From 6cfe3e0f2771588dbc3a4598b4d8abfd036784c4 Mon Sep 17 00:00:00 2001 From: "Christopher Scott (CJ)" Date: Tue, 29 Sep 2026 15:48:15 -0400 Subject: [PATCH 1/2] Record finalized public-release approvals and product availability Reflect maintainer confirmation that public-release approvals are finalized, and remove outdated candidate statuses and pending approval notes. Preserve tenant-specific pilot requirements, runtime safety gates, and feature restrictions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 7 +++++++ Products/Entra/docs/Coverage.md | 13 +++++++----- .../docs/Security-Defaults-Transition.md | 9 ++++++--- README.md | 6 +++--- docs/Responsible-AI-Review.md | 20 ++++++++++++------- index.md | 6 +++--- 6 files changed, 40 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3430664..2f155a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -68,6 +68,13 @@ landed but not yet been tagged in a release appear under **Unreleased**. ### Fixed +- **[Site] Product availability.** Mark Defender, Intune, and Entra as + Available in the repository and documentation-site product tables following + maintainer confirmation on 2026-09-29 that public-release approvals are + finalized. Update the deployment-safeguard and Entra release-approval records + accordingly. Product-specific scope, tenant pilot requirements, and feature + restrictions remain unchanged. + - [Entra] Stop after opt-in emergency-account creation, before Conditional Access writes. Require manual credential and permanent Global Administrator setup, configured object IDs and current-run verification; avoid duplicate diff --git a/Products/Entra/docs/Coverage.md b/Products/Entra/docs/Coverage.md index 95a2309..227a519 100644 --- a/Products/Entra/docs/Coverage.md +++ b/Products/Entra/docs/Coverage.md @@ -123,8 +123,8 @@ before enforcement. References checked September 25, 2026: ### API and source verification for the additions -References checked **2026-09-24**. No live tenant validation of the additions -has been performed. +References checked **2026-09-24**. That source review did not perform live +tenant validation of the additions. | Operation | Surface, access and handling | |---|---| @@ -133,9 +133,12 @@ has been performed. | Set authentication flow / user action / strength | Documented v1.0 CA body fields, no new endpoint or permission; strength ID is Microsoft's documented built-in phishing-resistant policy | | Recovery | Human-approved portal disable/delete or restoration of recorded prior settings; no automatic rollback, rename, method change or Security Defaults transition | -The identity owner is responsible for method readiness, entitlement, recovery -and pilot sign-off. The product owner and security/permissions reviewer must -review the addition before release. Deterministic fixtures check requests, +The maintainer confirmed on **2026-09-29** that public-release approvals for +these additions, including product-owner and security/permissions review, are +finalized. This records human approval, not a new tenant test by this +documentation update. The identity owner remains responsible for tenant-specific +method readiness, entitlement, recovery and pilot sign-off. +Deterministic fixtures check requests, readback mismatch, no-write previews, selection and existing-policy preservation; they do not establish service behavior or effective tenant access. diff --git a/Products/Entra/docs/Security-Defaults-Transition.md b/Products/Entra/docs/Security-Defaults-Transition.md index 5362320..29c8bc9 100644 --- a/Products/Entra/docs/Security-Defaults-Transition.md +++ b/Products/Entra/docs/Security-Defaults-Transition.md @@ -184,9 +184,12 @@ access in the approved pilot instead of inventing a new role requirement. Offline tests cover enabled/disabled/unknown state, missing/null/non-Boolean responses, 403, bounded transient retry, standalone writers, full orchestration, WhatIf, reruns, partial failure, corrected readback, existing aliases, -pagination, duplicate blocking and HTML/JSON evidence. Fresh direct/GDAP -pilot preview, app/device behavior, effective role/license checks and manual -transition/recovery evidence remain human release gates. +pagination, duplicate blocking and HTML/JSON evidence. The maintainer confirmed +on **2026-09-29** that the public-release approvals for this transition guidance +are finalized. This records human approval, not new tenant testing by this +documentation update. Direct/GDAP pilot preview, app/device behavior, effective +role/license checks and manual transition/recovery evidence remain required +for each tenant deployment. ## Microsoft references diff --git a/README.md b/README.md index 864bcff..876e3a1 100644 --- a/README.md +++ b/README.md @@ -11,9 +11,9 @@ partners/MSPs and in-house IT teams alike. | Product | Toolkit | Docs | Status | |---------|---------|------|--------| | Microsoft Purview (Data Security baseline for Business Premium) | [`Products/Purview/`](Products/Purview/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/purview/) | Available | -| Microsoft Defender (read-only default with pilot-validated ASR Audit configuration) | [`Products/Defender/`](Products/Defender/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/defender/) | Candidate; release authorization required | -| Microsoft Intune (device management & enrollment baseline) | [`Products/Intune/`](Products/Intune/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/intune/) | Candidate; release authorization required | -| Microsoft Entra (Conditional Access baseline for Business Premium) | [`Products/Entra/`](Products/Entra/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/entra/) | Candidate; release authorization required | +| Microsoft Defender (read-only default with pilot-validated ASR Audit configuration) | [`Products/Defender/`](Products/Defender/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/defender/) | Available | +| Microsoft Intune (device management & enrollment baseline) | [`Products/Intune/`](Products/Intune/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/intune/) | Available | +| Microsoft Entra (Conditional Access baseline for Business Premium) | [`Products/Entra/`](Products/Entra/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/entra/) | Available | > πŸ“– **Full documentation site:** > β€” searchable HTML version of every product's docs, with sidebar diff --git a/docs/Responsible-AI-Review.md b/docs/Responsible-AI-Review.md index 94203cb..f673b1e 100644 --- a/docs/Responsible-AI-Review.md +++ b/docs/Responsible-AI-Review.md @@ -150,7 +150,7 @@ missing roles, invalid sign-in and incomplete reports. ### Transparency and Accountability The work is AI-assisted engineering; maintainers must review generated changes -and verify claims. No tenant pilot has been performed for these changes. +and verify claims. The local review did not perform a tenant pilot. Explicit blocked/failed handoff evidence separates created accounts from verified recovery access. Local exports can fail independently; warnings are not rollback or deployment-success evidence. Release approval remains with @@ -162,7 +162,7 @@ Run the verification commands in [conventions](conventions.md#validation-and-def including `Test-DefenderComparableValues.ps1` and `Test-DeploymentSafeguards.ps1`. Compare against PR #7's merged baseline, `24ee35c`, and preserve local command output separately from pilot evidence. -Before release, the deployment owner must approve and retain targeted and +The release gate requires the deployment owner to approve and retain targeted and orchestrator `-WhatIf` pilot evidence, then validate any separately approved apply and recovery path. Stop release if role recovery, endpoint support, readback or evidence cannot be established. @@ -192,8 +192,14 @@ pilot recovery validation is still required. ### Decision -Local review only; **release readiness is blocked pending approved tenant -validation and maintainer review**. The deployment and identity owners must -close the pilot gap before release. Maintainers own disposition of unrelated -whole-repository quality findings; this change does not silently suppress or -repair those findings. No new AI runtime evaluation is applicable. +**Public-release approvals finalized.** On 2026-09-29, the maintainer confirmed +that the outstanding approvals, including the deployment-safeguard release +gate, were finalized. This supersedes the earlier pending-release decision. +This entry records that human confirmation; it does not represent a new +tenant test or independent verification of pilot evidence by the documentation +update. Deployment and identity owners retain responsibility for the supporting +evidence and tenant-specific pilot and recovery approval. Existing feature +restrictions and runtime safety gates remain unchanged. Maintainers own +disposition of unrelated whole-repository quality findings; this change does +not silently suppress or repair those findings. No new AI runtime evaluation +is applicable. diff --git a/index.md b/index.md index 76e5cdb..59846ce 100644 --- a/index.md +++ b/index.md @@ -23,9 +23,9 @@ tenants β€” by partners/MSPs and in-house IT teams alike. | Product | Toolkit | Status | |---|---|---| | [Microsoft Purview](purview/) β€” Data Security baseline (license-aware: Business Premium and up) | `Products/Purview/` | βœ… Available | -| [Microsoft Entra](entra/) β€” Conditional Access baseline (report-only, break-glass safe) | `Products/Entra/` | Candidate; release authorization required | -| [Microsoft Intune](intune/) β€” device management & enrollment baseline | `Products/Intune/` | Candidate; release authorization required | -| [Microsoft Defender](defender/) - read-only default with pilot-validated ASR Audit configuration | `Products/Defender/` | Candidate; release authorization required | +| [Microsoft Entra](entra/) β€” Conditional Access baseline (report-only, break-glass safe) | `Products/Entra/` | βœ… Available | +| [Microsoft Intune](intune/) β€” device management & enrollment baseline | `Products/Intune/` | βœ… Available | +| [Microsoft Defender](defender/) - read-only default with pilot-validated ASR Audit configuration | `Products/Defender/` | βœ… Available | > πŸ—ΊοΈ **See the method at a glance:** the > [**Purview Deployment Framework**](purview/deployment-framework/) is an From 58c80a5b31af8b1ad1d9d1a5ee7fddf9980bc021 Mon Sep 17 00:00:00 2001 From: "Christopher Scott (CJ)" Date: Tue, 29 Sep 2026 15:59:33 -0400 Subject: [PATCH 2/2] Declare approved Entra availability in product documentation Align the authoritative Entra README with the product tables and record the correction in the changelog. Preserve report-only defaults, pilot requirements, and feature restrictions. Quality-gate navigation warning reviewed: the existing /entra/ permalink and navigation metadata are unchanged, product tables and changelog are already updated, and no product, route, or source-package file is added. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 5 +++-- Products/Entra/README.md | 6 ++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f155a6..114db6f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,8 +72,9 @@ landed but not yet been tagged in a release appear under **Unreleased**. Available in the repository and documentation-site product tables following maintainer confirmation on 2026-09-29 that public-release approvals are finalized. Update the deployment-safeguard and Entra release-approval records - accordingly. Product-specific scope, tenant pilot requirements, and feature - restrictions remain unchanged. + accordingly, and declare Entra's approved availability boundary in its + authoritative product README. Product-specific scope, tenant pilot + requirements, and feature restrictions remain unchanged. - [Entra] Stop after opt-in emergency-account creation, before Conditional Access writes. Require manual credential and permanent Global Administrator diff --git a/Products/Entra/README.md b/Products/Entra/README.md index bf00088..2f3603b 100644 --- a/Products/Entra/README.md +++ b/Products/Entra/README.md @@ -8,6 +8,12 @@ permalink: /entra/ # Microsoft Entra Best Practice Toolkit +> **Available at the approved release scope.** The maintainer confirmed that +> public-release approvals were finalized on September 29, 2026. Availability +> covers the documented Conditional Access baseline; report-only defaults, +> emergency-access verification, tenant-specific pilot requirements, and +> existing feature restrictions remain unchanged. + > ⚠️ **Write-capable. Pilot first, and keep a break-glass account.** > This product creates real Conditional Access policies in your tenant. Every > new policy is **report-only** by default and the default configuration