{
  "documentation/24a22e59a644": {
    "title": "Project Evidence",
    "description": "Retained technical documentation: Project Evidence",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Project Evidence</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Project Evidence</h2>\n<p>This folder holds reviewer-facing evidence for portfolio projects such as the home lab, Microsoft 365 lab, PowerShell automation, identity and access administration, endpoint management, infrastructure networking, monitoring, backup/recovery, and troubleshooting work.</p>\n<h2>Project Documentation Pattern</h2>\n<p>Each project artifact should identify:</p>\n<ul>\n<li><strong>Objective:</strong> what operational requirement, support workflow, or infrastructure scenario the file addresses.</li>\n<li><strong>Technical areas covered:</strong> Windows administration, Microsoft 365, Active Directory fundamentals, PowerShell, DNS/DHCP, VLANs, pfSense, Proxmox, backup/recovery, monitoring, ticket triage, RCA, validation, or documentation.</li>\n<li><strong>Implementation or workflow:</strong> the steps performed, configuration logic, troubleshooting path, change sequence, or runbook procedure.</li>\n<li><strong>Validation or verification:</strong> how syntax, connectivity, service health, restore integrity, documentation quality, or rollback readiness is checked.</li>\n<li><strong>Associated proof:</strong> the diagram, script, log, checklist, runbook, CSV, JSON, or report that supports the summary.</li>\n</ul>\n<p>The project evidence library is preservation-first. Canonical proof should be selected carefully, while archive and generated variants remain traceable until reviewed.</p>\n<p>Future project evidence should be copied in small reviewed batches and validated after each batch.</p></article>",
    "active": "Projects"
  },
  "documentation/12f53dc6fb6c": {
    "title": "Backup/Restore Validation Workflow 2026",
    "description": "Retained technical documentation: Backup/Restore Validation Workflow 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Backup/Restore Validation Workflow 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/backup-disaster-recovery/backup-restore-validation-workflow-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Backup/Restore Validation Workflow 2026</h2>\n<p>Status: Sanitized operational workflow\nScope: Home lab backup and restore validation planning\nEvidence type: Runbook and validation guidance</p>\n<h2>Purpose</h2>\n<p>This workflow documents how backup and restore validation should be performed and recorded in the lab. It does not claim a restore test has already been completed. Completed validation must be recorded separately with actual evidence, dates, systems, and outcomes.</p>\n<h2>Objective</h2>\n<p>Define a repeatable recovery validation process that confirms whether a backup can be located, restored to a safe target, checked for integrity, and documented without risking active systems.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Backup and recovery planning.</li>\n<li>Non-destructive restore testing.</li>\n<li>Windows and Linux file/service verification concepts.</li>\n<li>Virtualized lab recovery using isolated targets.</li>\n<li>Rollback planning and change documentation.</li>\n<li>Evidence capture, reviewer notes, and operational handoff.</li>\n</ul>\n<h2>Implementation Workflow</h2>\n<ol>\n<li>Identify the protected system, dataset, or configuration.</li>\n<li>Confirm backup schedule, retention, and latest successful job status.</li>\n<li>Select a safe restore target, such as an isolated folder, test VM, or disconnected lab system.</li>\n<li>Record backup identifier, restore target, reviewer, date, and expected result.</li>\n<li>Perform the restore only within the approved test boundary.</li>\n<li>Validate restored files, services, or configuration state.</li>\n<li>Record limitations, errors, screenshots, logs, hashes, or command output only when actually collected.</li>\n<li>Update the runbook if the process exposed missing prerequisites or unclear rollback steps.</li>\n</ol>\n<h2>Backup Verification Methodology</h2>\n<p>Backup verification should confirm that backups exist, are recent enough for the recovery objective, and can be used for restore testing without damaging active systems.</p>\n<p>Recommended checks:</p>\n<ul>\n<li>Confirm backup schedule and last successful run.</li>\n<li>Confirm backup target and retention policy.</li>\n<li>Confirm protected systems or datasets.</li>\n<li>Confirm error logs or warning status.</li>\n<li>Confirm storage capacity and media health.</li>\n<li>Confirm backup integrity check if supported by the tool.</li>\n</ul>\n<h2>Restoration Validation Concepts</h2>\n<p>A restore is not proven until the restored data or system is usable. For lab validation, use a non-destructive target whenever possible.</p>\n<p>Validation steps:</p>\n<ol>\n<li>Select a safe restore target.</li>\n<li>Record source backup identifier.</li>\n<li>Restore to an isolated test location or VM.</li>\n<li>Confirm files, services, or configurations are present.</li>\n<li>Confirm restored data can be opened or used.</li>\n<li>Compare expected and restored content.</li>\n<li>Record limitations and any failed items.</li>\n</ol>\n<h2>Recovery Checkpoints</h2>\n<p>Before restore testing:</p>\n<ul>\n<li>Confirm test scope.</li>\n<li>Confirm rollback path.</li>\n<li>Confirm no live system overwrite risk.</li>\n<li>Confirm storage capacity.</li>\n<li>Confirm credentials and access rights.</li>\n<li>Notify affected stakeholders if applicable in a real environment.</li>\n</ul>\n<p>After restore testing:</p>\n<ul>\n<li>Record outcome.</li>\n<li>Record time required.</li>\n<li>Record evidence location.</li>\n<li>Document issues and remediation.</li>\n<li>Update the runbook if the process was unclear.</li>\n</ul>\n<h2>Operational Documentation Expectations</h2>\n<p>Each backup or restore validation record should include:</p>\n<ul>\n<li>Date and reviewer.</li>\n<li>System or dataset.</li>\n<li>Backup tool or method.</li>\n<li>Backup identifier.</li>\n<li>Restore target.</li>\n<li>Validation commands or steps.</li>\n<li>Evidence collected.</li>\n<li>Result status.</li>\n<li>Follow-up actions.</li>\n</ul>\n<h2>Evidence Capture Recommendations</h2>\n<p>Acceptable evidence:</p>\n<ul>\n<li>Actual backup job status screenshot.</li>\n<li>Actual restore test notes.</li>\n<li>Actual command output.</li>\n<li>Actual file comparison result.</li>\n<li>Actual system health check after restore.</li>\n<li>Actual logs from the backup or restore tool.</li>\n</ul>\n<p>Do not create fabricated restore results. If validation has not been performed, mark the item as planned and describe the exact evidence still required.</p>\n<h2>Rollback Concepts</h2>\n<p>Rollback planning should protect live systems from accidental overwrite or configuration drift.</p>\n<ul>\n<li>Use isolated restore locations.</li>\n<li>Snapshot test systems before risky validation.</li>\n<li>Keep original backup configuration unchanged during review.</li>\n<li>Document how to return to the pre-test state.</li>\n<li>Stop testing if restore behavior could impact active services.</li>\n</ul>\n<h2>Integrity Validation Guidance</h2>\n<p>Integrity checks should be appropriate to the artifact:</p>\n<ul>\n<li>File restore: compare file size, hash, and open/read behavior.</li>\n<li>VM restore: confirm boot, login, service status, and logs.</li>\n<li>Configuration restore: compare settings before applying to live systems.</li>\n<li>Database or application restore: use application-level validation where available.</li>\n</ul>\n<h2>Associated Proof to Collect</h2>\n<ul>\n<li>Backup job status or command output from the actual lab tool.</li>\n<li>Restore test record with date, target, source backup ID, and result.</li>\n<li>Integrity check output such as hash comparison, file open test, boot/login check, or service status.</li>\n<li>Screenshots or logs captured from the lab.</li>\n<li>Review notes explaining whether recovery objectives were met.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/78f8916547ae": {
    "title": "Historical Home Lab Summary — ad.jeremyfontenot.online",
    "description": "Retained technical documentation: Historical Home Lab Summary — ad.jeremyfontenot.online",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Historical Home Lab Summary — ad.jeremyfontenot.online</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/home-lab/historical-home-lab-summary-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Historical Home Lab Summary — ad.jeremyfontenot.online</h2>\n<h2>Evidence status</h2>\n<p>This document records historical home-lab context for reviewer use. It is not a live infrastructure dashboard.</p>\n<h2>Historical environment</h2>\n<ul>\n<li>Active Directory domain: <code>ad.jeremyfontenot.online</code></li>\n<li>Example hosts: <code>DC01.ad.jeremyfontenot.online</code>, <code>FS01.ad.jeremyfontenot.online</code>, <code>WS01.ad.jeremyfontenot.online</code>, <code>MGMT01.ad.jeremyfontenot.online</code></li>\n<li>Environment status: dismantled; infrastructure no longer accessible</li>\n<li>Evidence classification: historical home lab / preserved lab environment / validation environment</li>\n</ul>\n<h2>Scope documented</h2>\n<p>The home lab was used to explore and document Active Directory Domain Services, DNS, DHCP, Group Policy, file services, user provisioning, PowerShell automation, infrastructure validation, network validation, and Windows Server administration.</p>\n<h2>Public-language control</h2>\n<p>Public pages must present this as preserved technical experience and never as active infrastructure.</p></article>",
    "active": "Projects"
  },
  "documentation/d1033973c03f": {
    "title": "Change Record: AD OU Restructure Planning",
    "description": "Retained technical documentation: Change Record: AD OU Restructure Planning",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Change Record: AD OU Restructure Planning</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/identity-access/identity-access-change-record-notes-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Change Record: AD OU Restructure Planning</h2>\n<ul>\n<li><strong>Change ID:</strong> CHG-2026-001</li>\n<li><strong>Date:</strong> 2026-05-07</li>\n<li><strong>Owner:</strong> Jeremy Fontenot</li>\n<li><strong>Environment:</strong> Sanitized lab planning record for Active Directory-style administration.</li>\n<li><strong>Objective:</strong> Document an OU structure that separates users, computers, and service accounts so policy targeting, delegation, troubleshooting, and rollback planning are easier to review.</li>\n<li><strong>Technical areas:</strong> Active Directory fundamentals, OU design, Group Policy scope, change control, backup awareness, rollback planning, and validation documentation.</li>\n</ul>\n<h2>Implementation Notes</h2>\n<ul>\n<li>Define top-level OUs for Users, Computers, and Service Accounts.</li>\n<li>Document intended GPO scope before moving objects.</li>\n<li>Export or record the current OU layout before any controlled lab change.</li>\n<li>Move only a small lab test set first, then review policy application behavior.</li>\n<li>Keep service accounts isolated from standard user policy assumptions.</li>\n</ul>\n<h2>Validation Criteria</h2>\n<ul>\n<li>Confirm the test objects appear in the intended OU.</li>\n<li>Confirm expected GPO scope using a lab-safe policy review method such as <code>gpresult</code> or Group Policy Results.</li>\n<li>Confirm no unintended policy applies to service accounts.</li>\n<li>Confirm rollback steps are documented before broader changes.</li>\n</ul>\n<h2>Rollback Plan</h2>\n<ul>\n<li>Restore the prior OU layout from the recorded export or lab snapshot.</li>\n<li>Move test objects back to their original OU if policy behavior is unexpected.</li>\n<li>Preserve notes showing what changed, what was validated, and what remains planned.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/e856d801c1de": {
    "title": "pfSense Network Segmentation Diagram 2026",
    "description": "Retained technical documentation: pfSense Network Segmentation Diagram 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>pfSense Network Segmentation Diagram 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/infrastructure-networking/pfsense-network-segmentation-diagram-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>pfSense Network Segmentation Diagram 2026</h2>\n<p>Status: Sanitized lab architecture documentation\nScope: Home lab network segmentation planning and operational reference\nEvidence type: Architecture documentation and firewall policy intent</p>\n<h2>Purpose</h2>\n<p>This document explains the pfSense-based network segmentation model intended for the home lab environment. It is designed as portfolio-quality operational documentation, not as a claim that every rule or VLAN has already been validated on live systems.</p>\n<p>The diagram supports future evidence-library migration by describing how WAN, LAN, VLANs, VPN access, and lab service zones should be separated and reviewed.</p>\n<h2>Objective</h2>\n<p>Document the firewall segmentation model, management boundaries, VPN access path, and validation evidence required before any broader lab migration.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>pfSense firewall and routing concepts.</li>\n<li>VLAN zone design and default-deny policy intent.</li>\n<li>VPN access boundaries.</li>\n<li>DNS/DHCP service placement.</li>\n<li>Proxmox and lab workload separation.</li>\n<li>Firewall rule review, logging, rollback planning, and validation methodology.</li>\n</ul>\n<h2>Known Lab Context</h2>\n<ul>\n<li>Base environment uses the <code>192.168.0.0/24</code> network.</li>\n<li>Compute platform includes a Dell R710 server running lab workloads.</li>\n<li>Switching includes a D-Link switch with uplink connectivity between firewall, switch, and hypervisor hosts.</li>\n<li>Lab services include Proxmox, Active Directory, DNS, DHCP, Windows/Linux administration, Microsoft 365 concepts, VPN access, and PowerShell automation.</li>\n<li>pfSense is the firewall and routing control point for segmentation policy.</li>\n</ul>\n<h2>Segmentation Goals</h2>\n<ul>\n<li>Separate internet-facing WAN from trusted and lab networks.</li>\n<li>Keep firewall and infrastructure management access isolated from regular workstation traffic.</li>\n<li>Place server and lab workloads in zones that can be monitored and controlled.</li>\n<li>Support VPN access through a dedicated security boundary.</li>\n<li>Keep policy review simple enough for service desk and junior administrator troubleshooting.</li>\n</ul>\n<h2>Security Rationale</h2>\n<p>Segmentation reduces the blast radius of workstation compromise, misconfigured lab services, and test workloads. It also makes troubleshooting more predictable because DNS, DHCP, gateway, and firewall decisions can be reviewed per zone.</p>\n<p>This model intentionally avoids inventing a complete IP inventory. Future live migration should map this design to the actual pfSense interface, VLAN, DHCP, and firewall rule exports after manual review.</p>\n<h2>Zone Summary</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Zone</th>\n<th>Intent</th>\n<th>Typical Systems</th>\n<th>Policy Intent</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>WAN</td>\n<td>Internet edge</td>\n<td>ISP modem or upstream router</td>\n<td>Inbound denied by default except approved VPN or explicitly reviewed services</td>\n</tr>\n<tr>\n<td>Management</td>\n<td>Administration plane</td>\n<td>pfSense UI, Proxmox host access, switch management</td>\n<td>Restricted to administrator workstation or VPN admin group</td>\n</tr>\n<tr>\n<td>Workstation</td>\n<td>User endpoint traffic</td>\n<td>Windows client systems, admin workstation</td>\n<td>Allow DNS, DHCP, internet, and approved admin tools</td>\n</tr>\n<tr>\n<td>Server</td>\n<td>Core lab services</td>\n<td>Active Directory, DNS, DHCP, file or management services</td>\n<td>Allow only required management and service traffic</td>\n</tr>\n<tr>\n<td>Lab/Test</td>\n<td>Isolated experiments</td>\n<td>Temporary VMs, Linux/Windows testing systems</td>\n<td>Deny lateral access by default; allow only required services</td>\n</tr>\n<tr>\n<td>VPN</td>\n<td>Remote administration boundary</td>\n<td>WireGuard or OpenVPN clients</td>\n<td>Restricted routes to approved internal services</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Firewall Policy Intent</h2>\n<ul>\n<li>Default-deny inter-VLAN traffic unless a service requirement is documented.</li>\n<li>Allow DNS and DHCP only to approved lab infrastructure.</li>\n<li>Allow management protocols only from trusted administration sources.</li>\n<li>Keep lab/test workloads from initiating unrestricted traffic to management systems.</li>\n<li>Log denied traffic during troubleshooting windows, then tune logging to avoid noise.</li>\n<li>Review VPN routes and firewall aliases before expanding remote access.</li>\n</ul>\n<h2>Evidence Still Needed Before Live Migration</h2>\n<ul>\n<li>pfSense interface assignment export or screenshots.</li>\n<li>VLAN configuration export from pfSense or switch.</li>\n<li>DHCP scope configuration export or documented reservations.</li>\n<li>DNS forwarder/resolver configuration notes.</li>\n<li>Firewall rule review showing allow/deny policy for each zone.</li>\n<li>Validation checklist results showing gateway, DNS, DHCP, and VPN reachability.</li>\n</ul>\n<h2>Related Artifact</h2>\n<p>See <code>pfsense-network-segmentation-diagram-2026.svg</code> for the visual architecture reference.</p></article>",
    "active": "Projects"
  },
  "documentation/9c6bf8b7a2f5": {
    "title": "VLAN Architecture Walkthrough 2026",
    "description": "Retained technical documentation: VLAN Architecture Walkthrough 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>VLAN Architecture Walkthrough 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/infrastructure-networking/vlan-architecture-walkthrough-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><hr/>\n<p>title: \"VLAN Architecture Walkthrough 2026\"\ndescription: \"Enterprise-style VLAN segmentation case study documenting pfSense routing, Proxmox bridge mapping, Windows Server services, DHCP ownership, firewall boundaries, VPN reachability, and validation evidence.\"\ntype: \"TechArticle\"\nog_title: \"VLAN Architecture Walkthrough 2026\"\nog_description: \"A recruiter-ready infrastructure case study showing VLAN design, network segmentation, DHCP/DNS architecture, firewall policy, virtualization networking, and validation evidence.\"\nog_image: \"../../architecture-diagrams/vlan-architecture-diagram-dark.png\"</p>\n<hr/>\n<h2>VLAN Architecture Walkthrough 2026</h2>\n<p>Status: Sanitized lab architecture documentation<br/>\nScope: Home lab VLAN segmentation, infrastructure planning, firewall policy, and validation methodology<br/>\nPrimary artifact: <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/architecture-diagrams/vlan-architecture-diagram.svg\" rel=\"noopener noreferrer\" target=\"_blank\">VLAN Architecture Evidence Diagram</a></p>\n\n\n\n<div class=\"case-shell\">\n<div>\n\n## Executive Summary\n\nI built this VLAN Architecture Walkthrough to document how a small infrastructure environment can be segmented, routed, secured, and validated using enterprise-style practices. The project connects pfSense firewall administration, Proxmox virtualization networking, Windows Server services, DHCP/DNS planning, VPN access control, switch port mapping, and validation evidence into one reviewable package.\n\nThe business problem is straightforward: flat networks are harder to troubleshoot, harder to secure, and harder to explain during operational review. This case study demonstrates how I break infrastructure into clear trust zones, document the supporting paths, and validate expected behavior without overstating the lab as a production deployment.\n\nThe technical objectives were to:\n\n- Define VLAN boundaries for management, server, client, IoT, and guest traffic.\n- Map switch ports and trunk/access behavior for traceable physical support.\n- Show pfSense as the routing and firewall enforcement point.\n- Show Proxmox bridge relationships for virtualized workloads.\n- Preserve Windows Server, Active Directory, DNS, and DHCP as core infrastructure services.\n- Document DHCP ownership and relay behavior between trusted and untrusted VLANs.\n- Preserve validation evidence for gateway, DHCP, DNS, routing, firewall, VPN, and internet reachability checks.\n\nThe operational value is recruiter-readable: this project shows that I can plan an infrastructure change, document the architecture, define security boundaries, validate the result, and organize the evidence so another technician, administrator, or hiring manager can review it.\n\n<div class=\"hero-diagram\">\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/architecture-diagrams/vlan-architecture-diagram.svg\" rel=\"noopener noreferrer\" target=\"_blank\">\n<a href=\"https://jeremyfontenot.online/evidence-library/architecture-diagrams/vlan-architecture-diagram.svg\" rel=\"noopener noreferrer\" target=\"_blank\">Open original screenshot: VLAN Architecture Walkthrough evidence diagram showing switch ports, pfSense VLAN interfaces, Proxmox bridge mapping, DHCP ownership, firewall boundaries, validation coverage, and documentation references.</a>\n</a>\n</div>\n<div aria-label=\"Evidence navigation panel\" class=\"evidence-nav\">\n\n**Evidence navigation**\n\n- [Open light SVG diagram](../../architecture-diagrams/vlan-architecture-diagram.svg)\n- [Open light PNG diagram](../../architecture-diagrams/vlan-architecture-diagram.png)\n- [Open dark SVG diagram](../../architecture-diagrams/vlan-architecture-diagram-dark.svg)\n- [Open dark PNG diagram](../../architecture-diagrams/vlan-architecture-diagram-dark.png)\n- [Open diagram README](../../architecture-diagrams/vlan-architecture-diagram-README.md)\n- [Open validation checklist](../../validation-reports/network-validation-checklist-2026.md)\n\n</div>\n\n## Environment Overview\n\n| Component | Role in the architecture | Operational purpose |\n| --- | --- | --- |\n| Dell R710 | Physical virtualization host | Provides the lab compute platform for virtualized infrastructure workloads. |\n| Proxmox | Hypervisor and bridge layer | Separates management and workload traffic through documented bridge mappings. |\n| pfSense | Firewall, router, VPN edge, DHCP for untrusted VLANs | Enforces routed boundaries and policy control between VLANs. |\n| Windows Server | Core infrastructure services | Hosts Active Directory, DNS, DHCP, authentication, and domain services. |\n| Active Directory | Identity and authentication | Provides centralized identity concepts for trusted infrastructure services. |\n| DNS | Name resolution | Supports internal resolution and troubleshooting workflows. |\n| DHCP | Address assignment | Provides scope ownership for trusted VLANs and documents relay expectations. |\n| VPN | Administrative access path | Supports controlled remote reachability for management workflows. |\n| Managed switch | Physical VLAN and port boundary | Distinguishes trunk and access behavior for physical traceability. |\n| Wireless AP | Tagged wireless network edge | Supports guest and IoT SSID segmentation through trunked VLANs. |\n\n## Architecture Overview\n\nThe architecture uses pfSense as the routed enforcement point, a managed switch as the trunk/access boundary, Proxmox as the virtualization bridge layer, and Windows Server as the trusted core service node. VLANs define policy boundaries rather than just IP ranges. Each VLAN has a business and operational purpose, and each supporting artifact explains a different layer of the design.\n\n<div class=\"diagram-pair\">\n<figure>\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/architecture-diagrams/vlan-architecture-diagram.svg\" rel=\"noopener noreferrer\" target=\"_blank\">\n<a href=\"https://jeremyfontenot.online/evidence-library/architecture-diagrams/vlan-architecture-diagram.svg\" rel=\"noopener noreferrer\" target=\"_blank\">Open original screenshot: Light VLAN architecture evidence diagram.</a>\n</a>\n<figcaption>Light version for printed documentation and neutral review surfaces.</figcaption>\n</figure>\n<figure>\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/architecture-diagrams/vlan-architecture-diagram-dark.svg\" rel=\"noopener noreferrer\" target=\"_blank\">\n<a href=\"https://jeremyfontenot.online/evidence-library/architecture-diagrams/vlan-architecture-diagram-dark.svg\" rel=\"noopener noreferrer\" target=\"_blank\">Open original screenshot: Dark VLAN architecture evidence diagram.</a>\n</a>\n<figcaption>Dark version aligned to the portfolio visual system.</figcaption>\n</figure>\n</div>\n\n### Design Rationale\n\n- pfSense is positioned as the gateway and firewall policy enforcement point so routing decisions and segmentation rules are centralized.\n- Windows Server owns trusted DHCP responsibilities for VLAN 20 and VLAN 30 through relay relationships because those zones depend on core infrastructure services.\n- pfSense owns DHCP for untrusted VLAN 40 and VLAN 50 because IoT and guest networks should not depend on domain services.\n- The managed switch documents physical traceability so troubleshooting can start with cable, port, and mode verification before moving into routing or firewall logic.\n- Proxmox bridge mappings separate management, trusted workloads, untrusted workloads, and isolated internal testing.\n\n### Tradeoffs\n\n- More VLANs improve policy clarity but increase documentation and troubleshooting requirements.\n- DHCP relay keeps trusted scope management centralized but requires clear gateway and relay validation.\n- Guest and IoT isolation reduces lateral movement risk but must be tested carefully so internet access remains available where expected.\n- Management isolation protects administrative surfaces but requires a documented recovery path if routing or firewall changes block access.\n\n### Scalability Considerations\n\nThe model is intentionally expandable. Future VLANs should only be added when they introduce a real policy boundary, monitoring requirement, or operational risk difference. Candidate additions include monitoring, backups, storage, centralized logging, and Microsoft 365 hybrid administration workflows.\n\n## VLAN Segmentation Strategy\n\n| VLAN | Segment | Gateway | DHCP ownership | Access model |\n| --- | --- | --- | --- | --- |\n| VLAN 10 | Management | 10.10.10.1 | Static or controlled management assignment | Management-only access for switch, firewall, hypervisor, and administrative interfaces. |\n| VLAN 20 | Servers | 10.20.20.1 | Windows Server DHCP through relay | Trusted infrastructure services including Active Directory, DNS, DHCP, and domain services. |\n| VLAN 30 | Clients | 10.30.30.1 | Windows Server DHCP through relay | Client/workstation access to approved AD and DNS services only. |\n| VLAN 40 | IoT | 10.40.40.1 | pfSense DHCP | Untrusted device access with internet-only routing and blocked trusted-LAN paths. |\n| VLAN 50 | Guest | 10.50.50.1 | pfSense DHCP | Guest internet access with no LAN access. |\n\n<div class=\"card-grid\">\n<section class=\"case-card\">\n<h3>Architecture Callout</h3>\n<p>pfSense acts as the control plane for inter-VLAN routing, firewall enforcement, DHCP relay handling, VPN reachability, and outbound access policy.</p>\n</section>\n<section class=\"case-card\">\n<h3>Security Callout</h3>\n<p>Trusted services are separated from untrusted IoT and guest networks. Allowed paths are explicit, and blocked paths enforce trust boundaries.</p>\n</section>\n<section class=\"case-card\">\n<h3>Operations Callout</h3>\n<p>The switch port map, bridge map, DHCP notes, firewall evidence, and validation checklist create a repeatable troubleshooting path.</p>\n</section>\n</div>\n\n## Technical Components\n\n### pfSense\n\npfSense provides the WAN interface, LAN parent interface, VLAN gateways, firewall rule enforcement, VPN reachability, and DHCP services for untrusted networks. In this design, pfSense is the segmentation boundary rather than just an internet gateway.\n\nKey documented interfaces:\n\n- WAN: `igb0`\n- LAN parent: `igb1`\n- VLAN 10 Management\n- VLAN 20 Servers\n- VLAN 30 Clients\n- VLAN 40 IoT\n- VLAN 50 Guest\n\n### Proxmox\n\nProxmox represents the virtualization layer and demonstrates how VLAN-aware bridge planning supports workload separation. The bridge names in the diagram document intended operational boundaries:\n\n- `vmbr0`: management bridge\n- `vmbr1`: server and client bridge\n- `vmbr2`: IoT and guest bridge\n- `vmbr999`: internal isolated bridge\n\n### Windows Server, Active Directory, DNS, and DHCP\n\nWindows Server is documented as the core infrastructure services node. It supports Active Directory, DNS, DHCP, authentication, and domain services for trusted infrastructure and client segments. The case study keeps this role clear so reviewers can understand how identity, resolution, and address assignment support the segmented network.\n\n### VPN\n\nVPN reachability is treated as an administrative path, not a blanket bypass. The validation notes preserve VPN reachability as a review item so access can be tested without weakening segmentation.\n\n### Managed Switch and Wireless AP\n\nThe managed switch provides the physical boundary for access and trunk behavior:\n\n- Port 1 -&gt; pfSense Trunk\n- Port 2 -&gt; Proxmox Management\n- Port 3 -&gt; Proxmox VM Trunk\n- Port 4 -&gt; Windows Server\n- Port 8 -&gt; Wireless AP Trunk\n\nThe Wireless AP is documented as a trunked endpoint for IoT and guest SSIDs mapped to VLAN 40 and VLAN 50.\n\n## Evidence Package\n\nEach evidence item supports one part of the architecture. Together, they form the evidence chain behind the diagram.\n\n| Artifact | Purpose | What it demonstrates | Why it matters | Skills validated |\n| --- | --- | --- | --- | --- |\n| [Switch Port Map](../../network/network-infrastructure-validation-report-2026.md) | Documents physical switch relationships and port mode intent. | pfSense trunk, Proxmox management, Proxmox VM trunk, Windows Server access, Wireless AP trunk. | Physical traceability improves troubleshooting and reduces guesswork during changes. | Network documentation, Layer 1/Layer 2 troubleshooting, port mapping. |\n| [pfSense VLAN Interface Export](../../network/network-infrastructure-validation-report-2026.md) | Captures the VLAN interface model and gateway role. | WAN, LAN parent, VLAN gateways, firewall enforcement point, routing boundaries. | Interface evidence supports segmentation review and firewall policy validation. | pfSense administration, routing, VLAN design. |\n| [Proxmox Bridge Mapping](../../proxmox/proxmox-host-validation-report-2026.md) | Documents virtualization network boundaries. | Bridge-to-VLAN relationships and management/workload separation. | Virtual networking must align with switch and firewall expectations. | Proxmox administration, virtualization networking, infrastructure planning. |\n| [DHCP Scope Mapping](../../network/dhcp-dns-validation-report-2026.md) | Defines ownership for trusted and untrusted address assignment. | Windows Server DHCP for VLAN 20/30 and pfSense DHCP for VLAN 40/50. | Clear DHCP ownership prevents conflicting scopes and speeds lease troubleshooting. | DHCP administration, DNS/DHCP operations, service ownership. |\n| [Firewall Rule Review](../../network/firewall-rule-validation-report-2026.md) | Preserves firewall policy intent and segmentation behavior. | Allowed paths, blocked paths, guest isolation, IoT isolation, and administrative separation. | Firewall policy is the enforcement layer behind VLAN design. | Firewall management, security fundamentals, rule review. |\n| [Validation Checklist Results](../../validation-reports/network-validation-checklist-2026.md) | Provides repeatable testing methodology. | Gateway, DHCP, DNS, firewall, VPN, routing, and internet connectivity checks. | Validation evidence turns architecture into reviewable operational proof. | Troubleshooting, validation planning, technical documentation. |\n\n## Security Architecture\n\nThis design uses segmentation as a practical zero-trust control. VLANs do not automatically create security; the security comes from defined trust boundaries, explicit allowed paths, blocked lateral movement, and validation that confirms the intended policy.\n\n<div class=\"card-grid\">\n<section class=\"case-card\">\n<h3>Administrative Separation</h3>\n<p>Management access is restricted to documented administrative paths. Management interfaces are not treated as general client resources.</p>\n</section>\n<section class=\"case-card\">\n<h3>Guest and IoT Isolation</h3>\n<p>Guest and IoT networks are untrusted. Their expected behavior is internet access without trusted LAN reachability.</p>\n</section>\n<section class=\"case-card\">\n<h3>Firewall Segmentation</h3>\n<p>Firewall policy defines allowed and blocked routes. The traffic matrix keeps the intent readable during review.</p>\n</section>\n</div>\n\n### Traffic Matrix\n\n| Source | Allowed destination | Blocked or restricted paths |\n| --- | --- | --- |\n| Management | Management resources only | General workstation, IoT, and guest access unless explicitly approved. |\n| Clients | AD/DNS services | Management interfaces and untrusted VLAN lateral movement. |\n| IoT | Internet only | Trusted LAN, management, and server resources. |\n| Guest | Internet only | Trusted LAN, management, server, and IoT resources. |\n\n## Validation Methodology\n\nValidation is documented as a repeatable process. The goal is to confirm the architecture from physical connectivity through service behavior and firewall enforcement.\n\n| Validation area | Method | Expected result | Observed result | Outcome |\n| --- | --- | --- | --- | --- |\n| Gateway reachability | Test each VLAN gateway from an appropriate host or test point. | Each VLAN reaches its assigned gateway. | Documented in the validation checklist package. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| DHCP validation | Confirm lease behavior from the correct DHCP owner or relay path. | VLAN 20/30 receive trusted DHCP through relay; VLAN 40/50 use pfSense DHCP. | Documented in DHCP/DNS and validation evidence. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| DNS validation | Test internal and external resolution paths from trusted segments. | Trusted clients resolve internal names and internet DNS as expected. | Documented in DHCP/DNS evidence. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| Firewall validation | Test allowed and blocked paths from each security zone. | Approved traffic succeeds; restricted lateral movement fails. | Documented in firewall rule evidence. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| Routing validation | Confirm expected VLAN-to-gateway and VLAN-to-internet routing behavior. | Routed paths match the traffic matrix. | Documented in validation checklist package. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| VPN validation | Confirm administrative reachability without bypassing segmentation policy. | VPN access reaches approved administrative targets only. | Documented as a validation checklist item. | <span class=\"status-pass\">Pass-ready methodology</span> |\n| Internet connectivity | Test outbound access from approved networks. | Clients, IoT, and guest networks reach the internet according to policy. | Documented in validation checklist package. | <span class=\"status-pass\">Pass-ready methodology</span> |\n\n## Troubleshooting Methodology\n\nI troubleshoot VLAN and segmentation issues from the physical layer upward:\n\n1. Confirm cable, link light, and switch port.\n2. Confirm switch port mode: access or trunk.\n3. Confirm VLAN tag expectations on pfSense, the managed switch, Proxmox, and the Wireless AP.\n4. Confirm gateway reachability.\n5. Confirm DHCP lease assignment and scope ownership.\n6. Confirm DNS resolution.\n7. Confirm firewall rule path and rule order.\n8. Confirm service-specific traffic such as AD/DNS authentication dependencies.\n9. Confirm VPN route behavior only after local routing and firewall logic are understood.\n\nThis process keeps troubleshooting disciplined. It avoids jumping directly to firewall rules when the root cause may be a port mode, VLAN tag, bridge mapping, gateway, or DHCP relay issue.\n\n## Skills Demonstrated\n\n<div class=\"card-grid\">\n<section class=\"case-card\"><h3>Network Administration</h3><p>VLAN planning, trunk/access documentation, routing boundaries, and physical port mapping.</p></section>\n<section class=\"case-card\"><h3>Infrastructure Design</h3><p>Service placement, trust zones, management boundaries, and operational dependency mapping.</p></section>\n<section class=\"case-card\"><h3>Active Directory</h3><p>Core identity service placement, trusted segment dependencies, authentication context, and domain-service documentation.</p></section>\n<section class=\"case-card\"><h3>DHCP Administration</h3><p>Scope ownership, relay design, pfSense DHCP boundaries, and lease troubleshooting methodology.</p></section>\n<section class=\"case-card\"><h3>DNS Administration</h3><p>Internal resolution planning, trusted DNS dependency mapping, and validation workflows.</p></section>\n<section class=\"case-card\"><h3>Firewall Management</h3><p>Allowed/blocked path documentation, guest isolation, IoT isolation, and administrative separation.</p></section>\n<section class=\"case-card\"><h3>Virtualization</h3><p>Proxmox bridge planning, VLAN-aware workload separation, and isolated internal bridge documentation.</p></section>\n<section class=\"case-card\"><h3>Security Fundamentals</h3><p>Least privilege, zero-trust segmentation concepts, trust boundaries, and route validation.</p></section>\n<section class=\"case-card\"><h3>Technical Documentation</h3><p>Evidence chain mapping, review-ready diagrams, validation records, and recruiter-readable summaries.</p></section>\n</div>\n\n## Lessons Learned\n\n- VLAN design is most useful when each segment has a clear access policy, not just a different subnet.\n- Firewall policy and DHCP ownership must be documented together because both affect what users experience during support calls.\n- Proxmox bridge naming should be predictable and mapped to the physical switch plan so VM connectivity issues can be isolated quickly.\n- Guest and IoT isolation must be validated from the client perspective, not assumed from the diagram.\n- Evidence is stronger when the diagram, checklist, and supporting notes all point to the same architecture.\n\n## Future Roadmap\n\nPotential future extensions should be added only when they create a real operational boundary:\n\n- Monitoring VLAN for observability tooling.\n- Backup VLAN for protected backup traffic.\n- Storage VLAN for dedicated storage access.\n- Microsoft 365 hybrid administration segment.\n- Multi-node Proxmox cluster planning.\n- Centralized logging for firewall, DHCP, DNS, VPN, and authentication events.\n\n## Recruiter Takeaways\n\nThis project demonstrates that I can work across infrastructure layers: physical switching, VLAN design, firewall policy, virtualization networking, Windows Server services, DNS, DHCP, VPN, and validation documentation. It also shows that I organize proof in a way hiring managers can inspect instead of relying on broad claims.\n\nRelated internal links:\n\n- [Evidence Library](../../index.html)\n- [Network Validation Lab Notes](../../network/network-infrastructure-validation-report-2026.md)\n- [Firewall Rule Evidence](../../network/firewall-rule-validation-report-2026.md)\n- [DHCP and DNS Evidence](../../network/dhcp-dns-validation-report-2026.md)\n- [Network Validation Checklist](../../validation-reports/network-validation-checklist-2026.md)\n\n</div>\n<aside aria-label=\"Table of contents\" class=\"toc\">\n\n**On this page**\n\n- [Executive Summary](#executive-summary)\n- [Environment Overview](#environment-overview)\n- [Architecture Overview](#architecture-overview)\n- [VLAN Segmentation Strategy](#vlan-segmentation-strategy)\n- [Technical Components](#technical-components)\n- [Evidence Package](#evidence-package)\n- [Security Architecture](#security-architecture)\n- [Validation Methodology](#validation-methodology)\n- [Troubleshooting Methodology](#troubleshooting-methodology)\n- [Skills Demonstrated](#skills-demonstrated)\n- [Lessons Learned](#lessons-learned)\n- [Future Roadmap](#future-roadmap)\n\n</aside>\n</div></article>",
    "active": "Projects"
  },
  "documentation/7067b4b375b4": {
    "title": "Project 3 Evidence Set",
    "description": "Retained technical documentation: Project 3 Evidence Set",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Project 3 Evidence Set</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/m365-messaging-security/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Project 3 Evidence Set</h2>\n<h2>Microsoft 365 Messaging &amp; Security Administration</h2>\n<p><strong>Status:</strong> COMPLETE — validated portfolio scope; documented evidence limitations and licensing-metadata discrepancies remain in force</p>\n<p>This evidence package consolidates the configuration and validation work completed for Project 3. It is designed for portfolio use and avoids exposing passwords, recovery keys, tokens, private keys, authentication secrets, source IP addresses, local workstation paths, tenant-specific UPNs, and unnecessary object identifiers in public text artifacts.</p>\n<h2>Validated areas</h2>\n<ul>\n<li>Exchange Online shared mailbox configuration and delegation</li>\n<li>Exchange Online distribution group creation and membership</li>\n<li>Exchange Online external-sender transport rule</li>\n<li>Exchange message trace validation</li>\n<li>Microsoft Defender Explorer message visibility</li>\n<li>Microsoft Defender baseline mail protection review</li>\n<li>Microsoft Entra Conditional Access troubleshooting and remediation</li>\n<li>Conditional Access audit-log validation</li>\n<li>Successful post-remediation sign-in validation</li>\n<li>Microsoft 365 Developer E5 effective licensing validation</li>\n<li>Group-license assignment UI validation and documented Graph metadata discrepancy</li>\n</ul>\n<h2>Important status note</h2>\n<p>Microsoft 365 Admin Center shows <code>Project 3 E5 Licensing</code> as a group assignment for the Developer E5 SKU, and the test user has an active effective E5 license. However, Microsoft Graph continued to return an empty <code>assignedLicenses</code> collection for the group and <code>assignedByGroup: null</code> for the user. This discrepancy is documented rather than hidden or represented as fully reconciled.</p>\n<p>See <code>validation.md</code> and <code>evidence-index.md</code> for the evidence-to-claim mapping.</p>\n<h2>Public evidence handling</h2>\n<p>Text-based logs and command output in this folder are public sanitized derivatives. They preserve the validated result and troubleshooting narrative while omitting tenant-specific identifiers that are not necessary to support the portfolio claim. Screenshot evidence is retained as captured project proof and should be reviewed before reuse outside this repository.</p></article>",
    "active": "Projects"
  },
  "documentation/8320ffd9e4bb": {
    "title": "Evidence Index",
    "description": "Retained technical documentation: Evidence Index",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Evidence Index</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/m365-messaging-security/evidence-index.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Evidence Index</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>ID</th>\n<th>Evidence file</th>\n<th>Supports</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>E01</td>\n<td><code>evidence/screenshots/01-exchange-powershell-validation.png</code></td>\n<td>PowerShell validation of shared mailbox, distribution group, and external-sender transport rule</td>\n</tr>\n<tr>\n<td>E02</td>\n<td><code>evidence/screenshots/02-exchange-message-trace-sendas-delivered.png</code></td>\n<td>Shared mailbox Send As functional delivery validation</td>\n</tr>\n<tr>\n<td>E03</td>\n<td><code>evidence/screenshots/03-defender-explorer-external-sender-validation.png</code></td>\n<td>Defender Explorer visibility of Project 3 messages and external-sender test</td>\n</tr>\n<tr>\n<td>E04</td>\n<td><code>evidence/screenshots/04-ca-policy-scope-update-success.png</code></td>\n<td>Successful save of corrected external-user Conditional Access scope</td>\n</tr>\n<tr>\n<td>E05</td>\n<td><code>evidence/screenshots/05-post-remediation-myapps-success.png</code></td>\n<td>Functional post-remediation interactive access</td>\n</tr>\n<tr>\n<td>E06</td>\n<td><code>evidence/screenshots/06-signin-log-pre-post-remediation.png</code></td>\n<td>Sign-in log showing failed attempts before remediation and successful attempts afterward</td>\n</tr>\n<tr>\n<td>E07</td>\n<td><code>evidence/screenshots/07-signin-success-details.png</code></td>\n<td>Successful sign-in details, MFA requirement, user and application</td>\n</tr>\n<tr>\n<td>E08</td>\n<td><code>evidence/screenshots/08-conditional-access-evaluation-success.png</code></td>\n<td>MFA policy succeeds; security-info block policy is Not applied</td>\n</tr>\n<tr>\n<td>E09</td>\n<td><code>evidence/screenshots/09-m365-e5-group-assignment-list.png</code></td>\n<td>M365 Developer E5 product page showing Project 3 E5 Licensing as Type Group</td>\n</tr>\n<tr>\n<td>E10</td>\n<td><code>evidence/screenshots/10-m365-license-errors-zero.png</code></td>\n<td>Licensing errors = 0 and members without licenses = 0</td>\n</tr>\n<tr>\n<td>E11</td>\n<td><code>evidence/screenshots/11-m365-group-apps-services.png</code></td>\n<td>Apps &amp; services configuration view for the selected licensing group</td>\n</tr>\n<tr>\n<td>L01</td>\n<td><code>evidence/logs/AuditLogs_2026-09-21.csv</code></td>\n<td>Public sanitized audit-event derivative validating the Conditional Access policy update</td>\n</tr>\n<tr>\n<td>L02</td>\n<td><code>evidence/logs/license-details-output.txt</code></td>\n<td>Public sanitized summary of effective E5 licenseDetails and relevant service-plan provisioning states</td>\n</tr>\n<tr>\n<td>C01</td>\n<td><code>command-evidence.txt</code></td>\n<td>Sanitized PowerShell evidence transcribed from validated commands in the project session</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Recommended portfolio subset</h2>\n<p>Use E01, E02, E03, E04, E07, and E08 as the primary visible evidence set. Use E09/E10 for licensing administration if licensing is discussed on the project page. L01/L02 are sanitized public derivatives intended for supporting review; tenant-specific identifiers and source IP details are intentionally omitted.</p></article>",
    "active": "Projects"
  },
  "documentation/4cb905233407": {
    "title": "Validation Record",
    "description": "Retained technical documentation: Validation Record",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation Record</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/m365-messaging-security/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation Record</h2>\n<h2>Exchange Online</h2>\n<h3>Shared mailbox</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Validated object:</p>\n<ul>\n<li>Display name: <code>IT Support Shared</code></li>\n<li>Primary SMTP address: <code>&lt;shared-mailbox-smtp&gt;</code></li>\n<li>Recipient type: <code>SharedMailbox</code></li>\n</ul>\n<p>Delegation validated:</p>\n<ul>\n<li>Full Access: <code>&lt;lab-administrator&gt;</code></li>\n<li>Send As: <code>&lt;lab-administrator&gt;</code></li>\n<li>Send on Behalf: resolved to Lab Administrator / <code>&lt;lab-administrator&gt;</code></li>\n</ul>\n<p>Functional message trace evidence shows a message sent as the shared mailbox with status <code>Delivered</code>.</p>\n<h3>Distribution group</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Validated object:</p>\n<ul>\n<li>Display name: <code>Project 3 Distribution List</code></li>\n<li>Primary SMTP address: <code>&lt;distribution-group-smtp&gt;</code></li>\n<li>Recipient type: <code>MailUniversalDistributionGroup</code></li>\n</ul>\n<p>Validated members:</p>\n<ul>\n<li>Jeremy Fontenot</li>\n<li>Adele Vance</li>\n</ul>\n<h3>External sender transport rule</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Validated rule:</p>\n<ul>\n<li>Name: <code>Project 3 - External Sender Pilot</code></li>\n<li>State: <code>Enabled</code></li>\n<li>Mode: <code>Enforce</code></li>\n<li>Priority: <code>0</code></li>\n<li>Sender scope: <code>NotInOrganization</code></li>\n<li>Recipient: <code>&lt;lab-administrator&gt;</code></li>\n<li>Action: prepend subject with <code>[ EXTERNAL]</code></li>\n</ul>\n<p>Functional validation:</p>\n<ul>\n<li>External test message was delivered with the external-subject marker.</li>\n<li>Defender Explorer showed the message and related test messages as delivered.</li>\n</ul>\n<h2>Microsoft Defender</h2>\n<p><strong>Status: COMPLETE for reviewed baseline controls</strong></p>\n<p>Reviewed and documented during the project:</p>\n<ul>\n<li>Anti-malware default policy</li>\n<li>Safe Attachments built-in protection</li>\n<li>Safe Links built-in protection</li>\n<li>Anti-phishing default policy</li>\n<li>Quarantine view</li>\n<li>Explorer message investigation view</li>\n</ul>\n<p>Defender Explorer evidence confirms visibility of Project 3 test messages, including the external-sender validation message.</p>\n<h2>Microsoft Entra Conditional Access</h2>\n<h3>Problem observed</h3>\n<p><strong>Status: REMEDIATED</strong></p>\n<p>The <code>Project 3 License Test</code> account authenticated successfully but received sign-in error <code>53003</code> because Conditional Access blocked access.</p>\n<p>Sign-in analysis showed two relevant policy evaluations:</p>\n<ul>\n<li><code>Multifactor authentication for Microsoft partners and vendors</code> — Failure during the blocked attempt</li>\n<li><code>Security info registration for Microsoft partners and vendors</code> — Failure with <code>Block</code></li>\n</ul>\n<p>The security-info registration policy was incorrectly scoped to <code>All users</code>, causing an internal tenant member to hit a policy intended for external/partner identities.</p>\n<h3>Remediation</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Policy scope changed from:</p>\n<ul>\n<li>Include: <code>All users</code></li>\n</ul>\n<p>to:</p>\n<ul>\n<li>Include: <code>Guest or external users</code></li>\n<li>All six external identity categories selected</li>\n<li>External Microsoft Entra organizations: <code>All</code></li>\n</ul>\n<p>The existing emergency-access exclusions and trusted-location behavior were preserved.</p>\n<h3>Audit validation</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Relevant audit event:</p>\n<ul>\n<li>Activity: <code>Update conditional access policy</code></li>\n<li>Result: <code>Success</code></li>\n<li>Target: <code>Security info registration for Microsoft partners and vendors</code></li>\n<li>Initiated by: Jeremy Fontenot</li>\n<li>Time: 2026-09-21T20:48:36Z</li>\n</ul>\n<p>The audit record shows the policy changed away from <code>includeUsers: [\"All\"]</code> to external-user targeting.</p>\n<h3>Post-remediation sign-in validation</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>Validated successful sign-in:</p>\n<ul>\n<li>User: <code>Project 3 License Test</code></li>\n<li>UPN: <code>&lt;test-user-upn&gt;</code></li>\n<li>Application: <code>My Apps</code></li>\n<li>Time: 2026-09-21T20:53:15Z</li>\n<li>Status: <code>Success</code></li>\n<li>Authentication requirement: <code>Multifactor authentication</code></li>\n<li>Additional detail: <code>MFA requirement satisfied by claim in the token</code></li>\n</ul>\n<p>Conditional Access evaluation after remediation:</p>\n<ul>\n<li>MFA policy: <code>Success</code></li>\n<li>Secure password change policy: <code>Not applied</code></li>\n<li>Reauthentication on sign-in risk policy: <code>Not applied</code></li>\n<li>Security info registration block policy: <code>Not applied</code></li>\n</ul>\n<p>This demonstrates that the scope remediation removed the incorrect block without disabling MFA enforcement.</p>\n<h2>Developer E5 licensing</h2>\n<h3>Effective user license</h3>\n<p><strong>Status: COMPLETE</strong></p>\n<p>The <code>Project 3 License Test</code> account has an active effective license:</p>\n<ul>\n<li>SKU: <code>DEVELOPERPACK_V2_E5</code></li>\n<li>SKU ID: <code>&lt;redacted-sku-id&gt;</code></li>\n</ul>\n<p>The license-details response shows the majority of service plans provisioned successfully. At the captured point in time:</p>\n<ul>\n<li><code>INTUNE_A</code> = <code>PendingInput</code></li>\n<li><code>INTUNE_O365</code> = <code>PendingActivation</code></li>\n</ul>\n<p>These non-final Intune states are documented rather than represented as completed provisioning.</p>\n<h3>Group assignment</h3>\n<p><strong>Status: COMPLETE in Microsoft 365 Admin Center / Graph metadata discrepancy documented</strong></p>\n<p>Microsoft 365 Admin Center shows:</p>\n<ul>\n<li>Group: <code>Project 3 E5 Licensing</code></li>\n<li>Type: <code>Group</code></li>\n<li>Developer E5 product selected</li>\n<li>Group apps and services available for management</li>\n<li>Licensing errors: <code>0</code></li>\n<li>Members without licenses: <code>0</code></li>\n</ul>\n<p>However, Microsoft Graph repeatedly returned:</p>\n<ul>\n<li>Group <code>assignedLicenses: []</code></li>\n<li>Group <code>licenseProcessingState: null</code></li>\n<li>User <code>assignedByGroup: null</code></li>\n</ul>\n<p>An attempted direct removal of the user license returned the service error that the license was inherited from group membership. Because the Microsoft 365 licensing UI and service behavior contradict the Graph metadata, the discrepancy is preserved as a troubleshooting finding.</p>\n<h2>Evidence handling</h2>\n<p>No passwords, tokens, private keys, recovery keys, LAPS passwords, or other secrets are included in this package. Public text derivatives also omit unnecessary tenant-specific UPNs, object identifiers, local workstation paths, and source IP addresses.</p></article>",
    "active": "Projects"
  },
  "documentation/cdb0d3189bad": {
    "title": "Microsoft Entra Activity Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Activity Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Activity Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-activity-proof-20260605-043730/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Activity Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft Entra audit and sign-in activity.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Recent Microsoft Entra directory audit activity</li>\n<li>Recent tenant sign-in activity, if available in the tenant retention window</li>\n<li>Graph PowerShell delegated access</li>\n<li>Tenant activity-log visibility</li>\n<li>Troubleshooting awareness for audit/sign-in log retrieval</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>directory-audits-recent.json</li>\n<li>directory-audits-recent.csv</li>\n<li>sign-ins-recent.json</li>\n<li>sign-ins-recent.csv</li>\n<li>activity-export-errors.csv</li>\n<li>entra-activity-proof-summary.json</li>\n<li>entra-activity-proof-transcript-20260605-043730.txt</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This export is read-only. It should be used to support Microsoft Entra monitoring, audit review, and identity operations awareness. Empty sign-in or audit exports should be represented as retention/access limitations, not as proof of missing tenant activity.</p></article>",
    "active": "Projects"
  },
  "documentation/b48387714c8f": {
    "title": "Microsoft Entra Application Governance Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Application Governance Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Application Governance Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-application-proof-20260605-063206/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Application Governance Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft Entra app registrations, enterprise applications, service principals, and OAuth permission grants.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Entra app registration inventory</li>\n<li>Enterprise application / service principal inventory</li>\n<li>Application sign-in audience metadata</li>\n<li>Publisher domain metadata</li>\n<li>OAuth permission grant review</li>\n<li>Application governance and consent-review awareness</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>app-registrations.json</li>\n<li>app-registrations-summary.csv</li>\n<li>enterprise-applications-service-principals.json</li>\n<li>enterprise-applications-summary.csv</li>\n<li>oauth2-permission-grants.json</li>\n<li>oauth2-permission-grants-summary.csv</li>\n<li>application-export-errors.csv</li>\n<li>entra-application-proof-summary.json</li>\n<li>entra-application-proof-transcript-20260605-063206.txt</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of Microsoft Entra application governance review and cloud identity administration awareness.</p></article>",
    "active": "Projects"
  },
  "documentation/dd31ba8ef7a6": {
    "title": "Microsoft Entra Device and Intune Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Device and Intune Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Device and Intune Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-device-proof-20260605-043942/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Device and Intune Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft Entra device inventory and Intune managed device inventory.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Entra registered device inventory</li>\n<li>Device operating system metadata</li>\n<li>Device trust type metadata</li>\n<li>Approximate last sign-in metadata where available</li>\n<li>Intune managed device inventory where licensing and access allow it</li>\n<li>Intune access or licensing limitations if the managed device export fails</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>entra-directory-devices.json</li>\n<li>entra-directory-devices.csv</li>\n<li>intune-managed-devices.json</li>\n<li>intune-managed-devices.csv</li>\n<li>device-export-errors.csv</li>\n<li>entra-device-proof-summary.json</li>\n<li>entra-device-proof-transcript-20260605-043942.txt</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of endpoint inventory review and Microsoft cloud device administration awareness. Empty or failed Intune managed-device exports should be represented as license/access limitations, not as successful Intune management evidence.</p></article>",
    "active": "Projects"
  },
  "documentation/8170a179e7c7": {
    "title": "Microsoft Entra Group Membership Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Group Membership Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Group Membership Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-group-membership-proof-20260605-063604/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Group Membership Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft Entra group inventory and sanitized group membership review.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Entra group inventory</li>\n<li>Security-enabled group review</li>\n<li>Microsoft 365 group review</li>\n<li>Group membership review</li>\n<li>Sanitized user membership visibility</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>groups-summary.csv</li>\n<li>groups-summary.json</li>\n<li>group-members-sanitized.csv</li>\n<li>group-members-sanitized.json</li>\n<li>group-membership-export-errors.csv</li>\n<li>entra-group-membership-proof-summary.json</li>\n<li>entra-group-membership-proof-transcript-20260605-063604.txt</li>\n</ul>\n<h2>Sanitization Notes</h2>\n<p>User principal names are reduced to domain-only values. This preserves proof of group membership review without exposing unnecessary account-level details.</p>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of Microsoft Entra group administration and access review awareness.</p></article>",
    "active": "Projects"
  },
  "documentation/dcba677047c8": {
    "title": "Microsoft 365 License and Service Plan Proof Export",
    "description": "Retained technical documentation: Microsoft 365 License and Service Plan Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 License and Service Plan Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-license-proof-20260605-063412/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 License and Service Plan Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft 365 subscribed SKUs, service plans, and sanitized user license assignment review.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Microsoft 365 subscribed SKU inventory</li>\n<li>SKU capability state</li>\n<li>Consumed and available license units</li>\n<li>Service plan inventory</li>\n<li>Sanitized user license assignment review</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>subscribed-skus.json</li>\n<li>subscribed-skus-summary.csv</li>\n<li>subscribed-sku-service-plans.csv</li>\n<li>user-license-assignments-sanitized.csv</li>\n<li>user-license-assignments-sanitized.json</li>\n<li>license-export-errors.csv</li>\n<li>entra-license-proof-summary.json</li>\n<li>entra-license-proof-transcript-20260605-063412.txt</li>\n</ul>\n<h2>Sanitization Notes</h2>\n<p>User principal names are reduced to domain-only values. This preserves proof of license review without exposing unnecessary account-level details.</p>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of Microsoft 365 license review and tenant administration awareness.</p></article>",
    "active": "Projects"
  },
  "documentation/832b1072de0a": {
    "title": "Microsoft Entra Live Tenant Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Live Tenant Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Live Tenant Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-live-proof-20260605-042550/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Live Tenant Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only proof exported from Microsoft Entra / Microsoft Graph PowerShell.</p>\n<h2>Capture Summary</h2>\n<ul>\n<li>Captured at: 2026-06-05 04:26:07 -05:00</li>\n<li>Tenant ID: 53598f56-182f-4762-bd05-4586973fb766</li>\n<li>Signed-in account: jeremyfontenot@jeremyfontenot.online</li>\n<li>Organization display name: jeremy fontenot</li>\n<li>Verified domains: 2</li>\n<li>Users exported: 7</li>\n<li>Groups exported: 8</li>\n<li>Directory roles exported: 17</li>\n<li>Enterprise applications exported: 247</li>\n<li>Subscribed SKU records: 3</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>tenant-organization.json</li>\n<li>tenant-domains.csv</li>\n<li>entra-users-sanitized.csv</li>\n<li>entra-groups.csv</li>\n<li>entra-directory-roles.csv</li>\n<li>m365-subscribed-skus.csv</li>\n<li>enterprise-apps-sanitized.csv</li>\n<li>entra-proof-summary.json</li>\n<li>entra-proof-transcript-20260605-042550.txt</li>\n</ul>\n<h2>Evidence Notes</h2>\n<p>This export is read-only and is intended to prove access to a real Microsoft Entra tenant, tenant domain configuration, identity objects, groups, roles, applications, and licensing state.</p>\n<p>Sensitive user principal names are reduced to domain-only values in the sanitized user export.</p></article>",
    "active": "Projects"
  },
  "documentation/61d3f0f15b7e": {
    "title": "Microsoft Entra Tenant Proof Review Notes",
    "description": "Retained technical documentation: Microsoft Entra Tenant Proof Review Notes",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Tenant Proof Review Notes</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-live-proof-20260605-042550/tenant-proof-review-notes.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Tenant Proof Review Notes</h2>\n<h2>Evidence Type</h2>\n<p>Live Microsoft Graph PowerShell export from Microsoft Entra ID.</p>\n<h2>Tenant Identity</h2>\n<ul>\n<li>Tenant account used for capture: jeremyfontenot@jeremyfontenot.online</li>\n<li>Organization display name: jeremy fontenot</li>\n<li>Tenant ID: 53598f56-182f-4762-bd05-4586973fb766</li>\n<li>Capture date: 2026-06-05</li>\n<li>Capture method: Microsoft Graph PowerShell delegated read-only session</li>\n</ul>\n<h2>What This Evidence Validates</h2>\n<p>This evidence validates that the Microsoft 365 / Entra lab tenant existed and was accessible through Microsoft Graph PowerShell at the time of capture.</p>\n<p>The export provides reviewer-verifiable proof of:</p>\n<ul>\n<li>Microsoft Entra tenant access</li>\n<li>Custom domain association with jeremyfontenot.online</li>\n<li>Tenant organization metadata</li>\n<li>Verified domain records</li>\n<li>User object inventory</li>\n<li>Group object inventory</li>\n<li>Directory role inventory</li>\n<li>Enterprise application / service principal inventory</li>\n<li>Subscribed SKU records</li>\n<li>PowerShell transcript evidence of the export session</li>\n</ul>\n<h2>Files Included</h2>\n<ul>\n<li>tenant-organization.json</li>\n<li>tenant-domains.csv</li>\n<li>entra-users-sanitized.csv</li>\n<li>entra-groups.csv</li>\n<li>entra-directory-roles.csv</li>\n<li>enterprise-apps-sanitized.csv</li>\n<li>m365-subscribed-skus.csv</li>\n<li>entra-proof-summary.json</li>\n<li>entra-proof-transcript-20260605-042550.txt</li>\n<li>README.md</li>\n</ul>\n<h2>Sanitization Notes</h2>\n<p>The user export intentionally reduces user principal names to domain-only values. This preserves proof of tenant domain structure without exposing unnecessary account-level details.</p>\n<h2>Portfolio Claim Supported</h2>\n<p>This evidence supports the claim that the Microsoft 365 tenant named around Jeremy Fontenot and the custom domain jeremyfontenot.online were used as a personal Microsoft cloud administration lab.</p>\n<p>It does not claim enterprise production ownership, client tenant administration, or active paid subscription status beyond what is shown in the exported SKU and tenant records.</p></article>",
    "active": "Projects"
  },
  "documentation/38f89b429553": {
    "title": "Microsoft Entra Directory Role Assignment Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Directory Role Assignment Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Directory Role Assignment Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-role-assignment-proof-20260605-063046/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Directory Role Assignment Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Microsoft Entra directory roles and role membership review.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Entra directory role inventory</li>\n<li>Directory role assignment review</li>\n<li>Sanitized role membership visibility</li>\n<li>Least-privilege and privileged-access review awareness</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>directory-roles.csv</li>\n<li>directory-role-members-sanitized.csv</li>\n<li>directory-role-members-sanitized.json</li>\n<li>role-assignment-export-errors.csv</li>\n<li>entra-role-assignment-proof-summary.json</li>\n<li>entra-role-assignment-proof-transcript-20260605-063046.txt</li>\n</ul>\n<h2>Sanitization Notes</h2>\n<p>User principal names are reduced to domain-only values when available. This preserves proof of role review without exposing unnecessary account-level details.</p>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of Microsoft Entra privileged role review and identity administration awareness.</p></article>",
    "active": "Projects"
  },
  "documentation/c7b230bfd153": {
    "title": "Microsoft Entra Security Policy Proof Export",
    "description": "Retained technical documentation: Microsoft Entra Security Policy Proof Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Security Policy Proof Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-security-proof-20260605-043352/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Security Policy Proof Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains read-only Microsoft Graph PowerShell exports for Entra security and identity policy review.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Conditional Access policy inventory</li>\n<li>Conditional Access policy state</li>\n<li>Named location configuration</li>\n<li>Authentication methods policy</li>\n<li>Authentication method configuration inventory</li>\n<li>Authorization policy settings</li>\n<li>Security defaults enforcement policy state</li>\n<li>PowerShell transcript evidence of the read-only export session</li>\n</ul>\n<h2>Files Created</h2>\n<ul>\n<li>conditional-access-policies.json</li>\n<li>conditional-access-policies-summary.csv</li>\n<li>conditional-access-named-locations.json</li>\n<li>conditional-access-named-locations-summary.csv</li>\n<li>authentication-method-policy.json</li>\n<li>authentication-method-configurations.json</li>\n<li>authorization-policy.json</li>\n<li>security-defaults-policy.json</li>\n<li>entra-security-proof-summary.json</li>\n<li>entra-security-proof-transcript-20260605-043352.txt</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This export is read-only. It supports portfolio proof of Microsoft Entra policy review and tenant security administration awareness. It does not claim production enterprise administration or client tenant ownership.</p></article>",
    "active": "Projects"
  },
  "documentation/c8717b297264": {
    "title": "Microsoft Entra Security Proof Fallback Export",
    "description": "Retained technical documentation: Microsoft Entra Security Proof Fallback Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Security Proof Fallback Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/entra-security-proof-fallback-20260605-043558/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Security Proof Fallback Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains supplemental Microsoft Graph request exports for Conditional Access and authentication method policy evidence.</p>\n<h2>Evidence Value</h2>\n<p>This export records direct Microsoft Graph request results and captures any Graph service errors as preserved troubleshooting evidence.</p>\n<h2>Files Created</h2>\n<ul>\n<li>conditional-access-policies-graph-request.json</li>\n<li>conditional-access-policies-graph-request-beta.json</li>\n<li>authentication-method-policy-graph-request.json</li>\n<li>authentication-method-configurations-graph-request-beta.json</li>\n<li>graph-request-errors.csv</li>\n<li>entra-security-proof-fallback-summary.json</li>\n<li>entra-security-proof-fallback-transcript-20260605-043558.txt</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This is a read-only evidence capture. Failed Graph requests are preserved as troubleshooting evidence and should not be represented as successful policy exports.</p></article>",
    "active": "Projects"
  },
  "documentation/32b2d733621a": {
    "title": "Microsoft 365 / Entra Lab Evidence Export",
    "description": "Retained technical documentation: Microsoft 365 / Entra Lab Evidence Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 / Entra Lab Evidence Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/evidence/entra-exports-20260605-073748/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 / Entra Lab Evidence Export</h2>\n<h2>Export folder</h2>\n<p>C:\\Users\\jeremy\\Documents\\projects\\jeremyfontenot\\evidence-library\\projects\\microsoft-365-lab\\evidence\\entra-exports-20260605-073748</p>\n<h2>Export date</h2>\n<p>2026-06-05 08:08:14</p>\n<h2>Tenant identity evidence</h2>\n<ul>\n<li>tenant-organization-domains-skus.json</li>\n<li>entra-users-license-state.csv</li>\n<li>entra-directory-roles.csv</li>\n<li>entra-directory-role-assignments.csv</li>\n</ul>\n<h2>Group and access-control evidence</h2>\n<ul>\n<li>entra-groups.csv</li>\n<li>entra-group-membership.csv</li>\n<li>entra-sg-block-legacy-auth-group.csv</li>\n<li>entra-sg-block-legacy-auth-members.csv</li>\n</ul>\n<h2>Conditional Access and security policy evidence</h2>\n<ul>\n<li>entra-conditional-access-policies.json</li>\n<li>entra-conditional-access-policies-summary.csv</li>\n<li>entra-conditional-access-named-locations.json</li>\n<li>entra-conditional-access-named-locations-summary.csv</li>\n<li>entra-authentication-methods-policy.json</li>\n<li>entra-authorization-policy-security-defaults.json</li>\n</ul>\n<h2>Application and device evidence</h2>\n<ul>\n<li>entra-applications.csv</li>\n<li>entra-service-principals.csv</li>\n<li>entra-devices.csv</li>\n</ul>\n<h2>Activity and audit evidence</h2>\n<ul>\n<li>entra-signins-last-30-days.csv</li>\n<li>entra-directory-audit-last-30-days.csv</li>\n</ul>\n<h2>Exchange admin center evidence</h2>\n<ul>\n<li>exchange-admin-center-microsoft-365-groups-20260605.png</li>\n<li>exchange-admin-center-microsoft-365-groups-export-20260605.csv</li>\n<li>exchange-online-powershell-connection-attempt.md</li>\n<li>exchange-mail-enabled-security-group-check.md</li>\n</ul>\n<h2>Integrity evidence</h2>\n<ul>\n<li>microsoft-365-lab-evidence-manifest-20260605.csv</li>\n</ul>\n<h2>Evidence interpretation</h2>\n<p>This export documents a personal Microsoft 365 / Entra tenant lab associated with jeremyfontenot@jeremyfontenot.online and jeremyfontenot.online. The evidence includes tenant identity, verified domain/subscription state, directory groups, group membership, Conditional Access policy configuration, authentication-method policy state, authorization/security-defaults policy state, application/service-principal inventory, device inventory, sign-in records, directory audit records, Exchange admin center group evidence, and SHA-256 file integrity hashes.</p>\n<h2>Portfolio-safe proof statement</h2>\n<p>This evidence supports Microsoft 365 / Entra administration, Conditional Access policy review, security group targeting, directory-role review, authentication-method policy review, sign-in/audit-log review, Exchange admin center navigation, and evidence-governance practices in a personal cloud lab.</p>\n<h2>Microsoft 365 admin center portal evidence</h2>\n<ul>\n<li>m365-admin-center-homepage-20260605.png</li>\n<li>m365-admin-center-domains-jeremyfontenot-online-20260605.png</li>\n<li>m365-admin-center-licenses-20260605.png</li>\n<li>m365-admin-center-active-users-20260605.png</li>\n<li>m365-admin-center-active-teams-groups-20260605.png</li>\n</ul>\n<h2>Portal evidence interpretation</h2>\n<p>These screenshots provide browser-based administrative proof for Microsoft 365 admin center access, custom domain configuration, license/subscription visibility, active user review, and Microsoft 365 teams/groups review. They complement the Microsoft Graph exports in this folder.</p></article>",
    "active": "Projects"
  },
  "documentation/4e50e1919fca": {
    "title": "Exchange Admin Center Mail-Enabled Security Group Check",
    "description": "Retained technical documentation: Exchange Admin Center Mail-Enabled Security Group Check",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Exchange Admin Center Mail-Enabled Security Group Check</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/evidence/entra-exports-20260605-073748/exchange-mail-enabled-security-group-check.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Exchange Admin Center Mail-Enabled Security Group Check</h2>\n<h2>Purpose</h2>\n<p>Document whether SG-Block-Legacy-Auth appeared in Exchange admin center under mail-enabled security groups.</p>\n<h2>Date captured</h2>\n<p>2026-06-05 08:06:18</p>\n<h2>Result</h2>\n<p>The Exchange admin center Mail-enabled security tab was blank or did not list SG-Block-Legacy-Auth.</p>\n<h2>Interpretation</h2>\n<p>SG-Block-Legacy-Auth appears to be an Entra ID security group, not a mail-enabled Exchange security group.</p>\n<h2>Evidence Value</h2>\n<p>This confirms that Exchange admin center group evidence and Entra ID group evidence represent different group scopes:\n- Exchange admin center: Microsoft 365 groups and mail-enabled security/distribution groups\n- Entra admin center / Microsoft Graph: directory security groups, Microsoft 365 groups, role/security targeting groups</p>\n<h2>Related Evidence</h2>\n<ul>\n<li>entra-groups.csv</li>\n<li>entra-group-membership.csv</li>\n<li>exchange-admin-center-microsoft-365-groups-20260605.png</li>\n<li>exchange-admin-center-microsoft-365-groups-export-20260605.csv</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/27734febe4b1": {
    "title": "Exchange Online PowerShell Connection Attempt",
    "description": "Retained technical documentation: Exchange Online PowerShell Connection Attempt",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Exchange Online PowerShell Connection Attempt</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/evidence/entra-exports-20260605-073748/exchange-online-powershell-connection-attempt.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Exchange Online PowerShell Connection Attempt</h2>\n<h2>Purpose</h2>\n<p>Document the Exchange Online PowerShell connection attempt during Microsoft 365 lab evidence collection.</p>\n<h2>Tenant</h2>\n<ul>\n<li>Account: jeremyfontenot@jeremyfontenot.online</li>\n<li>Evidence folder: C:\\Users\\jeremy\\Documents\\projects\\jeremyfontenot\\evidence-library\\projects\\microsoft-365-lab\\evidence\\entra-exports-20260605-073748</li>\n<li>Date captured: 2026-06-05 07:54:41</li>\n</ul>\n<h2>Result</h2>\n<p>Exchange Online PowerShell connection failed with a local MSAL / RuntimeBroker / WAM-related token acquisition error.</p>\n<h2>Error Summary</h2>\n<p>Connect-ExchangeOnline failed with:\nSystem.NullReferenceException: Object reference not set to an instance of an object.\nRuntimeBroker / MSAL interactive token acquisition failed.</p>\n<h2>Validation Note</h2>\n<p>Exchange admin center remains accessible through the browser, so Exchange evidence should continue through portal screenshots, exported reports, and available admin-center configuration pages.</p>\n<h2>Evidence Value</h2>\n<p>This record documents:\n- Attempted Exchange Online PowerShell validation\n- Local authentication failure condition\n- Fallback validation path through Exchange admin center</p></article>",
    "active": "Projects"
  },
  "documentation/ea70118ef472": {
    "title": "Historical Microsoft 365 Tenant Summary — jeremyfontenot",
    "description": "Retained technical documentation: Historical Microsoft 365 Tenant Summary — jeremyfontenot",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Historical Microsoft 365 Tenant Summary — jeremyfontenot</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/historical-microsoft-365-tenant-summary-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Historical Microsoft 365 Tenant Summary — jeremyfontenot</h2>\n<h2>Evidence status</h2>\n<p>This document records historical Microsoft 365 lab context for reviewer use. It is a preserved documentation summary, not a live tenant dashboard.</p>\n<h2>Historical environment</h2>\n<ul>\n<li>Tenant name: <code>jeremyfontenot</code></li>\n<li>Primary domain: <code>jeremyfontenot.online</code></li>\n<li>Environment status: subscription canceled; tenant no longer accessible</li>\n<li>Evidence classification: historical Microsoft 365 lab / preserved technical experience</li>\n</ul>\n<h2>Scope documented</h2>\n<p>The tenant was used as a personal cloud lab to study and document Microsoft 365 administration, Exchange Online, SharePoint Online, Microsoft Teams, Entra ID, Conditional Access, Microsoft Defender, identity management, security configuration, administrative workflows, and tenant governance.</p>\n<h2>SharePoint documentation review</h2>\n<p>No preserved SharePoint export files were located in the uploaded repository snapshot.</p>\n<h2>Public-language control</h2>\n<p>Public pages must describe this as a historical Microsoft 365 lab. They must not imply current tenant access, current production administration, active licensing, or a live SharePoint service.</p></article>",
    "active": "Projects"
  },
  "documentation/ecac0949577b": {
    "title": "Intune Managed Device Proof Fallback Export",
    "description": "Retained technical documentation: Intune Managed Device Proof Fallback Export",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Intune Managed Device Proof Fallback Export</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/intune-managed-device-proof-fallback-20260605-044051/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Intune Managed Device Proof Fallback Export</h2>\n<h2>Purpose</h2>\n<p>This folder contains a corrected read-only Microsoft Graph PowerShell export for Intune managed device inventory.</p>\n<h2>What This Evidence Validates</h2>\n<p>This export can validate:</p>\n<ul>\n<li>Intune managed device inventory, if available</li>\n<li>Device compliance state</li>\n<li>Device management agent</li>\n<li>Enrollment date</li>\n<li>Last sync date</li>\n<li>Azure AD / Entra device linkage</li>\n<li>Sanitized user principal domain association</li>\n<li>Intune access or licensing limitations if the export fails</li>\n</ul>\n<h2>Scope Note</h2>\n<p>This export is read-only. Empty or failed Intune results should be represented as licensing, access, or tenant-state limitations, not as successful Intune management proof.</p></article>",
    "active": "Projects"
  },
  "documentation/6dfd6148d68c": {
    "title": "Intune Managed Device Export Limitation Notes",
    "description": "Retained technical documentation: Intune Managed Device Export Limitation Notes",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Intune Managed Device Export Limitation Notes</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/intune-managed-device-proof-fallback-20260605-044051/intune-access-limitation-review-notes.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Intune Managed Device Export Limitation Notes</h2>\n<h2>Evidence Type</h2>\n<p>Microsoft Graph PowerShell attempted export of Intune managed device inventory.</p>\n<h2>Capture Result</h2>\n<p>The export attempted to query Intune managed devices using Microsoft Graph delegated access.</p>\n<p>The request returned an authorization failure from the Microsoft Intune device management endpoint.</p>\n<h2>What This Evidence Validates</h2>\n<p>This evidence validates:</p>\n<ul>\n<li>Microsoft Graph PowerShell access was available.</li>\n<li>The tenant was reachable through Microsoft Graph.</li>\n<li>The Intune managed device endpoint was contacted.</li>\n<li>The export attempt was performed in a controlled, read-only manner.</li>\n<li>Intune managed device inventory could not be exported from the current tenant state due to authorization, licensing, or service access limitations.</li>\n</ul>\n<h2>What This Evidence Does Not Validate</h2>\n<p>This evidence does not validate:</p>\n<ul>\n<li>Active Intune device management</li>\n<li>Managed device enrollment</li>\n<li>Device compliance policy deployment</li>\n<li>Successful Intune inventory access</li>\n</ul>\n<h2>Supporting Files</h2>\n<ul>\n<li>intune-managed-device-proof-fallback-transcript-20260605-044051.txt</li>\n<li>intune-managed-device-proof-summary.json</li>\n<li>intune-managed-devices.json</li>\n<li>intune-managed-devices-sanitized.csv</li>\n</ul>\n<h2>Portfolio Claim Supported</h2>\n<p>This artifact should only be used as evidence of attempted Intune inventory validation and awareness of Microsoft Graph / Intune access boundaries.</p>\n<p>It should not be presented as proof of successful Intune managed device administration.</p></article>",
    "active": "Projects"
  },
  "documentation/709f10d4c094": {
    "title": "Microsoft 365 / Entra Live Proof Summary",
    "description": "Retained technical documentation: Microsoft 365 / Entra Live Proof Summary",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 / Entra Live Proof Summary</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/m365-entra-live-proof-summary-20260605.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 / Entra Live Proof Summary</h2>\n<h2>Evidence Capture Date</h2>\n<p>2026-06-05</p>\n<h2>Tenant Identity</h2>\n<ul>\n<li>Tenant account: jeremyfontenot@jeremyfontenot.online</li>\n<li>Tenant ID: 53598f56-182f-4762-bd05-4586973fb766</li>\n<li>Organization display name: jeremy fontenot</li>\n<li>Custom domain evidence: jeremyfontenot.online</li>\n<li>Capture method: Microsoft Graph PowerShell delegated read-only sessions</li>\n</ul>\n<h2>Evidence Inventory</h2>\n<p>This proof set contains 87 indexed files across 10 Microsoft 365 / Entra evidence folders.</p>\n<h2>Evidence Areas Captured</h2>\n<h3>Tenant and Directory Proof</h3>\n<p>Captured tenant organization metadata, verified domains, sanitized user inventory, group inventory, directory roles, service principals, subscribed SKUs, and Graph transcript evidence.</p>\n<h3>Security and Policy Proof</h3>\n<p>Captured Conditional Access policy data through direct Microsoft Graph requests, named locations, authentication method policy, authorization policy, security defaults policy, and related transcript/error evidence.</p>\n<h3>Activity Proof</h3>\n<p>Captured recent Microsoft Entra directory audit logs and sign-in logs, proving activity-log visibility and tenant authentication/audit review capability.</p>\n<h3>Device Proof</h3>\n<p>Captured Entra directory device inventory. Intune managed device export attempts were preserved separately as access/licensing/API limitation evidence.</p>\n<h3>Role Assignment Proof</h3>\n<p>Captured directory roles and sanitized role membership review, supporting privileged access review awareness.</p>\n<h3>Application Governance Proof</h3>\n<p>Captured app registrations, enterprise applications/service principals, and OAuth permission grants, supporting cloud app governance and consent-review awareness.</p>\n<h3>License Proof</h3>\n<p>Captured subscribed SKUs, service plans, and sanitized user license assignment review.</p>\n<h3>Group Membership Proof</h3>\n<p>Captured group inventory and sanitized group membership rows.</p>\n<h2>Integrity Files</h2>\n<ul>\n<li>m365-entra-proof-inventory-20260605.csv</li>\n<li>m365-entra-proof-hashes-20260605.csv</li>\n</ul>\n<p>The hash file contains SHA-256 fingerprints for all 87 indexed proof files.</p>\n<h2>What This Evidence Validates</h2>\n<p>This evidence validates:</p>\n<ul>\n<li>Access to a real Microsoft 365 / Microsoft Entra tenant</li>\n<li>Tenant association with jeremyfontenot.online</li>\n<li>Microsoft Graph PowerShell administration capability</li>\n<li>Read-only tenant inventory export workflow</li>\n<li>Identity, group, role, application, license, device, activity-log, and security policy review</li>\n<li>Evidence capture discipline with transcript, inventory, and SHA-256 integrity records</li>\n</ul>\n<h2>What This Evidence Does Not Claim</h2>\n<p>This evidence does not claim:</p>\n<ul>\n<li>Enterprise production tenant ownership</li>\n<li>Client tenant administration</li>\n<li>Active Intune managed device administration</li>\n<li>Active production Conditional Access enforcement beyond exported policy data</li>\n<li>Current SharePoint availability</li>\n<li>Current paid subscription status beyond exported SKU/license records</li>\n</ul>\n<h2>Portfolio Use</h2>\n<p>This proof set supports the portfolio claim that the Microsoft 365 tenant and custom domain were used as a personal cloud administration lab and that tenant state was captured using Microsoft Graph PowerShell in a controlled, read-only manner.</p></article>",
    "active": "Projects"
  },
  "documentation/fdc60714782e": {
    "title": "Microsoft 365 / Entra Site Proof Map",
    "description": "Retained technical documentation: Microsoft 365 / Entra Site Proof Map",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 / Entra Site Proof Map</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/m365-entra-site-proof-map-20260605.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 / Entra Site Proof Map</h2>\n<p>Date: 2026-06-05</p>\n<p>Last reviewed: 2026-06-15</p>\n<h2>Purpose</h2>\n<p>This control document maps public portfolio claims to repository-local Microsoft 365 / Entra proof files. It exists to prevent unsupported public wording from appearing on the portfolio.</p>\n<p>Public Microsoft 365 / Entra claims must remain:</p>\n<ul>\n<li>Repository-local.</li>\n<li>Evidence-backed.</li>\n<li>Limited to the proof files listed here.</li>\n<li>Clear about lab scope and documented limitations.</li>\n</ul>\n<h2>Scope Boundaries</h2>\n<h3>Supported Scope</h3>\n<ul>\n<li>Personal Microsoft 365 / Entra cloud administration lab.</li>\n<li>Read-only Microsoft Graph PowerShell evidence capture.</li>\n<li>Tenant inventory review.</li>\n<li>Identity and access review.</li>\n<li>Conditional Access review.</li>\n<li>Security group targeting.</li>\n<li>App governance review.</li>\n<li>License review.</li>\n<li>Sign-in and audit review.</li>\n<li>Admin center evidence.</li>\n<li>Exchange admin center evidence.</li>\n<li>Sanitized exports.</li>\n<li>SHA-256 proof records.</li>\n</ul>\n<h3>Unsupported Scope</h3>\n<ul>\n<li>Production tenant administration.</li>\n<li>Client tenant administration.</li>\n<li>Enterprise impact metrics.</li>\n<li>Managed Intune fleet.</li>\n<li>Full endpoint management.</li>\n<li>Active home lab infrastructure.</li>\n<li>Proxmox, pfSense, VLAN, or AD DS home lab proof inside this Microsoft 365 / Entra proof scope.</li>\n<li>Current SharePoint availability.</li>\n</ul>\n<h2>Reviewer Notes</h2>\n<ul>\n<li>Public claims must be backed by repository-local proof files, not memory, intent, screenshots stored elsewhere, or undocumented prior work.</li>\n<li>Proof files listed here are the claim boundary for the Microsoft 365 / Entra public surface.</li>\n<li>Do not upgrade lab evidence into production, client, enterprise, SOC, uptime, or business-impact language.</li>\n<li>Do not use Microsoft 365 / Entra proof to support Proxmox, pfSense, VLAN, or AD DS home lab claims unless a separate on-prem home lab evidence file supports that claim.</li>\n<li>SHA-256 records support integrity review for recorded files; they are not a tamper-proof guarantee beyond the captured hashes.</li>\n<li>Intune evidence is limited to the documented validation attempt and limitation notes. It does not support managed Intune fleet administration.</li>\n<li>Conditional Access wording must describe exported policy review and exported policy state. It must not imply client production enforcement or broad enterprise enforcement metrics.</li>\n<li>If a referenced proof file is missing during future review, keep the reference visible and mark it as missing instead of deleting it.</li>\n</ul>\n<h2>Supported Claims</h2>\n<h3>Microsoft Graph PowerShell Evidence Capture</h3>\n<ul>\n<li>Public claim: Microsoft Graph PowerShell evidence capture.</li>\n<li>Proof file: <code>m365-entra-live-proof-summary-20260605.md</code></li>\n<li>Proof type: Summary with capture method.</li>\n<li>Supported wording: Performed read-only Microsoft Graph PowerShell evidence capture from a personal Microsoft 365 / Entra tenant.</li>\n<li>Page using claim: <code>index.html</code>, <code>projects.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Tenant Identity and Organization Inventory</h3>\n<ul>\n<li>Public claim: Tenant identity and organization inventory.</li>\n<li>Proof file: <code>evidence/entra-exports-20260605-073748/tenant-organization-domains-skus.json</code></li>\n<li>Proof type: JSON export.</li>\n<li>Supported wording: Reviewed tenant ID, tenant account, organization display name, verified domains, and subscribed SKU records.</li>\n<li>Page using claim: <code>index.html</code>, <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Verified Domains</h3>\n<ul>\n<li>Public claim: Verified domains.</li>\n<li>Proof file: <code>evidence/entra-exports-20260605-073748/tenant-organization-domains-skus.json</code></li>\n<li>Proof type: JSON export.</li>\n<li>Supported wording: Verified two domains including <code>jeremyfontenot.online</code>.</li>\n<li>Page using claim: <code>index.html</code>, <code>dashboard.html</code>, <code>projects.html</code></li>\n</ul>\n<h3>Users and Groups</h3>\n<ul>\n<li>Public claim: Users and groups.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-users-license-state.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-groups.csv</code></li>\n<li>Proof type: Sanitized CSV exports.</li>\n<li>Supported wording: Reviewed seven user license-state rows and eight group rows.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Directory Role Review</h3>\n<ul>\n<li>Public claim: Directory role review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-directory-roles.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-directory-role-assignments.csv</code></li>\n<li>Proof type: CSV exports.</li>\n<li>Supported wording: Reviewed directory roles and role assignment records for privileged-access awareness.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Application Governance / Service Principals</h3>\n<ul>\n<li>Public claim: Application governance / service principals.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-service-principals.csv</code></li>\n<li><code>entra-application-proof-20260605-063206/enterprise-applications-summary.csv</code></li>\n<li>Proof type: CSV exports.</li>\n<li>Supported wording: Reviewed enterprise applications and service principals for governance awareness.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>dashboard.html</code></li>\n</ul>\n<h3>App Registrations</h3>\n<ul>\n<li>Public claim: App registrations.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-applications.csv</code></li>\n<li><code>entra-application-proof-20260605-063206/app-registrations-summary.csv</code></li>\n<li>Proof type: CSV exports.</li>\n<li>Supported wording: Reviewed eight app registration records.</li>\n<li>Page using claim: <code>projects.html</code>, <code>dashboard.html</code></li>\n</ul>\n<h3>OAuth Grants</h3>\n<ul>\n<li>Public claim: OAuth grants.</li>\n<li>Proof file: <code>entra-application-proof-20260605-063206/oauth2-permission-grants-summary.csv</code></li>\n<li>Proof type: CSV export.</li>\n<li>Supported wording: Reviewed 16 OAuth permission grant records.</li>\n<li>Page using claim: <code>projects.html</code>, <code>dashboard.html</code></li>\n</ul>\n<h3>License and Service Plan Review</h3>\n<ul>\n<li>Public claim: License and service plan review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/tenant-organization-domains-skus.json</code></li>\n<li><code>entra-license-proof-20260605-063412/subscribed-sku-service-plans.csv</code></li>\n<li>Proof type: JSON and CSV exports.</li>\n<li>Supported wording: Reviewed three subscribed SKUs, 68 service plans, and one licensed user record.</li>\n<li>Page using claim: <code>projects.html</code>, <code>dashboard.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Conditional Access Review</h3>\n<ul>\n<li>Public claim: Conditional Access review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-conditional-access-policies-summary.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-conditional-access-policies.json</code></li>\n<li>Proof type: CSV and JSON exports.</li>\n<li>Supported wording: Reviewed exported Conditional Access policy records, including enabled policy rows.</li>\n<li>Page using claim: <code>index.html</code>, <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Security Group Targeting</h3>\n<ul>\n<li>Public claim: Security group targeting.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-sg-block-legacy-auth-group.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-sg-block-legacy-auth-members.csv</code></li>\n<li>Proof type: CSV exports.</li>\n<li>Supported wording: Reviewed SG-Block-Legacy-Auth group targeting and membership evidence.</li>\n<li>Page using claim: <code>index.html</code>, <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Authentication and Security Policy Review</h3>\n<ul>\n<li>Public claim: Authentication and security policy review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-authentication-methods-policy.json</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-authorization-policy-security-defaults.json</code></li>\n<li>Proof type: JSON exports.</li>\n<li>Supported wording: Reviewed authentication-method policy and authorization/security-defaults state.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Audit and Sign-In Log Review</h3>\n<ul>\n<li>Public claim: Audit and sign-in log review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-signins-last-30-days.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/entra-directory-audit-last-30-days.csv</code></li>\n<li>Proof type: CSV exports.</li>\n<li>Supported wording: Reviewed sign-in and directory audit visibility from exported records.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>dashboard.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Device Inventory Review</h3>\n<ul>\n<li>Public claim: Device inventory review.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/entra-devices.csv</code></li>\n<li><code>entra-device-proof-20260605-043942/entra-device-proof-summary.json</code></li>\n<li>Proof type: CSV and JSON exports.</li>\n<li>Supported wording: Reviewed Entra device inventory.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Intune Validation Limitation</h3>\n<ul>\n<li>Public claim: Intune validation limitation.</li>\n<li>Proof files:</li>\n<li><code>intune-managed-device-proof-fallback-20260605-044051/README.md</code></li>\n<li><code>intune-managed-device-proof-fallback-20260605-044051/intune-managed-device-proof-summary.json</code></li>\n<li>Proof type: Limitation note and JSON summary.</li>\n<li>Supported wording: Documented Intune managed-device validation attempt with access/licensing or API-scope limitation.</li>\n<li>Page using claim: <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Microsoft 365 Admin Center Evidence</h3>\n<ul>\n<li>Public claim: Microsoft 365 admin center evidence.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/m365-admin-center-homepage-20260605.png</code></li>\n<li><code>evidence/entra-exports-20260605-073748/m365-admin-center-domains-jeremyfontenot-online-20260605.png</code></li>\n<li><code>evidence/entra-exports-20260605-073748/m365-admin-center-licenses-20260605.png</code></li>\n<li>Proof type: Screenshots.</li>\n<li>Supported wording: Reviewed Microsoft 365 admin center access, domain visibility, license visibility, users, and groups.</li>\n<li>Page using claim: <code>index.html</code>, <code>proof.html</code>, <code>resume.html</code>, <code>contact.html</code></li>\n</ul>\n<h3>Exchange Admin Center Evidence</h3>\n<ul>\n<li>Public claim: Exchange admin center evidence.</li>\n<li>Proof files:</li>\n<li><code>evidence/entra-exports-20260605-073748/exchange-admin-center-microsoft-365-groups-20260605.png</code></li>\n<li><code>evidence/entra-exports-20260605-073748/exchange-admin-center-microsoft-365-groups-export-20260605.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/exchange-online-powershell-connection-attempt.md</code></li>\n<li>Proof type: Screenshot, CSV export, documentation note.</li>\n<li>Supported wording: Reviewed Exchange admin center Microsoft 365 groups evidence and connection-attempt documentation.</li>\n<li>Page using claim: <code>projects.html</code>, <code>proof.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>SHA-256 Proof Integrity</h3>\n<ul>\n<li>Public claim: SHA-256 proof integrity.</li>\n<li>Proof files:</li>\n<li><code>m365-entra-proof-hashes-20260605.csv</code></li>\n<li><code>evidence/entra-exports-20260605-073748/microsoft-365-lab-evidence-manifest-20260605.csv</code></li>\n<li>Proof type: Hash CSV and manifest.</li>\n<li>Supported wording: Maintained SHA-256 indexed proof records for evidence integrity review.</li>\n<li>Page using claim: <code>index.html</code>, <code>proof.html</code>, <code>dashboard.html</code>, <code>resume.html</code></li>\n</ul>\n<h3>Proof Inventory Count</h3>\n<ul>\n<li>Public claim: Proof inventory count.</li>\n<li>Proof files:</li>\n<li><code>m365-entra-proof-inventory-20260605.csv</code></li>\n<li><code>m365-entra-proof-hashes-20260605.csv</code></li>\n<li>Proof type: Inventory and hash CSVs.</li>\n<li>Supported wording: Dashboard counts represent captured evidence inventory and hash records only.</li>\n<li>Page using claim: <code>dashboard.html</code>, <code>proof.html</code></li>\n</ul>\n<h2>Unsupported Claims</h2>\n<h3>Microsoft Graph PowerShell Evidence Capture</h3>\n<ul>\n<li>Unsupported wording to avoid: Production tenant administration; client tenant administration.</li>\n</ul>\n<h3>Tenant Identity and Organization Inventory</h3>\n<ul>\n<li>Unsupported wording to avoid: Enterprise tenant ownership; paid subscription claim beyond exported SKU records.</li>\n</ul>\n<h3>Verified Domains</h3>\n<ul>\n<li>Unsupported wording to avoid: Current SharePoint availability; production domain administration.</li>\n</ul>\n<h3>Users and Groups</h3>\n<ul>\n<li>Unsupported wording to avoid: Managed workforce; enterprise user population.</li>\n</ul>\n<h3>Directory Role Review</h3>\n<ul>\n<li>Unsupported wording to avoid: Production privileged-access program ownership.</li>\n</ul>\n<h3>Application Governance / Service Principals</h3>\n<ul>\n<li>Unsupported wording to avoid: Client app governance; production app portfolio ownership.</li>\n</ul>\n<h3>App Registrations</h3>\n<ul>\n<li>Unsupported wording to avoid: Built or operated all app registrations in production.</li>\n</ul>\n<h3>OAuth Grants</h3>\n<ul>\n<li>Unsupported wording to avoid: Enterprise consent program ownership.</li>\n</ul>\n<h3>License and Service Plan Review</h3>\n<ul>\n<li>Unsupported wording to avoid: Current paid subscription status beyond exported records.</li>\n</ul>\n<h3>Conditional Access Review</h3>\n<ul>\n<li>Unsupported wording to avoid: Client production enforcement; broad enterprise enforcement metrics.</li>\n</ul>\n<h3>Security Group Targeting</h3>\n<ul>\n<li>Unsupported wording to avoid: Organization-wide endpoint fleet management.</li>\n</ul>\n<h3>Authentication and Security Policy Review</h3>\n<ul>\n<li>Unsupported wording to avoid: Security program ownership in production.</li>\n</ul>\n<h3>Audit and Sign-In Log Review</h3>\n<ul>\n<li>Unsupported wording to avoid: SOC ownership; enterprise detection metrics.</li>\n</ul>\n<h3>Device Inventory Review</h3>\n<ul>\n<li>Unsupported wording to avoid: Managed Intune fleet; full endpoint management.</li>\n</ul>\n<h3>Intune Validation Limitation</h3>\n<ul>\n<li>Unsupported wording to avoid: Active Intune administration; managed Intune fleet.</li>\n</ul>\n<h3>Microsoft 365 Admin Center Evidence</h3>\n<ul>\n<li>Unsupported wording to avoid: Current SharePoint hosting; production administration.</li>\n</ul>\n<h3>Exchange Admin Center Evidence</h3>\n<ul>\n<li>Unsupported wording to avoid: Exchange production administration; mail-flow ownership metrics.</li>\n</ul>\n<h3>SHA-256 Proof Integrity</h3>\n<ul>\n<li>Unsupported wording to avoid: Tamper-proof guarantee beyond recorded hashes.</li>\n</ul>\n<h3>Proof Inventory Count</h3>\n<ul>\n<li>Unsupported wording to avoid: Employment metrics; client impact metrics; production uptime metrics.</li>\n</ul>\n<h2>Safe Portfolio Language</h2>\n<p>Use wording such as:</p>\n<ul>\n<li>Reviewed exported Microsoft 365 / Entra records.</li>\n<li>Documented tenant inventory, identity records, groups, roles, applications, licenses, devices, sign-ins, and audit logs.</li>\n<li>Captured read-only evidence from a personal Microsoft 365 / Entra lab tenant.</li>\n<li>Validated exported records against repository-local proof files.</li>\n<li>Mapped public claims to repository-local proof.</li>\n<li>Maintained SHA-256 indexed proof records for evidence integrity review.</li>\n<li>Documented Intune managed-device validation limitations.</li>\n<li>Reviewed exported Conditional Access policy records and related security policy state.</li>\n<li>Evidence-backed portfolio documentation.</li>\n</ul>\n<h2>Language to Avoid</h2>\n<p>Avoid wording that implies:</p>\n<ul>\n<li>Managed enterprise environment.</li>\n<li>Owned production tenant.</li>\n<li>Implemented across organization.</li>\n<li>Reduced risk by X%.</li>\n<li>Improved uptime.</li>\n<li>SOC monitoring or SOC ownership.</li>\n<li>Managed Intune fleet.</li>\n<li>Production deployment.</li>\n<li>Client environment.</li>\n<li>Production tenant administration.</li>\n<li>Enterprise tenant ownership.</li>\n<li>Full endpoint management.</li>\n<li>Current SharePoint availability.</li>\n<li>Tamper-proof guarantee beyond recorded hashes.</li>\n<li>Enterprise impact metrics.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/5a44ea441d55": {
    "title": "Microsoft 365 Lab Architecture Overview 2026",
    "description": "Retained technical documentation: Microsoft 365 Lab Architecture Overview 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 Lab Architecture Overview 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/microsoft-365-lab/microsoft-365-lab-architecture-overview-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 Lab Architecture Overview 2026</h2>\n<p>Status: Sanitized lab architecture overview\nScope: Microsoft 365 administration concepts connected to the home lab portfolio\nEvidence type: Architecture documentation</p>\n<h2>Purpose</h2>\n<p>This document records how Microsoft 365 lab concepts connect to identity, endpoint management, automation, security baselines, and validation workflows. It is intended as honest supporting documentation for portfolio review and migration planning.</p>\n<p>This document does not claim enterprise tenant ownership, client work, completed deployment, or completed validation beyond evidence available elsewhere in the repository.</p>\n<h2>Objective</h2>\n<p>Create a tenant-safe architecture record that explains how identity, endpoint policy, access control, automation, and validation would be organized in a Microsoft ecosystem support workflow.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Microsoft 365 administration and tenant-safe documentation.</li>\n<li>Entra ID and Conditional Access planning.</li>\n<li>Active Directory and hybrid administration fundamentals.</li>\n<li>Intune and endpoint policy review.</li>\n<li>PowerShell automation for repeatable administrative tasks.</li>\n<li>Security baseline planning and rollback awareness.</li>\n<li>Documentation, change review, and validation methodology.</li>\n</ul>\n<h2>Architecture Themes</h2>\n<ul>\n<li>Identity and access management through Microsoft Entra ID concepts.</li>\n<li>Endpoint management through Intune policy and baseline concepts.</li>\n<li>Hybrid administration concepts connecting Windows administration, Active Directory fundamentals, and cloud administration workflows.</li>\n<li>PowerShell automation for repeatable administrative tasks.</li>\n<li>Documentation and validation as evidence of operational maturity.</li>\n</ul>\n<h2>Identity Implementation Workflow</h2>\n<p>Microsoft 365 administration depends on controlled identity practices. A reviewer-ready workflow should record:</p>\n<ul>\n<li>User lifecycle intake, group assignment, and account deprovisioning criteria.</li>\n<li>Conditional Access policy purpose, target scope, exclusions, and expected user impact.</li>\n<li>MFA and sign-in risk awareness for privileged and standard users.</li>\n<li>Role-based administrative access and least-privilege review.</li>\n<li>Audit and change tracking for policy or group membership updates.</li>\n</ul>\n<p>Future evidence should use real tenant configuration exports, screenshots, or policy documentation when available.</p>\n<h2>Endpoint Management Workflow</h2>\n<p>Endpoint management documentation should describe the implementation sequence:</p>\n<ul>\n<li>Define device enrollment goals and supported ownership model.</li>\n<li>Document baseline policy intent before deployment.</li>\n<li>Review compliance evaluation criteria and user impact.</li>\n<li>Record application or configuration deployment process.</li>\n<li>Troubleshoot failed policy application using device status, assignment scope, sync timing, and event logs.</li>\n</ul>\n<p>Do not present a policy as deployed unless it is backed by actual lab evidence.</p>\n<h2>Hybrid Administration Concepts</h2>\n<p>The home lab context supports hybrid thinking by combining:</p>\n<ul>\n<li>Windows Server and Active Directory fundamentals.</li>\n<li>DNS and DHCP operational understanding.</li>\n<li>Endpoint support workflows.</li>\n<li>Microsoft 365 administration concepts.</li>\n<li>PowerShell automation for repeatable operations.</li>\n</ul>\n<p>This combination is valuable for entry-level system administration and service desk roles because it shows the ability to reason across local and cloud administration boundaries.</p>\n<h2>Automation Concepts</h2>\n<p>Automation should be used to:</p>\n<ul>\n<li>Standardize validation.</li>\n<li>Reduce manual documentation drift.</li>\n<li>Collect repeatable evidence.</li>\n<li>Review repository and site health.</li>\n<li>Support controlled change workflows.</li>\n</ul>\n<p>PowerShell scripts should include clear parameters, safe defaults, error handling, and documentation of expected input and output.</p>\n<h2>Security Baseline Concepts</h2>\n<p>Security baseline documentation should include:</p>\n<ul>\n<li>Policy purpose.</li>\n<li>Target users or devices.</li>\n<li>Risk addressed.</li>\n<li>Expected user impact.</li>\n<li>Validation method.</li>\n<li>Rollback or exception process.</li>\n</ul>\n<h2>Operational Workflow</h2>\n<p>A strong Microsoft 365 lab evidence package should preserve:</p>\n<ol>\n<li>Planning and policy intent.</li>\n<li>Configuration or script artifact.</li>\n<li>Validation checklist.</li>\n<li>Troubleshooting notes.</li>\n<li>Change record or review notes.</li>\n<li>Archive support for historical context.</li>\n</ol>\n<h2>Validation Considerations</h2>\n<p>Before any public claim or future migration, each Microsoft 365 artifact should be reviewed for:</p>\n<ul>\n<li>Whether it is source documentation, generated export, screenshot, or configuration.</li>\n<li>Whether it includes real evidence or planned documentation.</li>\n<li>Whether tenant-specific sensitive data has been removed.</li>\n<li>Whether claims are limited to lab, preserved, or planning context.</li>\n</ul>\n<h2>Verification Checklist</h2>\n<ul>\n<li>Confirm configuration files contain no tenant secrets, private IDs, or credentials.</li>\n<li>Confirm policy descriptions include purpose, scope, control, exception, and rollback notes.</li>\n<li>Confirm diagrams match the written administration boundaries.</li>\n<li>Confirm proof links resolve from the public portfolio pages.</li>\n<li>Confirm claims do not imply enterprise tenant ownership or customer work.</li>\n</ul>\n<h2>Evidence Still Needed</h2>\n<ul>\n<li>Current authoritative policy documentation.</li>\n<li>Tenant-safe screenshots or exports if available.</li>\n<li>Validation checklist results for policy behavior.</li>\n<li>Troubleshooting notes for failed or corrected configurations.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/921108660318": {
    "title": "Monitoring and Alerting Overview 2026",
    "description": "Retained technical documentation: Monitoring and Alerting Overview 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Monitoring and Alerting Overview 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/monitoring-logging/monitoring-alerting-overview-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Monitoring and Alerting Overview 2026</h2>\n<p>Status: Sanitized operational overview\nScope: Home lab monitoring, logging, and alert response planning\nEvidence type: Monitoring documentation</p>\n<h2>Purpose</h2>\n<p>This overview documents monitoring and alerting practices suitable for the home lab environment. It supports portfolio evidence for operational awareness, validation, and escalation discipline without claiming that a specific monitoring platform or alert result has been deployed unless separately proven.</p>\n<h2>Objective</h2>\n<p>Define how lab monitoring should identify service availability, network path failures, recurring system health issues, backup uncertainty, and security-boundary events that require escalation.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Proxmox host health review.</li>\n<li>pfSense interface, gateway, VPN, and firewall event monitoring.</li>\n<li>DNS/DHCP service health checks.</li>\n<li>Windows and Linux log review.</li>\n<li>Backup job status review.</li>\n<li>Alert prioritization, escalation, and RCA triggers.</li>\n<li>Evidence capture for troubleshooting and validation.</li>\n</ul>\n<h2>Monitoring Philosophy</h2>\n<p>Monitoring should answer practical operational questions:</p>\n<ul>\n<li>Is the service available?</li>\n<li>Is the system healthy?</li>\n<li>Is the network path working?</li>\n<li>Is a recurring failure developing?</li>\n<li>Is the alert actionable?</li>\n<li>What evidence should be collected before remediation?</li>\n</ul>\n<p>Good monitoring reduces guesswork. It should support troubleshooting and validation rather than create alert noise.</p>\n<h2>Infrastructure Visibility</h2>\n<p>Recommended visibility areas:</p>\n<ul>\n<li>Proxmox host health and resource usage.</li>\n<li>pfSense interface status and firewall events.</li>\n<li>DNS and DHCP service health.</li>\n<li>Active Directory service availability.</li>\n<li>Windows and Linux system logs.</li>\n<li>Backup job status.</li>\n<li>Validation script results.</li>\n<li>Static site validation and deployment checks.</li>\n</ul>\n<h2>Firewall Monitoring</h2>\n<p>pfSense monitoring should focus on:</p>\n<ul>\n<li>Interface status.</li>\n<li>Gateway health.</li>\n<li>Blocked traffic during troubleshooting windows.</li>\n<li>VPN connection events.</li>\n<li>Rule changes.</li>\n<li>Unexpected inter-zone traffic attempts.</li>\n</ul>\n<p>Firewall logs should be used carefully. High-volume deny logs can hide useful events, so log review should focus on a specific hypothesis.</p>\n<h2>DNS/DHCP Monitoring</h2>\n<p>DNS and DHCP monitoring should focus on:</p>\n<ul>\n<li>DNS service availability.</li>\n<li>Failed resolution patterns.</li>\n<li>DHCP scope utilization.</li>\n<li>Lease assignment failures.</li>\n<li>Reservation conflicts.</li>\n<li>Domain controller discovery issues where AD is in scope.</li>\n</ul>\n<h2>System Health Validation</h2>\n<p>System health validation should include:</p>\n<ul>\n<li>CPU, memory, disk, and network utilization.</li>\n<li>Service status for critical lab roles.</li>\n<li>Event log review after changes.</li>\n<li>Patch or reboot follow-up checks.</li>\n<li>Backup job review.</li>\n</ul>\n<h2>Log Review Practices</h2>\n<p>Effective log review should document:</p>\n<ul>\n<li>Time range.</li>\n<li>Affected system.</li>\n<li>Event source.</li>\n<li>Error codes.</li>\n<li>Related configuration changes.</li>\n<li>Follow-up action.</li>\n</ul>\n<p>Avoid copying large logs into portfolio evidence. Summarize findings and retain the source evidence path.</p>\n<h2>Alert Prioritization</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Priority</th>\n<th>Condition</th>\n<th>Action</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Critical</td>\n<td>Service unavailable or security boundary affected</td>\n<td>Investigate immediately and preserve evidence</td>\n</tr>\n<tr>\n<td>High</td>\n<td>Repeated failure or multiple affected systems</td>\n<td>Triage and escalate if scope expands</td>\n</tr>\n<tr>\n<td>Medium</td>\n<td>Single-system issue with workaround</td>\n<td>Document and schedule remediation</td>\n</tr>\n<tr>\n<td>Low</td>\n<td>Informational or maintenance event</td>\n<td>Review during routine operations</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Operational Escalation Concepts</h2>\n<p>Escalate when:</p>\n<ul>\n<li>Multiple systems are affected.</li>\n<li>A security boundary is involved.</li>\n<li>DNS, DHCP, AD, VPN, or firewall behavior is unstable.</li>\n<li>Backup or restore capability is uncertain.</li>\n<li>A recurring issue needs root cause analysis.</li>\n</ul>\n<h2>Evidence Still Needed</h2>\n<ul>\n<li>Monitoring dashboard screenshot from the actual lab.</li>\n<li>Alert configuration export.</li>\n<li>Validation script output.</li>\n<li>Firewall log review sample from a real troubleshooting window.</li>\n<li>DNS/DHCP service health check record.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/5d187cba2bc7": {
    "title": "Active Directory Service Desk Delegation Validation",
    "description": "Retained technical documentation: Active Directory Service Desk Delegation Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Active Directory Service Desk Delegation Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/ad-service-desk-delegation/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Active Directory Service Desk Delegation Validation</h2>\n<p>Captured: 2026-09-05</p>\n<p>Classification: sanitized public personal-lab evidence</p>\n<h2>Preservation and derivative relationship</h2>\n<p>This public file is a sanitized presentation derivative. The first captured evidence is retained byte-for-byte in <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/ad-service-desk-delegation/source-original/README.md\" rel=\"noopener noreferrer\" target=\"_blank\"><code>source-original/</code></a>. The derivative preserves the validated tasks, results, scope, and limitations while omitting unnecessary raw directory identifiers.</p>\n<h2>Purpose</h2>\n<p>This evidence records a least-privilege Active Directory delegation exercise in the personal nonproduction <code>ad.jeremyfontenot.online</code> lab. The goal was to allow a Service Desk security group to perform bounded user-support and group-membership tasks without Domain Admin rights.</p>\n<h2>Delegated principal</h2>\n<ul>\n<li>Security group: <code>JFAD\\GG-ServiceDesk</code></li>\n<li>Validation account: <code>JFAD\\sd.tech</code></li>\n<li>Scope: <code>OU=Service Desk,OU=Users,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></li>\n</ul>\n<h2>Validated user-support rights</h2>\n<p>The Service Desk OU ACL was configured with explicit, non-inherited rights that apply to descendant user objects:</p>\n<ul>\n<li>Reset Password extended right</li>\n<li>Write <code>lockoutTime</code> for account unlock</li>\n<li>Write <code>pwdLastSet</code> for force-password-change-at-next-logon</li>\n</ul>\n<p>The validation account successfully:</p>\n<ul>\n<li>reset the password of a separate test user;</li>\n<li>unlocked a deliberately locked test user; and</li>\n<li>set the test user to change password at next logon.</li>\n</ul>\n<p>A negative-control test confirmed that the same account could <strong>not</strong> disable the test account and received <code>Insufficient access rights to perform the operation</code>.</p>\n<h2>Validated group-membership delegation</h2>\n<p><code>JFAD\\GG-ServiceDesk</code> was granted explicit <code>WriteProperty</code> permission on only the <code>member</code> attribute of <code>GG-RDP-Allowed</code>.</p>\n<p>An Active Directory schema lookup confirmed that the ACL object type used for this delegation maps to the LDAP <code>member</code> attribute. The raw schema identifier is intentionally omitted from the public derivative because the attribute-name mapping is sufficient to support the bounded claim.</p>\n<p>The validation account successfully added and removed a test user from <code>GG-RDP-Allowed</code>.</p>\n<p>A negative-control test confirmed it could <strong>not</strong> add the same test user to <code>GG-Lab-Admins</code> and received <code>Insufficient access rights to perform the operation</code>.</p>\n<h2>Result</h2>\n<p><strong>PASS — bounded least-privilege Service Desk delegation was configured and functionally validated.</strong></p>\n<p>The evidence supports a personal-lab claim of scoped Active Directory delegation for common Service Desk operations. It does not claim enterprise directory ownership, production change authority, privileged-access-management deployment, or organization-wide RBAC governance.</p>\n<h2>Evidence files</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/ad-service-desk-delegation/validation-public.txt\" rel=\"noopener noreferrer\" target=\"_blank\">Public validation summary</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/ad-service-desk-delegation/evidence-manifest.json\" rel=\"noopener noreferrer\" target=\"_blank\">Evidence manifest</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/ad-service-desk-delegation/index.html\" rel=\"noopener noreferrer\" target=\"_blank\">Public presentation page</a></li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/85e602a93ca1": {
    "title": "Current Validated State",
    "description": "Retained technical documentation: Current Validated State",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Current Validated State</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Current Validated State</h2>\n<p>This public evidence folder summarizes reviewer-safe records from the private home-lab operations repository without exposing private repository links. Public claims use stable classifications instead of date-based proof labels. The <code>direct-evidence/</code> folder contains sanitized direct artifacts for the current infrastructure claims.</p>\n<h2>Document</h2>\n<ul>\n<li>Title: Jeremy Fontenot’s On-Premises Home Lab Documentation</li>\n<li>Filename: <code>Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx</code></li>\n<li>Download description: Download the Professional Home Lab Documentation (.docx)</li>\n<li>SHA-256: <code>D7E81A06DCFBD2E91EB8F52A02BDC795AC5B7084A70F343233F1104CCD297BDB</code></li>\n</ul>\n<h2>Source Commits</h2>\n<ul>\n<li>Website source commit at generation: <code>effdbeb0ed8d632a0b0c93328cd593cf85c3eb46</code></li>\n<li>Home-lab source commit for direct evidence: <code>fb6c286873285778d88d6d5cfde0b9bd00b96f36</code></li>\n</ul>\n<h2>Supported Public Claims</h2>\n<ul>\n<li>Personal nonproduction lab hosted on Dell PowerEdge R710 with Proxmox VE 9.2.3.</li>\n<li>pfSense, DC01, WS01, and Linux01 are the primary lab VMs described by current records.</li>\n<li>Linux01 current supported placement is VLAN 30 at <code>10.10.30.20/24</code>; older <code>10.10.20.x</code> Linux01 evidence is historical.</li>\n<li>DC01 direct evidence supports Windows Server 2022, AD DS, DNS, DHCP, Group Policy Management, Global Catalog status, FSMO ownership, and DC01 IP.</li>\n<li>WS01 direct evidence supports Windows 10 Pro, domain membership, secure channel, and current network state.</li>\n<li>Linux01 direct evidence supports Ubuntu 26.04 LTS, kernel, VLAN 30, current IP/gateway/DNS, current-versus-historical address boundary, and directly proven domain integration indicators.</li>\n<li>Linux01 SSSD remediation is documented as remediated and validated for Linux01 only.</li>\n<li>Backup job configuration and retained backup counts are supported; all-recent-backups-succeeded, recurring disaster-recovery assurance, RTO, and RPO are not claimed.</li>\n<li>One isolated Linux01 restore drill is supported; it does not prove recurring restore assurance.</li>\n</ul>\n<h2>Direct Evidence Links</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-platform-inventory.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct Proxmox inventory</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-backup-configuration.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct backup configuration</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-backup-inventory.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct backup inventory</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-restore-validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct restore validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/dc01-system-and-role-validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct DC01 validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/ws01-system-and-domain-validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct WS01 validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/linux01-system-network-domain-validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct Linux01 validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/linux01-sssd-remediation-validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open direct SSSD remediation validation</a></li>\n</ul>\n<h2>Limitations</h2>\n<p>Personal lab evidence does not represent employer production administration, client infrastructure ownership, enterprise scale, guaranteed uptime, full firewall assurance, or full security assurance. Timeout observations remain timeout observations. The restore evidence is one isolated Linux01 restore drill only and does not establish recurring restore assurance, RTO, RPO, SLA, or disaster-recovery readiness.</p></article>",
    "active": "Projects"
  },
  "documentation/313d07c59108": {
    "title": "DC01 System and Role Validation",
    "description": "Retained technical documentation: DC01 System and Role Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>DC01 System and Role Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/dc01-system-and-role-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>DC01 System and Role Validation</h2>\n<h2>Claim supported</h2>\n<p>Direct DC01 inventory supports Windows Server, installed role, domain, Global Catalog, FSMO, and DC01 IP claims for the personal nonproduction lab.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Operating system: Microsoft Windows Server 2022 Standard Evaluation.</li>\n<li>Version: 10.0.20348.</li>\n<li>Build number: 20348.</li>\n<li>Active Directory Domain Services installed: AD-Domain-Services, InstallState 1.</li>\n<li>DNS Server installed: DNS, InstallState 1.</li>\n<li>DHCP Server installed: DHCP, InstallState 1.</li>\n<li>Group Policy Management installed: GPMC, InstallState 1.</li>\n<li>Domain DNS root: ad.jeremyfontenot.online.</li>\n<li>NetBIOS domain: JFAD.</li>\n<li>Domain controller host: DC01.ad.jeremyfontenot.online.</li>\n<li>DC01 IPv4 address: 10.10.20.10.</li>\n<li>Global Catalog: true.</li>\n<li>FSMO roles on DC01: PDC Emulator, RID Master, Infrastructure Master, Schema Master, and Domain Naming Master.</li>\n</ul>\n<h2>Source command or source object</h2>\n<p>Authenticated DC01 target-local inventory result objects: OperatingSystem, InstalledRolesFeatures, Domain, Forest, and DomainControllers.</p>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<p><code>inventories/dc01-inventory-20260626-022543.json</code></p>\n<h2>Source file SHA-256</h2>\n<p><code>inventories/dc01-inventory-20260626-022543.json</code>: F60A6DD8C9EE42E90B02B210B1B1A775F89E5C3DED26618B593DEE1362C6DE42</p>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed executing account, privileged group details, SIDs, object GUIDs, GPO GUIDs, unrelated installed features, event details, raw time values not needed for the claim, and unrelated command output. Retained DC01 IP because it is already part of the current public home-lab evidence boundary.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>This artifact validates collected DC01 inventory values only.</li>\n<li>It does not prove ongoing Active Directory health, production readiness, security assurance, employer-system administration, or service availability beyond the captured inventory.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Validated</p></article>",
    "active": "Projects"
  }
}