agents need governed identities and accountable owners, what M-25-21, M-25-22 and… | 2026-11-11 | — | — |
Book 18 — Application Modernization
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — A Portfolio, Not a Rewrite | Why application modernization in a federal agency is a portfolio decision made one application at a time: the scale of the legacy problem from GAO’s… | 2026-11-09 | 2026-10-28 | Baseline |
| Chapter 02 — Triaging the Portfolio | How to give every application in a large federal portfolio a disposition: the six dispositions (retire, retain, rehost, replatform, refactor… | 2026-11-12 | 2026-11-11 | Baseline |
| Chapter 03 — The Target Reference Architecture | The one architecture the refactored and rebuilt applications are built on, with versions and support windows as of October 2026: Java 25 LTS and… | 2026-11-12 | 2026-11-12 | Baseline |
| Chapter 04 — Moving the Data: Db2 and Oracle to PostgreSQL or SQL Server | How to move an application’s data off Db2 and Oracle to PostgreSQL or SQL Server: choosing the target engine, schema conversion (type mapping… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 05 — Generative and Agentic AI in the Architecture | Where generative and agentic AI fits in a modernized application (assistive features, retrieval-augmented generation, code modernization assistance… | 2026-11-09 | 2026-10-28 | Baseline |
| Chapter 06 — Compliance by Design | How a modernized application meets federal compliance by building it into the target architecture and its pipeline: what Circular A-130 asks of the… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 07 — Who Governs the Architecture | Who decides what in an application modernization portfolio: the architecture review board and its decision rights, the approved-technology list… | 2026-11-09 | 2026-11-09 | Baseline |
| Chapter 08 — The Reference Implementation | A small, runnable slice of the book’s target architecture in the repository’s examples/app-modernization folder: a Spring Boot REST service over… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 09 — Mapping the Work to TOGAF and Zachman | How the book’s portfolio method lines up with the two enterprise architecture frameworks agencies most often name: the TOGAF Standard, 10th Edition… | 2026-11-09 | 2026-11-08 | Baseline |
| Chapter 10 — Running the Portfolio in Waves | How to run an application modernization portfolio over years: waves laid on the program’s phases and gates G0 to G5, a pilot wave, factory waves and… | 2026-11-11 | 2026-11-11 | Baseline |
| Appendix A — Identity Remediation Work Packages | The identity remediation factory’s six work packages as copy-paste procedures: owner assignment, permission reduction, secret-to-managed-identity… | 2026-11-12 | 2026-11-11 | Draft |
| Book 18 — Application Modernization | Book 18 of the Federal Modernization Workbook: how an agency with thousands of legacy mission applications decides, one application at a time… | 2026-11-11 | — | — |
Book 19 — Building the Attribute-Driven Migration
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — The HR-to-Entra Middleware | Building the middleware between an HR extract and Microsoft Entra ID’s API-driven inbound provisioning, starting from Microsoft’s own CSV2SCIM sample… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 02 — Graph Clients for the Government Clouds | One Microsoft Graph client pattern for worldwide, GCC, GCC High and DoD, starting from Microsoft’s own Graph SDK snippets for national clouds (pinned… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 03 — Writing a Validation Kit Check | How to add a check to the read-only validation kit, built end to end on a new check, VK-SYNC-02 (soft match and hard match takeover blocking): the… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 04 — Dynamic Rules as Code | Keeping dynamic membership rules in Git as code: one file per group with an owner and membership tests, a parser and offline evaluator for the rule… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 05 — Lifecycle Workflows Custom Extensions | Building the Logic Apps that Lifecycle Workflows custom task extensions call: start from Learn’s Logic App definition (pinned in the repository)… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 06 — Moving Group Policy as Code | Moving Group Policy settings to Intune settings catalog policies as code: read Intune’s Group Policy analytics (Graph beta) into a per-setting move… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 07 — Machine Configuration Packages | Building Azure Machine Configuration content from Learn’s own procedure and Microsoft’s pinned samples, then adding only what a federal pipeline… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 08 — Ansible Beside Arc | Onboarding servers to Azure Arc with Ansible while keeping one owning tool per setting: start from Microsoft’s own azurearc role (pinned in the… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 09 — Drift Pipelines and Evidence to the ISSO | A scheduled GitHub Actions pipeline that signs in with a federated credential and no secret, runs the validation kit read-only, compares each run… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 10 — Deploying to Test and Production | The runbook that takes the Attribute-Driven Migration kits past the chapters’ test-tenant steps: one settings file per stage with no secrets… | 2026-11-12 | 2026-11-12 | Waiting for review |
| Book 19 — Building the Attribute-Driven Migration | Book 19 of the Federal Modernization Workbook: a developer workbook for the Attribute-Driven Migration project, a code-first companion for the… | 2026-11-11 | — | Waiting for review |
Book 20 — Information Protection & Microsoft Purview
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — Data Inventory and Classification | Why protection has to travel with the data, and the decisions that come before any label: the agency’s authoritative data classes and the handling… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 02 — Sensitivity Label Architecture | The reference architecture for information protection, with its trust boundaries and control planes, and the label design built on it: a small… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 03 — Label Publication and Defaults | How the agency publishes its sensitivity labels and sets defaults it can justify: a pilot label policy before the tenant-wide one, a default label… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 04 — Teams, Groups and SharePoint Containers | How container sensitivity labels govern the places content lives: privacy, guest access, external sharing, access from unmanaged devices… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 05 — Rights Management and Recovery | How the agency turns on the encryption service behind every protecting sensitivity label and every encrypted message, and how it keeps the ability to… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 06 — Exchange Message Encryption | How the agency encrypts the mail that leaves it without asking every sender to remember: when to use a sensitivity label and when a mail flow rule… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 07 — SharePoint and OneDrive | How the agency makes labeled and encrypted files work where most of them live: why SharePoint and OneDrive can’t search, scan, co-author or apply DLP… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 08 — DLP and Endpoint Controls | How to design Microsoft Purview Data Loss Prevention from data outcomes rather than from templates: the outcome statement, the surface and the action… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 09 — Auto-Labeling and Sensitive Information Types | How the agency detects sensitive content it never labeled: the classifier ladder from built-in sensitive information types to custom types, exact… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 10 — Audit, Insider Risk and Communication Compliance | The tools that watch activity and behavior around the agency’s data, and the governance they need first: Purview Audit Standard and Premium… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 11 — AI Data Security | How the agency monitors and governs sensitive data in approved and unapproved AI workflows: how Microsoft 365 Copilot honors permissions, sensitivity… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Chapter 12 — Operations and Evidence | Who runs information protection after it is built, and how the agency proves it keeps working: change control for labels, policies and keys with a… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Appendix A — Requirements Mapping: Controls, KSIs and Chapters | A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. | 2026-11-11 | 2026-11-11 | Waiting for review |
| Book 20 — Information Protection & Microsoft Purview | Book 20 of the Federal Modernization Workbook: the data pillar engineered with Microsoft Purview. | 2026-11-11 | — | Waiting for review |
Explainers
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| What a Federal DDI Platform Must Do | Research under review: a narrated, vendor-neutral briefing for CIOs, CISOs, network and DDI leads, and acquisition teams on what federal requirements… | 2026-11-09 | 2026-10-29 | — |
| Who Names the Device After AD? | Research under review: a narrated explainer on device naming and DNS registration after Active Directory retires, the gaps that break things (IPv6… | 2026-11-09 | — | — |
| Federal HR 2.0 Across Agencies and Boundaries: Shared Governance, FedRAMP’s 2026 Rules and What Oracle Publishes | Research under review. | 2026-11-01 | 2026-10-30 | — |
| DNS for HR-Driven Identity Across Clouds | Research under review: a narrated explainer on DNS for HR-driven identity with Oracle Fusion Cloud HCM, Microsoft Entra ID, AWS (including Amazon… | 2026-11-09 | — | — |
| Certificates, Tokens and Keys Across the Hybrid Estate | Research under review: a narrated explainer on how SQL Server token authentication, the cloud key vaults, PIV smart card sign-in and network access… | 2026-11-09 | — | — |
| Keeping Identity Correct After HR Becomes the Source | Research draft: the day-two operating model for HR-driven identity. | 2026-11-07 | — | — |
| Explainers | The Federal Modernization Workbook’s explainers: plain-language accounts of a concept, linked to the books that rely on it. | 2026-11-01 | — | — |
| Governing and Buying AI Under M-25-21 and M-25-22 | Research under review: what OMB M-25-21 and M-25-22 require of a civilian agency beyond the identity obligations covered in Book 17. | 2026-11-01 | 2026-10-30 | — |
Guides
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Ansible for Configuration Automation | Where Ansible fits in a federal modernization program beside Intune, Azure Arc, Azure Policy machine configuration and Configuration Manager, with… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Azure Arc Track: Implementation Guide | The step-by-step implementation of the companion guide’s Azure Arc track: bringing servers on premises and in other clouds under Azure Resource… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Attribute-Driven Migration: An Implementation Guide | A step-by-step guide to the cross-track foundation of the attribute-driven migration from Active Directory to Microsoft Entra ID, in the order the… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Attribute-Driven Migration from Active Directory to Microsoft Entra ID | One end-to-end path for moving a forest to Entra ID on attributes instead of OU placement, in four tracks (people from HR, end-user devices through… | 2026-11-09 | 2026-11-09 | Reviewed |
| Azure Security Engineering | An implementation guide for the security of an agency’s Azure estate: the landing-zone security baseline, a continuous inventory of public exposure… | 2026-11-11 | 2026-11-11 | Waiting for review |
| For the Authorizing Official: Evidence over Attestation | A one-page brief for the authorizing official: every risk the program carries reaches them in writing with an end date, and in return gates are… | 2026-11-09 | 2026-11-07 | Reviewed |
| For the CHCO: HR 2.0 and the Contractor Source | A one-page brief for the chief human capital officer: why Federal HR 2.0 onboarding is the moment to add the identity feed, when that window closes… | 2026-11-09 | 2026-11-07 | Reviewed |
| For the CIO: The Clocks and the Cost | A one-page brief for the CIO: the external dates that land on one estate, why one program can sequence them when separate projects can only race… | 2026-11-09 | 2026-11-07 | Reviewed |
| For the CISO: Leavers and Account Findings | A one-page brief for the CISO: why orphaned accounts come from the wiring and not from carelessness, how that connects to account-management… | 2026-11-09 | 2026-11-07 | Reviewed |
| Charter Sign-Off Sheet | A one-page, fill-in sheet that puts names on the program’s charter roles, the decisions each role holds and the six gates, with the deliberate… | 2026-11-09 | 2026-11-07 | Reviewed |
| Building Book 09’s SD-WAN Design on Cisco Catalyst SD-WAN | Research under review: an implementation guide for building Book 09’s governed branch transport on Cisco Catalyst SD-WAN. | 2026-11-12 | 2026-10-29 | Waiting for review |
| Certificate Lifecycle on CyberArk Certificate Manager | Research under review: a narrated implementation guide for running Book 07’s certificate lifecycle management on CyberArk Certificate Manager… | 2026-11-09 | 2026-11-05 | Reviewed |
| Defender XDR Engineering & Operations: An Implementation Guide | A gated guide for engineering and operating Microsoft Defender XDR on Windows endpoints and servers in a federal tenant: the service architecture… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Distribution Point Consolidation: An Implementation Guide | A step-by-step guide to consolidating Configuration Manager distribution points, from the analysis of the existing estate to the last distribution… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Distribution Point Consolidation: A Decision Guide Before You Fund a Refresh | A decision guide for the CIO, program lead, endpoint lead, ISSO and budget officer at an agency weighing a Configuration Manager distribution point… | 2026-11-09 | 2026-11-08 | Reviewed |
| Effective Meetings — Purpose, Agenda, Roles, and Follow-Through | A practical standard for running program meetings: a real agenda, named roles, a parking lot, and written action items with owners and dates. | 2026-11-09 | 2026-11-07 | Reviewed |
| Global Secure Access & Zero Trust Network Engineering: An Implementation Guide | A gated guide for deploying Microsoft Entra Internet Access and Private Access as the agency’s identity-aware network layer, in twelve steps that… | 2026-11-11 | 2026-11-11 | Waiting for review |
| Building Book 03’s HR Pipeline: Oracle Fusion Cloud HCM to Microsoft Entra ID | Research under review: an implementation guide for building Book 03’s HR-driven provisioning pipeline from Oracle Fusion Cloud HCM to Microsoft Entra… | 2026-11-12 | 2026-11-11 | Waiting for review |
| HR-Driven Identity: An Implementation Guide | A gated guide for running the HR-driven identity lifecycle in Microsoft Entra ID once the HR pipeline exists: who writes each account state and… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Implementing Book 08 on Infoblox NIOS | Research under review: a narrated implementation guide for building Book 08’s DNS, DHCP and IPAM design on Infoblox NIOS: Phase 0 decisions, the Grid… | 2026-11-09 | 2026-11-05 | Reviewed |
| Intune Track Implementation: Attribute-Driven Management of End-User Devices | A step-by-step guide to the Intune track of the attribute-driven migration: the prerequisites (licensing, the GCC tenant, roles and the coverage… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Non-Person Identity: An Implementation Guide | A step-by-step guide to governing service accounts and workload identities in the non-person identity track: inventory AD service accounts, MSAs and… | 2026-11-12 | 2026-11-11 | Waiting for review |
| The One-Page Ask | A one-page, fill-in template for asking leadership to approve the four-week pre-flight: the decision in one sentence, four local numbers, the… | 2026-11-09 | 2026-11-07 | Reviewed |
| Privileged Access: An Implementation Guide | A gated guide for making privileged access just-in-time in Microsoft Entra ID and Azure: inventory every privileged assignment by tier; build and… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Provider Notices: An Implementation Guide | A gated guide for collecting the tenant-specific notices cloud providers send (scheduled maintenance, retirements, health and security advisories… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities | A comparison and migration guide for every kind of service identity, on premises and in the cloud: a user account used as a service, a standalone… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Integrating ServiceNow and SailPoint: An Implementation Example (Pass 1) | Research draft: an illustrative integration kit for ServiceNow and SailPoint Identity Security Cloud, with an ISC workflow that raises identity… | 2026-11-09 | 2026-11-08 | Reviewed |
| Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide | Research draft: a gated implementation guide that builds Book 13’s Ticket-to-Machine loop on ServiceNow (the front door and the record) and SailPoint… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Building an internal Ticket-to-Machine task catalog | A one-page guide to the Ticket-to-Machine task catalog pack: a macro-free Excel workbook, a CSV template, 25 fictional worked examples and a checker… | 2026-11-09 | 2026-11-09 | Reviewed |
| Zero Trust Assessment: An Implementation Guide | An implementation guide for running Microsoft’s Zero Trust Assessment as evidence rather than a verdict: scoping what it is and isn’t, preparing a… | 2026-11-12 | 2026-11-12 | Waiting for review |
Evaluations
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Cloud DNS on AWS, Azure and Oracle Cloud: Native Resolvers, Infoblox and BIND | Research under review: the Route 53 VPC Resolver (endpoints, forwarding and system rules, rule sharing through AWS RAM, DNS Firewall, query logging… | 2026-11-09 | 2026-10-29 | — |
| Evaluations | The Federal Modernization Workbook’s evaluations: products and technology options judged against the books’ requirements, with the evidence for and… | 2026-11-01 | — | — |
| Infoblox DDI for Federal Agencies | Research under review: a narrated technical deep dive on Infoblox NIOS and Universal DDI for federal agencies, with the requirements that drive the… | 2026-11-09 | 2026-10-29 | — |
| Contractors as Oracle Contingent Workers: Choosing the Contractor Source of Truth | Research under review: whether contractors could be recorded as Oracle Fusion Cloud HCM contingent workers so one HR feed drives employees and… | 2026-11-06 | 2026-10-29 | — |
| SD-WAN and SASE Platforms Against Book 09’s Requirements | Research under review: Cisco Catalyst SD-WAN, Palo Alto Prisma SD-WAN and Prisma Access, Fortinet, HPE Aruba EdgeConnect, Arista VeloCloud, Juniper… | 2026-11-08 | 2026-10-29 | — |
| Trinzic Alone, or Trinzic Plus Cloud DDI? | Research under review: a narrated evaluation for architects learning DDI, on whether Infoblox Trinzic appliances can run an agency’s DNS, DHCP and… | 2026-11-09 | 2026-10-29 | — |
Training
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Training | The Federal Modernization Workbook’s training: the Microsoft Automation learning path in four modules, the Ticket-to-Machine and HR-Driven Identity… | 2026-11-12 | — | Waiting for review |
| Infoblox Training and Learning Paths | Research under review: a verified catalog of official Infoblox training resources organized as learning paths for Grid administrators, division… | 2026-11-07 | 2026-11-07 | Reviewed |
| Labs | Every developer workbook lab and learning path exercise in one place. | 2026-11-12 | — | Waiting for review |
| Microsoft Automation, Module 4: Azure Arc through Azure Resource Manager and Resource Graph | Research draft: Module 4 of the Microsoft Automation learning path, for Books 05 and 06. | 2026-11-11 | 2026-11-03 | Waiting for review |
| Microsoft Automation, Module 2: Microsoft Entra ID through Microsoft Graph | Research draft: Module 2 of the Microsoft Automation learning path, for Books 02 and 04. | 2026-11-11 | 2026-11-01 | Waiting for review |
| Microsoft Automation, Module 1: Graph and Azure Foundations | Research draft: Module 1 of the Microsoft Automation learning path. | 2026-11-11 | 2026-11-01 | Waiting for review |
| Microsoft Automation, Module 3: Intune through Microsoft Graph | Research draft: Module 3 of the Microsoft Automation learning path, for Book 05. | 2026-11-11 | 2026-10-30 | Waiting for review |
Learning path: Building the Attribute-Driven Migration
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Attribute-Driven Migration, Module 1: Send HR Records through a Middleware that Fails Closed | Research draft: Module 1 of the Attribute-Driven Migration learning path. | 2026-11-10 | 2026-11-02 | Waiting for review |
| Attribute-Driven Migration, Module 2: Write a Validation Kit Check | Research draft: Module 2 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 3: Keep Dynamic Rules as Code | Research draft: Module 3 of the Attribute-Driven Migration learning path. | 2026-11-10 | — | Waiting for review |
| Attribute-Driven Migration, Module 4: Move Group Policy as Code | Research draft: Module 4 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 5: Build Machine Configuration Packages | Research draft: Module 5 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 6: Onboard Servers with Ansible beside Arc | Research draft: Module 6 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 7: Extend Lifecycle Workflows | Research draft: Module 7 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 8: Run the Drift Pipeline and Hand Over the Evidence | Research draft: Module 8 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Attribute-Driven Migration, Module 9: Deploy to Test, then Production | Research draft: Module 9 of the Attribute-Driven Migration learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Learning path: Building the Attribute-Driven Migration | Research draft: a learning path in nine modules for developers, platform engineers, identity engineers and ISSO reviewers. | 2026-11-07 | 2026-11-07 | Reviewed |
Learning path: HR-Driven Identity in Microsoft Entra ID
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Module 1: Name one writer for every account state | Gate G1 and workbook Chapter 01: keep the lifecycle rows of the writer register as reviewed JSON, check its shape, and scan the directory audit log… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 2: Run contractors from their own source | Gate G2 and workbook Chapter 02: compute each contractor’s earliest end, write the extract the HR middleware turns into SCIM requests, reconcile the… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 3: Make joiners ready on day one | Gate G3 and workbook Chapter 03: keep Lifecycle Workflows definitions as reviewed code, lint them (scope by code, the Temporary Access Pass’s… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 4: Assign access from attributes and review what a move leaves | Gate G4 and workbook Chapter 04: lint access package assignment policies before they reach the tenant (memberOf quarantine, overlapping automatic… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 5: Check certificate-based authentication | Gate G5 and workbook Chapter 05: measure every CRL, and check the certificate-based authentication trust store, each CRL against the cloud’s limit… | 2026-11-10 | — | Waiting for review |
| Module 6: Time separations from the logs | Gate G6 and workbook Chapter 06: measure separation-to-block and separation-to-revocation for every leaver from the audit log, the Lifecycle… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 7: Find lifecycle drift and file the evidence | Gate G7 and workbook Chapter 07: write one read-only run of the six lifecycle drift classes and six metrics from the HR export, the directory, the… | 2026-11-09 | 2026-11-08 | Reviewed |
| Learning path: HR-Driven Identity in Microsoft Entra ID | A learning path in seven modules for identity engineers, developers, HR systems analysts and ISSO reviewers: name one writer for every account state… | 2026-11-08 | 2026-11-08 | Reviewed |
Learning path: Non-Person Identity in Microsoft Entra ID
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Module 1: Inventory every non-person identity | Gate G1 and workbook Chapter 01: read every AD service account, MSA, gMSA, dMSA, app registration, service principal and managed identity into one… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 2: Owners, sponsors and the orphan rule | Gates G1 and G6 and workbook Chapter 02: check every identity in the register for two human owners and an active service record, build the orphan… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 3: Decide each identity’s target | Gate G2 and workbook Chapter 03: turn Book 02’s migration path matrix into a proposed target for every identity, check each owner’s disposition… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 4: Set the credential rules | Gate G3 and workbook Chapter 04: hold the tenant’s app management policy as reviewed JSON (no new secrets, certificates capped at 180 days, the app… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 5: Cut the privilege of service principals | Gate G4 and workbook Chapter 07: sweep every service principal’s application permissions, delegated grants, directory roles and managed identities’… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 6: Conditional Access for workload identities | Gate G4 and workbook Chapter 08: hold CA015 and CA037 as reviewed files, scoped to Tier 1 single-tenant service principals by object ID, ring by… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 7: Convert to managed identities and federation | Gate G5 and workbook Chapter 05: convert legacy credentials in the plan’s order (a managed identity, then a federated credential, then a… | 2026-11-09 | 2026-11-08 | Reviewed |
| Module 8: Convert Kerberos accounts to gMSAs and dMSAs | Gate G5 and workbook Chapter 06: give every Kerberos account a reviewed disposition, plan its move to a gMSA or a Windows Server 2025 dMSA, list what… | 2026-11-09 | — | Waiting for review |
| Module 9: Govern AI agent identities | The guide’s AI agents section and workbook Chapter 09: read agent identities and blueprints with their sponsors, owners and credentials, check them… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 10: Find drift and file the evidence | Gate G6 and workbook Chapter 10: run the register and the ownership check on a schedule, compare them with a baseline a reviewer approved by its… | 2026-11-09 | 2026-11-07 | Reviewed |
| Module 11: Deploy to test, then production | Workbook Chapter 11, the deployment runbook, across every gate: one settings file per stage with no secret, a read-only preflight, a safe order from… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 12: Migrate a service account, from a user account to a gMSA, a dMSA or Microsoft Entra | The companion guide Service Accounts, with the developer workbook’s Chapters 05 and 06: compare the kinds of service identity, choose a target with… | 2026-11-10 | 2026-11-02 | Waiting for review |
| Learning path: Non-Person Identity in Microsoft Entra ID | A learning path in twelve modules for identity engineers, Active Directory engineers, developers, AI governance staff and ISSO reviewers: inventory… | 2026-11-10 | 2026-11-02 | Waiting for review |
Learning path: Privileged Access in Microsoft Entra ID and Azure
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Module 1: Inventory every privileged assignment | Workbook Chapter 01 and the plan’s Phase 0 (A0.1, A0.2, Gate 0): read every Microsoft Entra and Azure privileged assignment, active and eligible… | 2026-11-09 | 2026-11-07 | Reviewed |
| Module 2: Emergency access first | Workbook Chapter 02 and the plan’s A0.4 and A1.1: check each emergency access account against Learn’s standard from code (PA-EA-01 to PA-EA-10)… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 3: Conditional Access for administrators and the activation gate | Workbook Chapter 03 and the plan’s A1.5, A2.3, A2.5 and A2.6: keep the administrator policies, the privileged authentication strength and… | 2026-11-09 | 2026-11-07 | Reviewed |
| Module 4: PIM for Microsoft Entra roles as code | Workbook Chapter 04 and the plan’s A1.6, A2.1, A2.2 and A3.1: hold Book 04, Appendix B’s role settings as one reviewed file per role, check them… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 5: PIM for Groups and the PRV groups | Workbook Chapter 05 and the plan’s A2.1 and A3.3: keep the PRV role-assignable groups as one reviewed file of who may be a member or owner, until… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 6: PIM for Azure resources | Workbook Chapter 06 and the plan’s A3.2: hold PIM for Azure resources as reviewed JSON through Azure Resource Manager, not Graph: role settings by… | 2026-11-09 | 2026-11-07 | Reviewed |
| Module 7: Access reviews of privileged roles | Workbook Chapter 07 and the plan’s A2.7 and A3.7: define every privileged access review series as reviewed JSON (Entra roles, PRV group membership… | 2026-11-09 | 2026-11-07 | Reviewed |
| Module 8: Evidence and drift for the ISSO | Workbook Chapter 08 and the plan’s A3.6, A4.3 and Gate 4: run Module 1’s inventory, Module 2’s emergency access check and a PIM audit read on a… | 2026-11-09 | 2026-11-09 | Reviewed |
| Learning path: Privileged Access in Microsoft Entra ID and Azure | A learning path in eight modules for developers, identity engineers, platform engineers and ISSO reviewers: inventory every privileged assignment… | 2026-11-08 | 2026-11-08 | Reviewed |
Learning path: Provider Notices
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Module 1: Why provider notices go unread | Before the gates: why the notices five providers send about the agency’s own estate land in a portal or one person’s inbox with no owner, the six… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 2: Azure Service Health and alerts | Gate G1 and workbook Chapter 01: read every Service Health event for the subscriptions in scope through Azure Resource Graph with Learn’s own sample… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 3: Microsoft 365 Message center | Gate G2 and workbook Chapter 02: read a tenant’s Message center posts and service health issues through the Microsoft Graph service communications… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 4: Oracle Cloud Infrastructure announcements | Gate G3 and workbook Chapter 03: read every Oracle Cloud Infrastructure announcement for a tenancy, the latest in each chain, with its affected… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 5: AWS Health and the support plan | Gate G4 and workbook Chapter 04: read every open and upcoming AWS Health event for an account, with a customer managed policy of exactly three read… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 6: Google incidents and the maintenance gap | Gate G5 and workbook Chapter 05: read a Google Cloud project’s Personalized Service Health incidents with roles/servicehealth.viewer, and write down… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 7: Routing to owners | Gate G6 and workbook Chapter 06: write and check a routing file of ordered rules, route two weeks of fictional notices from five providers as a dry… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 8: Digest, evidence and go/no-go | Gate G7 and workbook Chapter 07, with the runbook’s promotion criteria: write the weekly digest the owners read (open notices by provider, action… | 2026-11-09 | 2026-11-09 | Reviewed |
| Module 9: Deploying to test and production (optional) | Optional, for whoever deploys the kit: workbook Chapter 08, the deployment runbook, across every gate. | 2026-11-09 | 2026-11-09 | Reviewed |
| Learning path: Provider Notices | A learning path in nine modules for cloud platform leads, Microsoft 365 service owners, developers, service desk and change managers, and ISSO… | 2026-11-09 | 2026-11-09 | Reviewed |
Learning path: Ticket-to-Machine on ServiceNow and SailPoint
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Ticket-to-Machine, Module 1: The Loop and the Typed Task | Research draft: Module 1 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-09 | Reviewed |
| Ticket-to-Machine, Module 2: The Boundary and Least Privilege | Research draft: Module 2 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Ticket-to-Machine, Module 3: One Writer per Attribute | Research draft: Module 3 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-08 | Reviewed |
| Ticket-to-Machine, Module 4: Sources and the Starting Drift | Research draft: Module 4 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Ticket-to-Machine, Module 5: Drift to a Typed Task | Research draft: Module 5 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Ticket-to-Machine, Module 6: Actuation and the Re-read Rule | Research draft: Module 6 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Ticket-to-Machine, Module 7: Evidence for the ISSO | Research draft: Module 7 of the Ticket-to-Machine learning path. | 2026-11-09 | 2026-11-07 | Reviewed |
| Learning path: Ticket-to-Machine on ServiceNow and SailPoint | Research draft: a learning path in seven modules for developers, identity governance engineers, ServiceNow engineers and ISSO reviewers. | 2026-11-09 | 2026-11-07 | Reviewed |
Learning path: The Zero Trust Assessment as Evidence
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Module 1: Evidence, not a verdict | Guide Steps 1 and 6: what Microsoft’s Zero Trust Assessment checks, the four things it isn’t (a verdict, a substitute for ScubaGear, a supported… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Module 2: Running the assessment safely | Guide Steps 2 to 5: a clean host with the pinned version and a protected report folder; consent once, with the sources’ different role lists side by… | 2026-11-12 | — | Waiting for review |
| Module 3: From results to a closure register | Guide Steps 7 and 8: normalize every result to Book 11’s seven results with the kit, work the dispositions for what didn’t run, record the review of… | 2026-11-12 | — | Waiting for review |
| Module 4: Reconcile, re-run and keep the evidence | Guide Steps 9 and 10: compare two runs and tell a fixed finding from one the tool simply didn’t evaluate; reconcile with ScubaGear and, where the… | 2026-11-12 | 2026-11-11 | Waiting for review |
| Learning path: The Zero Trust Assessment as Evidence | A learning path in four modules for assessment operators, pillar owners, the Zero Trust program lead and ISSO reviewers, built from the Zero Trust… | 2026-11-12 | 2026-11-11 | Waiting for review |
Reference
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Command Reference | Every command in the example kits: what it does, the pages that teach it, and how to get its help. | 2026-10-31 | — | — |
| Federal Framework Crosswalk | Research under review: a crosswalk of the Federal Modernization Workbook’s 21 books against federal modernization frameworks: each framework’s… | 2026-11-11 | 2026-10-29 | — |
| Microsoft Practice Crosswalk: Entra, Intune, National Clouds, Arc and SQL | Research draft: a crosswalk from the Entra ID, Intune, national-cloud endpoint, Azure Arc and SQL practices in Books 02, 04, 05, 06, 10 and 15 to the… | 2026-11-09 | 2026-10-25 | — |
| Reference | The Federal Modernization Workbook’s reference pages: the command reference, the federal framework, M-19-17 and FICAM, and Microsoft practice… | 2026-11-11 | — | — |
| Learn Coverage Map | The Federal Modernization Workbook’s map of every Microsoft Learn identity page, on the Windows Server side and the Microsoft Entra side, to the… | 2026-11-12 | — | Waiting for review |
| M-19-17 and FICAM Crosswalk | Research under review: OMB M-19-17’s requirements at section level and the FICAM Architecture’s five service areas, mapped to the Federal… | 2026-11-06 | 2026-11-02 | — |
| RMF Map | Research under review: a map of the seven NIST Risk Management Framework steps and their 47 tasks onto the Federal Modernization Workbook’s books and… | 2026-11-08 | 2026-11-02 | Waiting for review |
| Source Register | The Federal Modernization Workbook’s register of the sources its slides and videos link to, each with a permanent address, a link to the original… | 2026-11-09 | 2026-11-09 | Reviewed |
| Zero Trust Closure Coverage | Research draft: a tracker of the workbook’s Zero Trust Assessment closure update, generated from data/zta-closure/coverage.yml. | 2026-11-12 | 2026-11-11 | — |
Research (moved)
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Research has moved | The Federal Modernization Workbook’s research area has been retired. | 2026-11-02 | — | — |
About
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Archive | The Federal Modernization Workbook’s archive: each edition is a fixed, tagged state of the books, guides and developer workbooks, published as a… | 2026-11-09 | — | — |
| Decision Register | The Federal Modernization Workbook’s decision register: each editorial and design decision since the repository began, with the question, the options… | 2026-11-12 | — | — |
| Reviewers’ Guide | A guide for outside reviewers of the Federal Modernization Workbook: the review gate that holds the developer workbooks, guides and training until… | 2026-11-09 | — | — |
| How This Workbook Knows What It Says | How the Federal Modernization Workbook checks its claims: primary sources only, an endnote for every external fact, a claims log per chapter with a… | 2026-11-08 | — | — |
Inspiration
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Inspiration | The sixteen operating principles the U.S. | 2026-10-31 | — | — |
Presentations
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Presentations | Download the PowerPoint decks for the Federal Modernization Workbook books: each book’s 15-minute Why / What / Who / How briefing, its narrated… | 2026-11-10 | — | — |
| Videos | The Federal Modernization Workbook’s video library: every narrated presentation, executive briefing, technical deep dive and research deck, playable… | 2026-11-06 | — | — |
Project Plans
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Attribute-Driven Migration: The Cross-Track Attribute Foundation | A sample PMP-style project plan for the cross-track foundation of the Attribute-Driven Migration companion guide and its two technical deep-dive… | 2026-11-09 | — | — |
| Content Delivery Modernization: Distribution Point Consolidation | A sample PMP-style project plan for the Content Delivery Modernization project, built from the Distribution Point Consolidation decision and… | 2026-11-09 | — | — |
| Continuous Monitoring & Evidence Fabric: Evidence From the Systems | A sample PMP-style project plan for the Continuous Monitoring & Evidence Fabric project, built from Book 13, Chapter 12: a work breakdown by project… | 2026-11-09 | — | — |
| Data Platform Identity Transformation: SQL Server from Windows Authentication to Entra ID | A sample PMP-style project plan for the Data Platform Identity Transformation project, built from Book 06 and its runbooks: a work breakdown by… | 2026-11-07 | — | — |
| Endpoint & Device Modernization: Group Policy to Intune and Azure Arc | A sample PMP-style project plan for the Endpoint & Device Modernization project, built from Book 05, Chapters 04 to 10: a work breakdown from… | 2026-11-09 | — | — |
| Identity Lifecycle & Provisioning: HR-Driven Identity | A sample PMP-style project plan for the Identity Lifecycle & Provisioning project, built from Book 03, Chapter 12: a work breakdown by Book 03 phase… | 2026-11-09 | — | — |
| Projects | Sample PMP-style project plans for the Federal Modernization Program: the program’s integrated master schedule and one plan per complementary… | 2026-11-08 | — | — |
| Network & Access Modernization: Naming Plane, Governed Transport and Edge Enforcement | A sample PMP-style project plan for the Network & Access Modernization project, built from Books 08 and 09: a work breakdown by project phase, a… | 2026-11-08 | — | — |
| Non-Person Identity Modernization: Service Accounts, Workload Identities and AI Agents | A sample PMP-style project plan for the Non-Person Identity Modernization project, built from Book 02, Chapters 09 and 10, Book 04, Chapter 05, Book… | 2026-11-09 | — | — |
| Privileged Access & Administrative Identity: Just-in-Time by Tier | A sample PMP-style project plan for the Privileged Access & Administrative Identity project, built from Book 04, Chapters 04 to 10 and Appendix B: a… | 2026-11-09 | — | — |
| Program Master Schedule: Phases 0 to 5 and Gates G0 to G5 | A sample PMP-style integrated master schedule for the Federal Modernization Program, built from Book 00, Chapters 05 and 09 and Book 01, Chapter 12… | 2026-11-09 | — | — |
| Supply Chain & Software Bill of Materials: From Inventory to Proof | A sample PMP-style project plan for the Supply Chain & Software Bill of Materials project, built from Book 14, Chapter 07: a work breakdown by the… | 2026-11-09 | — | — |
Developer Workbooks
| Page | What it does | Last updated | Last verified | Status |
|---|---|---|---|---|
| Chapter 01 — The Writer Register as Code | Keep the lifecycle rows of the writer register as reviewed JSON, one writer and a backstop for every account-state transition and HR-mastered value… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 02 — Contractor Sources and Enforced End Dates | Run contractors from a source other than HR with an end date that can’t be left open: compute each contractor’s earliest end from the contract, the… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 03 — Joiner Workflows as Code and the Temporary Access Pass Bridge | Keep the Lifecycle Workflows definitions as reviewed v1.0 request bodies, lint them against Learn’s limits and the program’s rules (scope by code… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 04 — Access from Attributes and the Mover’s Residual Review | Keep access package assignment policies as reviewed v1.0 bodies and lint them before they reach the tenant (the memberOf rules quarantined from… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 05 — Certificate-Based Authentication Checks | Check the certificate-based authentication configuration behind PIV and CAC sign-in as code, starting from Learn’s CRL page and the PKI trust store… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 06 — Separation Timing from the Logs | Measure every separation from the logs as code, starting from Learn’s audit activity list, the Lifecycle Workflows user processing results and the… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 07 — Lifecycle Drift, Metrics and Evidence | Find the six lifecycle drift classes (missing identity, stale access, orphan account, unauthorized write, credential drift and contractor credential… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 08 — Deploying to a Test Tenant, Then to Production | The runbook that takes the kit from each chapter’s non-production step to a live test environment (an Oracle HCM test pod with synthetic workers and… | 2026-11-09 | 2026-11-09 | Reviewed |
| Building HR-Driven Identity | A developer workbook for the Identity Lifecycle & Provisioning project and the HR-driven identity implementation guide: a code-first companion for… | 2026-11-09 | 2026-11-07 | Reviewed |
| Developer Workbooks | Developer workbooks for the Federal Modernization Program’s projects. | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 01 — Non-Person Identity Inventory as Code | Read every non-person identity into one register as code, starting from Learn’s own commands for finding service accounts and service principals and… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 02 — Ownership and the Orphan Rule | Check every identity in Chapter 01’s register against the program’s ownership rule as code, starting from Learn’s own Graph samples for finding… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 03 — The Migration Path Matrix as Code | Turn Book 02’s migration path matrix into reviewed data and code, starting from Learn’s own decision tables for choosing an on-premises service… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 04 — App Management Policies and Certificate Rotation | Hold the tenant’s app management policy as reviewed JSON and rotate app registration certificates through Key Vault as code, starting from… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 05 — Workload Identity Federation and Managed Identities | Convert non-person identities wave by wave in the plan’s order (managed identity, then federated credential, then certificate), starting from Learn’s… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 06 — gMSAs, dMSAs and the Kerberos Island | Move the Kerberos-only workloads in Chapter 01’s register as reviewed code, starting from Learn’s own gMSA, dMSA and KDS root key procedures (pinned… | 2026-11-09 | 2026-11-09 | Waiting for review |
| Chapter 07 — Least Privilege for Service Principals | Sweep every service principal in Chapter 01’s register for its application permissions, delegated grants, directory roles and, for managed… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 08 — Conditional Access for Workload Identities | Hold Conditional Access for workload identities as reviewed data and code, starting from Learn’s own Graph JSON sample for a workload identity policy… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 09 — AI Agent Identities | Govern AI agent identities as code, starting from Learn’s own Microsoft Entra Agent ID samples (pinned in the repository) for creating a blueprint… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 10 — Drift and Evidence for the ISSO | Run Chapter 01’s register and Chapter 02’s ownership check on a schedule, compare the register with the last approved baseline by fingerprint, and… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 11 — Deploying to Test and Production | A deployment runbook that takes the kit from the non-production environment of each chapter’s second lab to a live test environment (an Entra test… | 2026-11-09 | 2026-11-09 | Reviewed |
| Building Non-Person Identity | A developer workbook for the Non-Person Identity Modernization project: a code-first companion for the developers who build its register of service… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 01 — Privileged Inventory as Code | Read every privileged assignment in the estate as code, starting from Learn’s own samples for listing Microsoft Entra role assignments (pinned in the… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 02 — Emergency Access Accounts as Code | Check the emergency access accounts against Learn’s standard as code, and write the alert on their use as a reviewed ARM template, starting from… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 03 — Conditional Access for Administrators and the Activation Gate | Hold the Conditional Access policies for administrators as reviewed JSON, starting from Microsoft’s own template for administrators as Graph returns… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 04 — PIM for Microsoft Entra Roles as Code | Hold PIM role settings for Microsoft Entra roles as one reviewed JSON file per role, starting from Learn’s own samples for updating PIM rules and… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 05 — PIM for Groups and the PRV Groups | Hold the PRV role-assignable groups, their PIM for Groups member and owner schedules and their two role management policies as reviewed JSON… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 06 — PIM for Azure Resources | Hold PIM for Azure resources as reviewed code through the Resource Manager API, starting from Learn’s REST walkthroughs and Microsoft’s own request… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 07 — Access Reviews of Privileged Roles | Hold the access reviews of privileged roles as reviewed JSON and apply them through Microsoft Graph and Resource Manager, starting from Learn’s own… | 2026-11-10 | 2026-11-10 | Waiting for review |
| Chapter 08 — Evidence and Drift for the ISSO | Run the privileged inventory and the emergency access check on a schedule with the PIM activation and audit evidence, compare each run with the last… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 09 — Deploying to Test and Production | A runbook that takes the kit from the labs to a live test tenant and subscription, then to production, with the same commands and one settings file… | 2026-11-09 | 2026-11-09 | Reviewed |
| Building Privileged Access | A developer workbook for the Privileged Access & Administrative Identity project: a code-first companion for the developers who build its inventory… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 01 — The Notice Record and Azure Service Health | The one record every provider’s notice becomes, and the first collector that fills it: Azure Service Health read through Azure Resource Graph with… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 02 — Microsoft 365 Message Center and Service Health | Microsoft 365’s Message center posts and service health issues read through the Microsoft Graph service communications API, on the tenant’s own Graph… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 03 — Oracle Cloud Infrastructure Announcements | Oracle Cloud Infrastructure announcements read with Oracle’s own CLI and the one policy statement Oracle documents for reading them: the latest… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 04 — AWS Health | AWS Health events read through the AWS Health API with a customer managed policy holding three read actions (AWS publishes no read-only managed… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 05 — Google Cloud Personalized Service Health | Google Cloud’s Personalized Service Health read for a project (or an organization) with the viewer role Google documents: every event an incident… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 06 — Routing to Owners and Ticket-to-Machine Tasks | Turning notices into work: a routing file the agency writes at work, checked before it runs; rules tried in order, first match wins; a… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 07 — The Weekly Digest and Evidence | What the owners read and what the ISSO keeps: a weekly digest in five sections (open notices by provider and kind, action required soonest first with… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 08 — Deploying to Test and Production | A deployment runbook that takes the provider notices kit from the labs to a live test environment, then to production, with the same commands and one… | 2026-11-09 | 2026-11-09 | Reviewed |
| Building Provider Notices | A developer workbook for the provider notices implementation guide: a code-first companion for the developers who build the software that collects… | 2026-11-10 | 2026-11-09 | Reviewed |
| Chapter 01 — The Loop and the Typed Task | Where the kit sits in Book 13’s five-step loop, and the one record every step writes or reads: the typed identity finding. | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 02 — The ServiceNow Client and Least Privilege | The ServiceNow half of the kit’s shared client: OAuth client-credentials tokens at oauthtoken.do, Table API paging, the Attachment API and retries on… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 03 — The SailPoint Client and Its Scopes | The SailPoint half of the kit’s shared client: ISC tokens by client credentials or a personal access token, Search with searchAfter paging, the… | 2026-11-09 | 2026-11-09 | Reviewed |
| Chapter 04 — Drift to a Typed Task | Build 1 of the kit: SailPoint event triggers start ISC workflows whose HTTP Request step posts a typed identity finding to the ServiceNow Scripted… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 05 — The Re-read Rule | Build 2 of the kit and its answer to Gap 1: a ServiceNow business rule turns any close into Awaiting verification, and a client re-reads the account… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 06 — Drift Reconciliation | Build 3 of the kit: a read-only client joins the HR extract, Microsoft Graph and SailPoint ISC on employeeId and reports Book 03’s drift classes with… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 07 — Evidence Records for Book 13 and the ISSO | The ServiceNow half of Pass 2’s evidence export: read closed and cancelled identity findings and write one record per finding in Book 13’s evidence… | 2026-11-09 | 2026-11-07 | Reviewed |
| Chapter 08 — One Writer per Attribute | Gap 4 of the Ticket-to-Machine example and an item planned for the kit’s Pass 2: if Entra inbound provisioning from HR and SailPoint’s Entra source… | 2026-11-09 | 2026-11-03 | Reviewed |
| Chapter 09 — Deploying to Test and Production | The deployment runbook: take the kit from a developer instance to a ServiceNow sub-production instance and a SailPoint sandbox tenant, then to the… | 2026-11-09 | 2026-11-09 | Reviewed |
| Building Ticket-to-Machine | A developer workbook for the Ticket-to-Machine loop on ServiceNow and SailPoint Identity Security Cloud: a code-first companion for the developers… | 2026-11-09 | 2026-11-07 | Reviewed |
Decks and videos
Start series
| Deck and video | What it does | Length | Last updated | Files |
|---|---|---|---|---|
| Start series, Episode 1 — Start Here: Where Modernization Begins | Narrated tour of Start Here. | 7 min | 2026-11-11 | Video · Deck |
| Start series, Episode 2 — The First Four Weeks | Narrated tour of Start Here. | 7 min | 2026-11-08 | Video · Deck |
| Start series, Episode 3 — Foundation to Gate G1 | Narrated tour of Start Here. | 6 min | 2026-11-09 | Video · Deck |
| Start series, Episode 4 — Making the Case at Your Agency | Narrated tour of Start Here. | 6 min | 2026-11-08 | Video · Deck |
Book decks
| Deck and video | What it does | Length | Last updated | Files |
|---|---|---|---|---|
| Attribute-Driven Migration to Entra ID — deeper dive implementation, Part 1: reading the tree to flowing attributes | Narrated tour of Attribute-Driven Migration: An Implementation Guide. | 15 min | 2026-11-09 | Video · Deck |
| Attribute-Driven Migration to Entra ID — deeper dive implementation, Part 2: groups, targeting and moving Group Policy | Narrated tour of Attribute-Driven Migration: An Implementation Guide. | 17 min | 2026-11-09 | Video · Deck |
| Attribute-Driven Migration to Entra ID — deeper dive implementation, Part 3: proving it, cutting over and keeping it true | Narrated tour of Attribute-Driven Migration from Active Directory to Microsoft Entra ID. | 16 min | 2026-11-09 | Video · Deck |
| Attribute-Driven Migration to Entra ID — technical deep dive, Part 1: the model and the HR track | Narrated tour of Attribute-Driven Migration from Active Directory to Microsoft Entra ID. | 18 min | 2026-11-09 | Video · Deck |
| Attribute-Driven Migration to Entra ID — technical deep dive, Part 2: devices, servers, non-person identities, and running it | Narrated tour of Attribute-Driven Migration from Active Directory to Microsoft Entra ID. | 19 min | 2026-11-09 | Video · Deck |
| Book 00 — Orientation & Program: executive briefing | Narrated tour of Book 00 — Orientation & Program. | 25 min | 2026-11-09 | Video · Deck |
| Book 00 — Orientation & Program: presentation | Narrated tour of Book 00 — Orientation & Program. | 13 min | 2026-11-09 | Video · Deck |
| Book 01 — The Transformation Arc: executive briefing | Narrated tour of Book 01 — The Transformation Arc. | 26 min | 2026-11-09 | Video · Deck |
| Book 01 — The Transformation Arc: presentation | Narrated tour of Book 01 — The Transformation Arc. | 15 min | 2026-11-06 | Video · Deck |
| Book 02 — Identity & Directory: executive briefing | Narrated tour of Book 02 — Identity & Directory. | 16 min | 2026-11-06 | Video · Deck |
| Book 02 — Identity & Directory: presentation | Narrated tour of Book 02 — Identity & Directory. | 12 min | 2026-11-06 | Video · Deck |
| Book 02 — Identity & Directory: technical deep dive | Narrated tour of Book 02 — Identity & Directory. | 24 min | 2026-11-06 | Video · Deck |
| Book 03 — External Partner Identity: executive briefing | Narrated tour of Chapter 15 — External Partner Identity. | 11 min | 2026-11-08 | Video · Deck |
| Book 03 — External Partner Identity: technical deep dive | Narrated tour of Chapter 15 — External Partner Identity. | 16 min | 2026-11-08 | Video · Deck |
| Book 03 — HR-Driven Identity: executive briefing | Narrated tour of Book 03 — HR-Driven Identity. | 16 min | 2026-11-06 | Video · Deck |
| Book 03 — HR-Driven Identity: presentation | Narrated tour of Book 03 — HR-Driven Identity. | 12 min | 2026-11-06 | Video · Deck |
| Book 03 — HR-Driven Identity: technical deep dive | Narrated tour of Book 03 — HR-Driven Identity. | 22 min | 2026-11-06 | Video · Deck |
| Book 04 — Access & Privilege: executive briefing | Narrated tour of Book 04 — Access & Privilege. | 16 min | 2026-11-08 | Video · Deck |
| Book 04 — Access & Privilege: presentation | Narrated tour of Book 04 — Access & Privilege. | 9 min | 2026-11-06 | Video · Deck |
| Book 04 — Access & Privilege: technical deep dive | Narrated tour of Book 04 — Access & Privilege. | 23 min | 2026-11-09 | Video · Deck |
| Book 05 — Devices & Endpoints: executive briefing | Narrated tour of Book 05 — Devices & Endpoints. | 17 min | 2026-11-09 | Video · Deck |
| Book 05 — Devices & Endpoints: presentation | Narrated tour of Book 05 — Devices & Endpoints. | 12 min | 2026-11-09 | Video · Deck |
| Book 05 — Devices & Endpoints: technical deep dive | Narrated tour of Book 05 — Devices & Endpoints. | 27 min | 2026-11-09 | Video · Deck |
| Book 06 — Data Platform: SQL Server Identity: executive briefing | Narrated tour of Book 06 — Data Platform: SQL Server Identity. | 16 min | 2026-11-09 | Video · Deck |
| Book 06 — Data Platform: SQL Server Identity: presentation | Narrated tour of Book 06 — Data Platform: SQL Server Identity. | 11 min | 2026-11-06 | Video · Deck |
| Book 06 — Data Platform: SQL Server Identity: technical deep dive | Narrated tour of Book 06 — Data Platform: SQL Server Identity. | 23 min | 2026-11-09 | Video · Deck |
| Book 07 — PKI & Certificates: executive briefing | Narrated tour of Book 07 — PKI & Certificates. | 14 min | 2026-11-09 | Video · Deck |
| Book 07 — PKI & Certificates: presentation | Narrated tour of Book 07 — PKI & Certificates. | 13 min | 2026-11-09 | Video · Deck |
| Book 07 — PKI & Certificates: technical deep dive | Narrated tour of Book 07 — PKI & Certificates. | 25 min | 2026-11-09 | Video · Deck |
| Book 08 — DNS, DHCP & IPAM: executive briefing | Narrated tour of Book 08 — DNS, DHCP & IPAM. | 15 min | 2026-11-06 | Video · Deck |
| Book 08 — DNS, DHCP & IPAM: presentation | Narrated tour of Book 08 — DNS, DHCP & IPAM. | 14 min | 2026-11-06 | Video · Deck |
| Book 08 — DNS, DHCP & IPAM: technical deep dive | Narrated tour of Book 08 — DNS, DHCP & IPAM. | 24 min | 2026-11-06 | Video · Deck |
| Book 09 — Network & Transport: executive briefing | Narrated tour of Book 09 — Network & Transport. | 23 min | 2026-11-09 | Video · Deck |
| Book 09 — Network & Transport: presentation | Narrated tour of Book 09 — Network & Transport. | 14 min | 2026-11-09 | Video · Deck |
| Book 09 — Network & Transport: technical deep dive | Narrated tour of Book 09 — Network & Transport. | 21 min | 2026-11-09 | Video · Deck |
| Book 09 — SD-WAN: technical deep dive | Narrated tour of Book 09 — Network & Transport. | 20 min | 2026-11-09 | Video · Deck |
| Book 09 — The Field-Office WAN Case: SD-WAN for Executives | Narrated tour of Chapter 11 — Field Office WAN Transformation. | 8 min | 2026-11-06 | Video · Deck |
| Book 10 — Cloud Boundary & Landing Zone: executive briefing | Narrated tour of Book 10 — Cloud Boundary & Landing Zone. | 22 min | 2026-11-09 | Video · Deck |
| Book 10 — Cloud Boundary & Landing Zone: presentation | Narrated tour of Book 10 — Cloud Boundary & Landing Zone. | 14 min | 2026-11-09 | Video · Deck |
| Book 10 — Cloud Boundary & Landing Zone: technical deep dive | Narrated tour of Book 10 — Cloud Boundary & Landing Zone. | 20 min | 2026-11-09 | Video · Deck |
| Book 11 — Zero Trust & Assessment: executive briefing | Narrated tour of Book 11 — Zero Trust & Assessment. | 23 min | 2026-11-06 | Video · Deck |
| Book 11 — Zero Trust & Assessment: presentation | Narrated tour of Book 11 — Zero Trust & Assessment. | 14 min | 2026-11-06 | Video · Deck |
| Book 11 — Zero Trust & Assessment: technical deep dive | Narrated tour of Book 11 — Zero Trust & Assessment. | 20 min | 2026-11-09 | Video · Deck |
| Book 12 — Security Operations & Telemetry: executive briefing | Narrated tour of Book 12 — Security Operations & Telemetry. | 15 min | 2026-11-09 | Video · Deck |
| Book 12 — Security Operations & Telemetry: presentation | Narrated tour of Book 12 — Security Operations & Telemetry. | 14 min | 2026-11-06 | Video · Deck |
| Book 12 — Security Operations & Telemetry: technical deep dive | Narrated tour of Book 12 — Security Operations & Telemetry. | 19 min | 2026-11-09 | Video · Deck |
| Book 13 — Governance, Drift & Evidence: executive briefing | Narrated tour of Book 13 — Governance, Drift & Evidence. | 15 min | 2026-11-06 | Video · Deck |
| Book 13 — Governance, Drift & Evidence: presentation | Narrated tour of Book 13 — Governance, Drift & Evidence. | 14 min | 2026-11-09 | Video · Deck |
| Book 13 — Governance, Drift & Evidence: technical deep dive | Narrated tour of Book 13 — Governance, Drift & Evidence. | 20 min | 2026-11-09 | Video · Deck |
| Book 13 — Ticket-to-Machine Reference: narrated reference deck | Narrated tour of Appendix B — Ticket-to-Machine Reference. | 11 min | 2026-11-06 | Video · Deck |
| Book 14 — Federal Compliance & Authorization: executive briefing | Narrated tour of Book 14 — Federal Compliance & Authorization. | 16 min | 2026-11-09 | Video · Deck |
| Book 14 — Federal Compliance & Authorization: presentation | Narrated tour of Book 14 — Federal Compliance & Authorization. | 12 min | 2026-11-09 | Video · Deck |
| Book 15 — Building Day-Two Automation In-House: an Executive Briefing | Narrated tour of Chapter 13 — Building Day-Two Automation In-House. | 9 min | 2026-11-06 | Video · Deck |
| Book 15 — Compliance Automation & Day-2 Operations: executive briefing | Narrated tour of Book 15 — Compliance Automation & Day-2 Operations. | 14 min | 2026-11-06 | Video · Deck |
| Book 15 — Compliance Automation & Day-2 Operations: presentation | Narrated tour of Book 15 — Compliance Automation & Day-2 Operations. | 12 min | 2026-11-06 | Video · Deck |
| Book 15 — Compliance Automation & Day-2 Operations: technical deep dive | Narrated tour of Book 15 — Compliance Automation & Day-2 Operations. | 20 min | 2026-11-06 | Video · Deck |
| Book 16 — People: Training & Education: executive briefing | Narrated tour of Book 16 — People: Training & Education. | 15 min | 2026-11-06 | Video · Deck |
| Book 16 — People: Training & Education: presentation | Narrated tour of Book 16 — People: Training & Education. | 13 min | 2026-11-08 | Video · Deck |
| Book 17 — AI Identity Governance: executive briefing | Narrated tour of Book 17 — AI Identity Governance. | 15 min | 2026-11-09 | Video · Deck |
| Book 17 — AI Identity Governance: presentation | Narrated tour of Book 17 — AI Identity Governance. | 13 min | 2026-11-06 | Video · Deck |
| Book 17 — AI Identity Governance: technical deep dive | Narrated tour of Book 17 — AI Identity Governance. | 21 min | 2026-11-09 | Video · Deck |
| Book 18 — Application Modernization: executive briefing | Narrated tour of Book 18 — Application Modernization. | 14 min | 2026-11-09 | Video · Deck |
| Book 18 — Application Modernization: presentation | Narrated tour of Book 18 — Application Modernization. | 10 min | 2026-11-09 | Video · Deck |
| Book 18 — Application Modernization: technical deep dive | Narrated tour of Book 18 — Application Modernization. | 21 min | 2026-11-09 | Video · Deck |
| Building Ticket-to-Machine — One Drift Case, End to End: narrated story deck | Narrated tour of Building Ticket-to-Machine. | 21 min | 2026-11-06 | Video · Deck |
| Companion guide — Ansible for Configuration Automation: technical deep dive | Narrated tour of Ansible for Configuration Automation. | 19 min | 2026-11-09 | Video · Deck |
| Companion guide — Effective Meetings: narrated deck | Narrated tour of Effective Meetings — Purpose, Agenda, Roles, and Follow-Through. | 14 min | 2026-11-06 | Video · Deck |
| Companion guide — Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities | Narrated tour of Service Accounts: From User Accounts to gMSAs to Microsoft Entra Workload Identities. | 16 min | 2026-11-10 | Video |
| Content Delivery Modernization (DP Consolidation): executive decision deck | Narrated tour of Chapter 11 — Field Office WAN Transformation. | 11 min | 2026-11-08 | Video · Deck |
| HR-Driven Identity — implementation, Part 1: writers, sources and joiners | Narrated tour of HR-Driven Identity: An Implementation Guide. | 16 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity — implementation, Part 2: access, credentials, separation and drift | Narrated tour of HR-Driven Identity: An Implementation Guide. | 16 min | 2026-11-06 | Video · Deck |
| Non-Person Identity — implementation, Part 1: inventory, decisions and credential rules | Narrated tour of Non-Person Identity: An Implementation Guide. | 17 min | 2026-11-10 | Video · Deck |
| Non-Person Identity — implementation, Part 2: privilege, conversion and lifecycle | Narrated tour of Non-Person Identity: An Implementation Guide. | 16 min | 2026-11-09 | Video · Deck |
| The Reference Tab: presentation | Narrated tour of Reference. | 10 min | 2026-11-09 | Video · Deck |
| Ticket-to-Machine on ServiceNow and SailPoint — implementation, Part 1: boundary, writers, sources and the front door | Narrated tour of Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide. | 16 min | 2026-11-09 | Video · Deck |
| Ticket-to-Machine on ServiceNow and SailPoint — implementation, Part 2: actuation, re-read, tempo and evidence | Narrated tour of Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide. | 15 min | 2026-11-06 | Video · Deck |
Developer workbook tours
Training modules
| Deck and video | What it does | Length | Last updated | Files |
|---|---|---|---|---|
| Attribute-Driven Migration learning path, Module 1: Send HR records through a middleware that fails closed | Narrated tour of Attribute-Driven Migration, Module 1: Send HR Records through a Middleware that Fails Closed. | 14 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 2: Write a validation kit check | Narrated tour of Attribute-Driven Migration, Module 2: Write a Validation Kit Check. | 13 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 3: Keep dynamic rules as code | Narrated tour of Attribute-Driven Migration, Module 3: Keep Dynamic Rules as Code. | 14 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 4: Move Group Policy as code | Narrated tour of Attribute-Driven Migration, Module 4: Move Group Policy as Code. | 15 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 5: Build machine configuration packages | Narrated tour of Attribute-Driven Migration, Module 5: Build Machine Configuration Packages. | 15 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 6: Onboard servers with Ansible beside Arc | Narrated tour of Attribute-Driven Migration, Module 6: Onboard Servers with Ansible beside Arc. | 16 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 7: Extend Lifecycle Workflows | Narrated tour of Attribute-Driven Migration, Module 7: Extend Lifecycle Workflows. | 14 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 8: Run the drift pipeline and hand over the evidence | Narrated tour of Attribute-Driven Migration, Module 8: Run the Drift Pipeline and Hand Over the Evidence. | 15 min | 2026-11-06 | Video · Deck |
| Attribute-Driven Migration learning path, Module 9: Deploy to test, then production | Narrated tour of Attribute-Driven Migration, Module 9: Deploy to Test, then Production. | 14 min | 2026-11-06 | Video · Deck |
| HR-Driven Identity learning path, Module 1: Name one writer for every account state | Narrated tour of Module 1: Name one writer for every account state. | 13 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity learning path, Module 2: Run contractors from their own source | Narrated tour of Module 2: Run contractors from their own source. | 13 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity learning path, Module 3: Make joiners ready on day one | Narrated tour of Module 3: Make joiners ready on day one. | 13 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity learning path, Module 4: Assign access from attributes and review what a move leaves | Narrated tour of Module 4: Assign access from attributes and review what a move leaves. | 13 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity learning path, Module 5: Check certificate-based authentication | Narrated tour of Module 5: Check certificate-based authentication. | 13 min | 2026-11-09 | Video · Deck |
| HR-Driven Identity learning path, Module 6: Time separations from the logs | Narrated tour of Module 6: Time separations from the logs. | 13 min | 2026-11-06 | Video · Deck |
| HR-Driven Identity learning path, Module 7: Find lifecycle drift and file the evidence | Narrated tour of Module 7: Find lifecycle drift and file the evidence. | 14 min | 2026-11-09 | Video · Deck |
| Microsoft Automation learning path, Module 1: Graph and Azure Foundations | Narrated tour of Microsoft Automation, Module 1: Graph and Azure Foundations. | 15 min | 2026-11-06 | Video · Deck |
| Microsoft Automation learning path, Module 2: Microsoft Entra ID through Microsoft Graph | Narrated tour of Microsoft Automation, Module 2: Microsoft Entra ID through Microsoft Graph. | 13 min | 2026-11-06 | Video · Deck |
| Microsoft Automation learning path, Module 3: Intune through Microsoft Graph | Narrated tour of Microsoft Automation, Module 3: Intune through Microsoft Graph. | 14 min | 2026-11-06 | Video · Deck |
| Non-Person Identity learning path, Module 10: Find drift and file the evidence | Narrated tour of Module 10: Find drift and file the evidence. | 16 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 11: Deploy to test, then production | Narrated tour of Module 11: Deploy to test, then production. | 14 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 1: Inventory every non-person identity | Narrated tour of Module 1: Inventory every non-person identity. | 14 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 2: Owners, sponsors and the orphan rule | Narrated tour of Module 2: Owners, sponsors and the orphan rule. | 14 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 3: Decide each identity’s target | Narrated tour of Module 3: Decide each identity’s target. | 14 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 4: Set the credential rules | Narrated tour of Module 4: Set the credential rules. | 14 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 5: Cut the privilege of service principals | Narrated tour of Module 5: Cut the privilege of service principals. | 15 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 6: Conditional Access for workload identities | Narrated tour of Module 6: Conditional Access for workload identities. | 15 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 7: Convert to managed identities and federation | Narrated tour of Module 7: Convert to managed identities and federation. | 15 min | 2026-11-09 | Video · Deck |
| Non-Person Identity learning path, Module 8: Convert Kerberos accounts to gMSAs and dMSAs | Narrated tour of Module 8: Convert Kerberos accounts to gMSAs and dMSAs. | 16 min | 2026-11-10 | Video · Deck |
| Non-Person Identity learning path, Module 9: Govern AI agent identities | Narrated tour of Module 9: Govern AI agent identities. | 15 min | 2026-11-09 | Video · Deck |
| Privileged Access learning path, Module 1: Inventory every privileged assignment | Narrated tour of Module 1: Inventory every privileged assignment. | 14 min | 2026-11-06 | Video · Deck |
| Privileged Access learning path, Module 2: Emergency access first | Narrated tour of Module 2: Emergency access first. | 13 min | 2026-11-09 | Video · Deck |
| Privileged Access learning path, Module 3: Conditional Access for administrators and the activation gate | Narrated tour of Module 3: Conditional Access for administrators and the activation gate. | 14 min | 2026-11-06 | Video · Deck |
| Privileged Access learning path, Module 4: PIM for Microsoft Entra roles as code | Narrated tour of Module 4: PIM for Microsoft Entra roles as code. | 15 min | 2026-11-09 | Video · Deck |
| Privileged Access learning path, Module 5: PIM for Groups and the PRV groups | Narrated tour of Module 5: PIM for Groups and the PRV groups. | 15 min | 2026-11-09 | Video · Deck |
| Privileged Access learning path, Module 6: PIM for Azure resources | Narrated tour of Module 6: PIM for Azure resources. | 13 min | 2026-11-06 | Video · Deck |
| Privileged Access learning path, Module 7: Access reviews of privileged roles | Narrated tour of Module 7: Access reviews of privileged roles. | 13 min | 2026-11-06 | Video · Deck |
| Privileged Access learning path, Module 8: Evidence and drift for the ISSO | Narrated tour of Module 8: Evidence and drift for the ISSO. | 16 min | 2026-11-09 | Video · Deck |
| Ticket-to-Machine learning path, Module 1: The Loop and the Typed Task | Narrated tour of Ticket-to-Machine, Module 1: The Loop and the Typed Task. | 14 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine learning path, Module 2: The Boundary and Least Privilege | Narrated tour of Ticket-to-Machine, Module 2: The Boundary and Least Privilege. | 13 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine learning path, Module 3: One Writer per Attribute | Narrated tour of Ticket-to-Machine, Module 3: One Writer per Attribute. | 14 min | 2026-11-09 | Video · Deck |
| Ticket-to-Machine learning path, Module 4: Sources and the Starting Drift | Narrated tour of Ticket-to-Machine, Module 4: Sources and the Starting Drift. | 14 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine learning path, Module 5: Drift to a Typed Task | Narrated tour of Ticket-to-Machine, Module 5: Drift to a Typed Task. | 14 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine learning path, Module 6: Actuation and the Re-read Rule | Narrated tour of Ticket-to-Machine, Module 6: Actuation and the Re-read Rule. | 14 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine learning path, Module 7: Evidence for the ISSO | Narrated tour of Ticket-to-Machine, Module 7: Evidence for the ISSO. | 14 min | 2026-11-06 | Video · Deck |
Research
| Deck and video | What it does | Length | Last updated | Files |
|---|---|---|---|---|
| Book 08 — DNS, DHCP & IPAM: what a federal DDI platform must do | Narrated tour of What a Federal DDI Platform Must Do. | 14 min | 2026-11-09 | Video · Deck |
| Book 09’s SD-WAN Design on Cisco Catalyst SD-WAN: narrated research deck | Narrated tour of Building Book 09’s SD-WAN Design on Cisco Catalyst SD-WAN. | 17 min | 2026-11-06 | Video · Deck |
| Research: Certificate Lifecycle on CyberArk Certificate Manager — implementation guide | Narrated tour of Certificate Lifecycle on CyberArk Certificate Manager. | 20 min | 2026-11-06 | Video · Deck |
| Research: Certificates, Tokens and Keys Across the Hybrid Estate — explainer | Narrated tour of Certificates, Tokens and Keys Across the Hybrid Estate. | 11 min | 2026-11-06 | Video · Deck |
| Research: Cloud DNS, Part 1 — The Native Resolvers | Narrated tour of Cloud DNS on AWS, Azure and Oracle Cloud: Native Resolvers, Infoblox and BIND. | 17 min | 2026-11-06 | Video · Deck |
| Research: Cloud DNS, Part 2 — BIND and the Federal Fit | Narrated tour of Cloud DNS on AWS, Azure and Oracle Cloud: Native Resolvers, Infoblox and BIND. | 17 min | 2026-11-09 | Video · Deck |
| Research: DNS for HR-Driven Identity Across Clouds — explainer | Narrated tour of DNS for HR-Driven Identity Across Clouds. | 10 min | 2026-11-06 | Video · Deck |
| Research: Implementing Book 08 on Infoblox NIOS — implementation guide | Narrated tour of Implementing Book 08 on Infoblox NIOS. | 22 min | 2026-11-06 | Video · Deck |
| Research: Infoblox DDI for Federal Agencies — technical deep dive | Narrated tour of Infoblox DDI for Federal Agencies. | 27 min | 2026-11-07 | Video · Deck |
| Research: Trinzic Alone, or Trinzic Plus Cloud DDI? — explainer | Narrated tour of Trinzic Alone, or Trinzic Plus Cloud DDI?. | 9 min | 2026-11-06 | Video · Deck |
| Research: Who Names the Device After AD? — explainer | Narrated tour of Who Names the Device After AD?. | 11 min | 2026-11-06 | Video · Deck |
| Ticket-to-Machine on ServiceNow and SailPoint: narrated research deck | Narrated tour of Ticket-to-Machine on ServiceNow and SailPoint: An Example Implementation Guide. | 10 min | 2026-11-09 | Video · Deck |
Interviews
| Deck and video | What it does | Length | Last updated | Files |
|---|---|---|---|---|
| HR-Driven Identity: interview talk, detailed deck | Narrated tour of Book 03 — HR-Driven Identity. | 16 min | 2026-11-06 | Video · Deck |
| HR-Driven Identity: interview talk, executive cut | Narrated tour of Book 03 — HR-Driven Identity. | 12 min | 2026-11-06 | Video · Deck |
| HR-Driven Identity: who is authoritative for a contractor | Narrated tour of Book 03 — HR-Driven Identity. | 10 min | 2026-11-06 | Video · Deck |
Kits
| Kit | What it does | Last updated | Status |
|---|---|---|---|
| Ansible examples: CMDB-driven inventory, assessment, Arc onboarding and drift | The inventory is inventory/cmdbinventory.py, a dynamic inventory script that reads a CSV export from the CMDB (CMDBCSV, or the fictional… | 2026-11-09 | Illustrative |
| Application modernization: reference implementation | Checked against Maven Central, the npm registry and Docker Hub on October 28, 2026. | 2026-11-08 | Illustrative |
| Cisco Catalyst SD-WAN: read-only ED 26-03 gate and evidence collector | One Python script, python/sdwanevidence.py, signs in to Catalyst SD-WAN Manager, makes only GET requests, and writes two files: | 2026-11-01 | Illustrative |
| Copilot agent pack: Day-Two Automation Builder | This pack turns Microsoft 365 Copilot into a drafting and review assistant for the method in Book 15, Chapter 13 — Building Day-Two Automation… | 2026-10-28 | Illustrative |
| Distribution point consolidation kit | Every run writes manifest.json: the task, the mode, the time, and for every file its SHA-256 and the NIST SP 800-53 controls and FedRAMP 20x KSIs it… | 2026-11-08 | Illustrative |
| Drift pipeline: compare validation kit runs and package evidence for the ISSO | A scheduled pipeline runs the validation kit read-only, compares each run with the last, opens findings for what’s new or changed, and hands the ISSO… | 2026-11-09 | Illustrative |
| Dynamic rules as code | A library of dynamic membership rules kept in Git, with a parser and an offline evaluator for the rule grammar Learn documents, a linter, membership… | 2026-11-01 | — |
| Group Policy as code | Moving Group Policy settings to Intune settings catalog policies from reviewed JSON in Git: a move plan read from Intune’s Group Policy analytics, a… | 2026-11-02 | — |
| Oracle Fusion Cloud HCM to Microsoft Entra ID: extract-to-SCIM converter and validator | Microsoft publishes a PowerShell sample for this integration, CSV2SCIM, documented on Learn in API-driven inbound provisioning with PowerShell script. | 2026-11-09 | Illustrative |
| HR lifecycle: the code behind Building HR-Driven Identity | The tools the HR-driven identity implementation guide’s gates need that the rest of examples/ doesn’t already give. | 2026-11-09 | Illustrative |
| Lifecycle Workflows custom task extensions | One reusable Logic App per integration, called by Microsoft Entra ID Governance Lifecycle Workflows through a custom task extension, with its own… | 2026-11-01 | — |
| Machine configuration packages: a checked build | A build for Azure Machine Configuration content that runs Learn’s own GuestConfiguration cmdlets and checks what they produce before anything is… | 2026-11-01 | — |
| Microsoft automation reference: Graph and Resource Manager clients, Entra ID, Intune and Azure Arc checks | Equivalent Python and PowerShell implementations of five read-only Entra ID checks, each tied to the ScubaGear policy it evidences: | 2026-11-11 | Illustrative |
| Non-person identity as code | Code for the developer workbook Building Non-Person Identity, the code-first companion to the Non-Person Identity Modernization project plan. | 2026-11-09 | — |
| Privileged access as code | Read-only code for the developer workbook Building Privileged Access, the code-first companion to the Privileged Access & Administrative Identity… | 2026-11-09 | — |
| Provider notices as code | Cloud providers send each tenant, account, tenancy or project its own notices: scheduled maintenance, retirements, health and security advisories… | 2026-11-09 | — |
| ServiceNow + SailPoint ISC integration kit (Pass 1: identity) | If the agency has no identity-governance product and no funding for one, Book 15, Chapter 13 — Building Day-Two Automation In-House describes how… | 2026-11-09 | Illustrative |
| Start Kit: read-only estate assessment | One run produces a one-page summary (Summary/StartKitSummary.md) with these counts, each traced to the file it came from. | 2026-11-01 | Illustrative |
| Ticket-to-Machine task catalog pack | A workbook for listing your agency’s day-to-day Ticket-to-Machine tasks: one row per task, with its lane, its trigger, its drift class and severity… | 2026-11-09 | Illustrative |
| Validation kit: read-only checks for the track implementation guides | Each check is one function named after its ID: VK-HR-01 is Invoke-VkHr01 and VK-INT-04 is Invoke-VkInt04. | 2026-11-01 | Illustrative |
| Zero Trust Assessment results as evidence | Microsoft’s Zero Trust Assessment writes its results to a JSON file in the report folder: /zt-export/ZeroTrustAssessmentReport.json. | 2026-11-12 | — |