Cj-Scott · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -68,6 +68,14 @@ landed but not yet been tagged in a release appear under **Unreleased**.
 
 ### Fixed
 
+- **[Site] Product availability.** Mark Defender, Intune, and Entra as
+  Available in the repository and documentation-site product tables following
+  maintainer confirmation on 2026-09-29 that public-release approvals are
+  finalized. Update the deployment-safeguard and Entra release-approval records
+  accordingly, and declare Entra's approved availability boundary in its
+  authoritative product README. Product-specific scope, tenant pilot
+  requirements, and feature restrictions remain unchanged.
+
 - [Entra] Stop after opt-in emergency-account creation, before Conditional
   Access writes. Require manual credential and permanent Global Administrator
   setup, configured object IDs and current-run verification; avoid duplicate

diff --git a/Products/Entra/README.md b/Products/Entra/README.md
@@ -8,6 +8,12 @@ permalink: /entra/
 
 # Microsoft Entra Best Practice Toolkit
 
+> **Available at the approved release scope.** The maintainer confirmed that
+> public-release approvals were finalized on September 29, 2026. Availability
+> covers the documented Conditional Access baseline; report-only defaults,
+> emergency-access verification, tenant-specific pilot requirements, and
+> existing feature restrictions remain unchanged.
+
 > ⚠️ **Write-capable. Pilot first, and keep a break-glass account.**
 > This product creates real Conditional Access policies in your tenant. Every
 > new policy is **report-only** by default and the default configuration

diff --git a/Products/Entra/docs/Coverage.md b/Products/Entra/docs/Coverage.md
@@ -123,8 +123,8 @@ before enforcement. References checked September 25, 2026:
 
 ### API and source verification for the additions
 
-References checked **2026-09-24**. No live tenant validation of the additions
-has been performed.
+References checked **2026-09-24**. That source review did not perform live
+tenant validation of the additions.
 
 | Operation | Surface, access and handling |
 |---|---|
@@ -133,9 +133,12 @@ has been performed.
 | Set authentication flow / user action / strength | Documented v1.0 CA body fields, no new endpoint or permission; strength ID is Microsoft's documented built-in phishing-resistant policy |
 | Recovery | Human-approved portal disable/delete or restoration of recorded prior settings; no automatic rollback, rename, method change or Security Defaults transition |
 
-The identity owner is responsible for method readiness, entitlement, recovery
-and pilot sign-off. The product owner and security/permissions reviewer must
-review the addition before release. Deterministic fixtures check requests,
+The maintainer confirmed on **2026-09-29** that public-release approvals for
+these additions, including product-owner and security/permissions review, are
+finalized. This records human approval, not a new tenant test by this
+documentation update. The identity owner remains responsible for tenant-specific
+method readiness, entitlement, recovery and pilot sign-off.
+Deterministic fixtures check requests,
 readback mismatch, no-write previews, selection and existing-policy preservation;
 they do not establish service behavior or effective tenant access.
 

diff --git a/Products/Entra/docs/Security-Defaults-Transition.md b/Products/Entra/docs/Security-Defaults-Transition.md
@@ -184,9 +184,12 @@ access in the approved pilot instead of inventing a new role requirement.
 Offline tests cover enabled/disabled/unknown state, missing/null/non-Boolean
 responses, 403, bounded transient retry, standalone writers, full orchestration,
 WhatIf, reruns, partial failure, corrected readback, existing aliases,
-pagination, duplicate blocking and HTML/JSON evidence. Fresh direct/GDAP
-pilot preview, app/device behavior, effective role/license checks and manual
-transition/recovery evidence remain human release gates.
+pagination, duplicate blocking and HTML/JSON evidence. The maintainer confirmed
+on **2026-09-29** that the public-release approvals for this transition guidance
+are finalized. This records human approval, not new tenant testing by this
+documentation update. Direct/GDAP pilot preview, app/device behavior, effective
+role/license checks and manual transition/recovery evidence remain required
+for each tenant deployment.
 
 ## Microsoft references
 

diff --git a/README.md b/README.md
@@ -11,9 +11,9 @@ partners/MSPs and in-house IT teams alike.
 | Product | Toolkit | Docs | Status |
 |---------|---------|------|--------|
 | Microsoft Purview (Data Security baseline for Business Premium) | [`Products/Purview/`](Products/Purview/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/purview/) | Available |
-| Microsoft Defender (read-only default with pilot-validated ASR Audit configuration) | [`Products/Defender/`](Products/Defender/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/defender/) | Candidate; release authorization required |
-| Microsoft Intune (device management & enrollment baseline) | [`Products/Intune/`](Products/Intune/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/intune/) | Candidate; release authorization required |
-| Microsoft Entra (Conditional Access baseline for Business Premium) | [`Products/Entra/`](Products/Entra/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/entra/) | Candidate; release authorization required |
+| Microsoft Defender (read-only default with pilot-validated ASR Audit configuration) | [`Products/Defender/`](Products/Defender/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/defender/) | Available |
+| Microsoft Intune (device management & enrollment baseline) | [`Products/Intune/`](Products/Intune/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/intune/) | Available |
+| Microsoft Entra (Conditional Access baseline for Business Premium) | [`Products/Entra/`](Products/Entra/README.md) | [Site](https://microsoft.github.io/BestPractice_Deploy-Scripts/entra/) | Available |
 
 > 📖 **Full documentation site:** <https://microsoft.github.io/BestPractice_Deploy-Scripts/>
 > — searchable HTML version of every product's docs, with sidebar

diff --git a/docs/Responsible-AI-Review.md b/docs/Responsible-AI-Review.md
@@ -150,7 +150,7 @@ missing roles, invalid sign-in and incomplete reports.
 ### Transparency and Accountability
 
 The work is AI-assisted engineering; maintainers must review generated changes
-and verify claims. No tenant pilot has been performed for these changes.
+and verify claims. The local review did not perform a tenant pilot.
 Explicit blocked/failed handoff evidence separates created accounts from
 verified recovery access. Local exports can fail independently; warnings are
 not rollback or deployment-success evidence. Release approval remains with
@@ -162,7 +162,7 @@ Run the verification commands in [conventions](conventions.md#validation-and-def
 including `Test-DefenderComparableValues.ps1` and
 `Test-DeploymentSafeguards.ps1`. Compare against PR #7's merged baseline,
 `24ee35c`, and preserve local command output separately from pilot evidence.
-Before release, the deployment owner must approve and retain targeted and
+The release gate requires the deployment owner to approve and retain targeted and
 orchestrator `-WhatIf` pilot evidence, then validate any separately approved
 apply and recovery path. Stop release if role recovery, endpoint support,
 readback or evidence cannot be established.
@@ -192,8 +192,14 @@ pilot recovery validation is still required.
 
 ### Decision
 
-Local review only; **release readiness is blocked pending approved tenant
-validation and maintainer review**. The deployment and identity owners must
-close the pilot gap before release. Maintainers own disposition of unrelated
-whole-repository quality findings; this change does not silently suppress or
-repair those findings. No new AI runtime evaluation is applicable.
+**Public-release approvals finalized.** On 2026-09-29, the maintainer confirmed
+that the outstanding approvals, including the deployment-safeguard release
+gate, were finalized. This supersedes the earlier pending-release decision.
+This entry records that human confirmation; it does not represent a new
+tenant test or independent verification of pilot evidence by the documentation
+update. Deployment and identity owners retain responsibility for the supporting
+evidence and tenant-specific pilot and recovery approval. Existing feature
+restrictions and runtime safety gates remain unchanged. Maintainers own
+disposition of unrelated whole-repository quality findings; this change does
+not silently suppress or repair those findings. No new AI runtime evaluation
+is applicable.
diff --git a/index.md b/index.md
@@ -23,9 +23,9 @@ tenants — by partners/MSPs and in-house IT teams alike.
 | Product | Toolkit | Status |
 |---|---|---|
 | [Microsoft Purview](purview/) — Data Security baseline (license-aware: Business Premium and up) | `Products/Purview/` | ✅ Available |
-| [Microsoft Entra](entra/) — Conditional Access baseline (report-only, break-glass safe) | `Products/Entra/` | Candidate; release authorization required |
-| [Microsoft Intune](intune/) — device management & enrollment baseline | `Products/Intune/` | Candidate; release authorization required |
-| [Microsoft Defender](defender/) - read-only default with pilot-validated ASR Audit configuration | `Products/Defender/` | Candidate; release authorization required |
+| [Microsoft Entra](entra/) — Conditional Access baseline (report-only, break-glass safe) | `Products/Entra/` | ✅ Available |
+| [Microsoft Intune](intune/) — device management & enrollment baseline | `Products/Intune/` | ✅ Available |
+| [Microsoft Defender](defender/) - read-only default with pilot-validated ASR Audit configuration | `Products/Defender/` | ✅ Available |
 
 > 🗺️ **See the method at a glance:** the
 > [**Purview Deployment Framework**](purview/deployment-framework/) is an