{
  "documentation/649e173ee41c": {
    "title": "Troubleshooting",
    "description": "Retained technical documentation: Troubleshooting",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Cloud Sync Agent Validation</h2>\n<p>The existing Microsoft Entra Cloud Sync agent on <code>SYNC01</code> was preserved and not reinstalled.</p>\n<p>Validation confirmed:</p>\n<ul>\n<li>Service name: <code>AADConnectProvisioningAgent</code></li>\n<li>Service state: Running</li>\n<li>Startup mode: Automatic</li>\n<li>Service account: existing gMSA</li>\n<li>Entra agent status: Active</li>\n<li>Outbound TCP 443 connectivity to the Cloud Sync bootstrap endpoint: Successful</li>\n</ul>\n<h2>gMSA Validation</h2>\n<p>The provisioning agent runs under:</p>\n<p><code>JFAD\\pGMSA_126bbe50$</code></p>\n<p>Active Directory validation confirmed that <code>SYNC01</code> is authorized to retrieve the gMSA managed password.</p>\n<p>A <code>Test-ADServiceAccount</code> command executed from <code>DC01</code> returned <code>False</code>.</p>\n<p>This result was not treated as evidence that the gMSA was broken because <code>Test-ADServiceAccount</code> validates whether the computer executing the command can use the account. The Cloud Sync gMSA is assigned to <code>SYNC01</code>, not <code>DC01</code>.</p>\n<h2>Performance Counter Permission Issue</h2>\n<p>The Cloud Sync agent event log initially contained:</p>\n<ul>\n<li>Event ID <code>12033</code></li>\n<li>Error indicating access to the registry key <code>Global</code> was denied</li>\n</ul>\n<p>The local <code>Performance Log Users</code> group on <code>SYNC01</code> contained no members.</p>\n<p>The Cloud Sync gMSA was added to the local:</p>\n<p><code>Performance Log Users</code></p>\n<p>group.</p>\n<p>After the agent service was restarted, the previous registry-access error did not recur and the event log reported:</p>\n<ul>\n<li>Event ID <code>14013</code></li>\n<li><code>Metrics Agent was initialized successfully.</code></li>\n</ul>\n<h2>Remaining Performance Counter Event</h2>\n<p>The agent also logged Event ID <code>12009</code> indicating failure to initialize performance counters.</p>\n<p>Because:</p>\n<ul>\n<li>the provisioning agent remained Running</li>\n<li>Microsoft Entra reported the agent as Active</li>\n<li>the metrics agent initialized successfully</li>\n<li>user synchronization succeeded</li>\n<li>Password Hash Synchronization succeeded</li>\n<li>group synchronization succeeded</li>\n<li>provisioning logs showed successful processing</li>\n</ul>\n<p>the agent was not reinstalled based solely on this event.</p>\n<h2>Cloud Sync Provisioning Delay</h2>\n<p>During group synchronization testing, the newly created <code>GG-CloudSync-Test</code> group did not immediately appear in Microsoft Entra.</p>\n<p>Initial troubleshooting verified:</p>\n<ul>\n<li>The group existed in Active Directory</li>\n<li>ObjectClass was <code>group</code></li>\n<li>The group was located inside the configured Cloud Sync OU</li>\n<li>The Cloud Sync job contained a Groups attribute mapping</li>\n<li>OU scope was correct</li>\n<li>The provisioning agent was active</li>\n<li>Outbound connectivity was successful</li>\n</ul>\n<p>The Cloud Sync Overview later confirmed that Users and Groups provisioning uses a fixed:</p>\n<p><code>20 minute</code></p>\n<p>interval.</p>\n<p>After the expected provisioning cycle completed, the group appeared successfully in Microsoft Entra with its synchronized member.</p>\n<p>This behavior was documented as normal propagation delay rather than a synchronization failure.</p>\n<h2>Provision on Demand Limitation Encountered</h2>\n<p>A group was tested through the AD-to-Entra <code>Provision on demand</code> interface.</p>\n<p>The request returned:</p>\n<p><code>ResourceNotFound</code></p>\n<p>with a message indicating the input entry was not found or was out of scope.</p>\n<p>Further inspection of the interface showed that this AD-to-Entra provisioning workflow was operating on user objects.</p>\n<p>The group test result was therefore not used as evidence of a failed group synchronization.</p>\n<h2>Final Health Validation</h2>\n<p>At the end of testing:</p>\n<ul>\n<li>Cloud Sync configuration: Healthy</li>\n<li>Cloud Sync agent: Active</li>\n<li>Users synchronized: 4</li>\n<li>Groups synchronized: 1</li>\n<li>Password Hash Sync: Enabled</li>\n<li>Provisioning failure filter for the final validation window: No results</li>\n</ul>\n<h2>Troubleshooting Principle</h2>\n<p>The environment was troubleshot from observed evidence rather than by reinstalling Cloud Sync or changing scope without cause.</p>\n<p>The working synchronization infrastructure was preserved throughout the project.</p></article>",
    "active": "Projects"
  },
  "documentation/c16a404bc237": {
    "title": "Validation",
    "description": "Retained technical documentation: Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Controlled Identity Lifecycle Test</h2>\n<h3>User Provisioning</h3>\n<ul>\n<li>Source user: <code>cloudsync.test01</code></li>\n<li>Source UPN: <code>cloudsync.test01@jeremyfontenot.online</code></li>\n<li>Source OU: <code>OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></li>\n<li>Microsoft Entra provisioning: Validated</li>\n<li>On-premises sync enabled: Yes</li>\n</ul>\n<h3>Attribute Synchronization</h3>\n<ul>\n<li>Attribute tested: <code>Department</code></li>\n<li>On-premises value: <code>Hybrid Identity Lab</code></li>\n<li>Microsoft Entra value: <code>Hybrid Identity Lab</code></li>\n<li>Result: Validated</li>\n</ul>\n<h3>Password Hash Synchronization</h3>\n<ul>\n<li>Password changed on-premises</li>\n<li>Microsoft Entra authentication succeeded using the updated password</li>\n<li>Result: Validated</li>\n</ul>\n<h3>Group Synchronization</h3>\n<ul>\n<li>Source group: <code>GG-CloudSync-Test</code></li>\n<li>Group type: Global Security</li>\n<li>Source: Windows Server Active Directory</li>\n<li>Microsoft Entra provisioning: Validated</li>\n<li>Direct synchronized members: 1</li>\n<li>Member: <code>Cloud Sync Test 01</code></li>\n</ul>\n<h3>Source Anchor Correlation</h3>\n<ul>\n<li>AD ObjectGUID: <code>1e49a065-aa0d-4415-87d2-ee0ad0f4f1d2</code></li>\n<li>Calculated source anchor: <code>ZaBJHg2qFUSH0u4K0PTx0g==</code></li>\n<li>Microsoft Entra on-premises immutable ID matched the calculated source anchor</li>\n<li>Result: Validated</li>\n</ul>\n<h3>Cloud Sync Health</h3>\n<ul>\n<li>Configuration status: Healthy</li>\n<li>Provisioning agent: Active</li>\n<li>Users synchronized: 4</li>\n<li>Groups synchronized: 1</li>\n<li>Users/groups provisioning interval: 20 minutes</li>\n<li>Password Hash Sync interval: 5 minutes</li>\n<li>Provisioning failures in final validation window: None</li>\n</ul>\n<h2>Overall Result</h2>\n<p>The controlled hybrid identity lifecycle test successfully validated Active Directory to Microsoft Entra provisioning, attribute synchronization, Password Hash Synchronization, security-group synchronization, membership synchronization, provisioning logs, and source-anchor correlation.</p>\n<h2>Validation Matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Validation Area</th>\n<th>Source / Test</th>\n<th>Expected Result</th>\n<th>Actual Result</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Cloud Sync agent service</td>\n<td><code>SYNC01</code> service state</td>\n<td>Running / Automatic</td>\n<td>Running / Automatic</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Cloud Sync agent in Entra</td>\n<td>Cloud Sync Agents page</td>\n<td>Active</td>\n<td>Active</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>OU scope</td>\n<td>Dedicated Cloud Sync OU</td>\n<td>Correct OU selected</td>\n<td>Correct OU selected</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>New user creation</td>\n<td><code>cloudsync.test01</code></td>\n<td>Enabled in scoped OU</td>\n<td>Enabled in scoped OU</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>User provisioning</td>\n<td>AD → Microsoft Entra</td>\n<td>User appears in Entra</td>\n<td>User synchronized successfully</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Attribute synchronization</td>\n<td><code>Department</code></td>\n<td><code>Hybrid Identity Lab</code> in Entra</td>\n<td>Value synchronized</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Password Hash Sync</td>\n<td>On-prem password change</td>\n<td>New password authenticates to Entra</td>\n<td>Authentication successful</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Security group sync</td>\n<td><code>GG-CloudSync-Test</code></td>\n<td>Group appears in Entra</td>\n<td>Group synchronized</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Group membership sync</td>\n<td><code>cloudsync.test01</code> membership</td>\n<td>Member appears in Entra group</td>\n<td>Membership synchronized</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Source anchor correlation</td>\n<td>AD <code>objectGUID</code> → Base64</td>\n<td>Matches Entra immutable ID</td>\n<td>Exact match confirmed</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Provisioning logs</td>\n<td>User provisioning event</td>\n<td>Successful processing</td>\n<td>Success</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Group provisioning logs</td>\n<td>Group provisioning event</td>\n<td>Successful processing</td>\n<td>Success</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Provisioning failures</td>\n<td>Final failure review</td>\n<td>No current failures</td>\n<td>No results</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Agent outbound connectivity</td>\n<td>Microsoft bootstrap endpoint TCP 443</td>\n<td>Connection succeeds</td>\n<td><code>TcpTestSucceeded = True</code></td>\n<td>COMPLETE</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Lifecycle Validation Result</h2>\n<p>The controlled identity lifecycle test is COMPLETE.</p>\n<p>The broader portfolio project remains IN PROGRESS until final portfolio presentation material and evidence files are organized and committed.</p></article>",
    "active": "Projects"
  },
  "documentation/0a6bca1f3ed6": {
    "title": "Microsoft 365 Graph Administration Lab",
    "description": "Retained technical documentation: Microsoft 365 Graph Administration Lab",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft 365 Graph Administration Lab</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft 365 Graph Administration Lab</h2>\n<p><strong>Status:</strong> COMPLETE — validated read-only Microsoft Graph administration and reporting automation.</p>\n<p>Portfolio case study: https://jeremyfontenot.online/m365-graph-administration-lab.html</p>\n<p>This lab demonstrates Microsoft 365, Microsoft Entra ID, Microsoft Intune, Microsoft Graph, and PowerShell administration using a Microsoft 365 E5 Developer tenant.</p>\n<h2>Objectives</h2>\n<ul>\n<li>Build reusable Microsoft Graph administration tooling.</li>\n<li>Prefer read-only validation before configuration changes.</li>\n<li>Use delegated permissions with least-privilege scope selection.</li>\n<li>Exercise both Graph REST endpoints and PowerShell automation.</li>\n<li>Document authentication, permissions, API behavior, troubleshooting, and validation.</li>\n<li>Produce portfolio-quality evidence without creating meaningless tenant activity.</li>\n</ul>\n<h2>Validated scripts</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Script</th>\n<th>Purpose</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><code>Get-M365TenantInventory.ps1</code></td>\n<td>Tenant, domain, user, group, SKU, role, and Entra-device inventory</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365UserInventory.ps1</code></td>\n<td>Detailed Entra/M365 user and licensing inventory</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365GroupMembership.ps1</code></td>\n<td>Group and direct-membership reporting</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365LicenseAssignment.ps1</code></td>\n<td>License capacity and assignment reporting</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-EntraRoleInventory.ps1</code></td>\n<td>Activated Entra directory roles and membership</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-EntraStaleAccounts.ps1</code></td>\n<td>Potentially stale account analysis using sign-in activity</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-IntuneManagedDeviceInventory.ps1</code></td>\n<td>Intune managed-device inventory</td>\n<td>Validated</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Validated environment snapshot</h2>\n<ul>\n<li>Verified domains: 3</li>\n<li>Users: 22</li>\n<li>Groups: 12</li>\n<li>Subscribed SKUs: 1</li>\n<li>Activated directory roles: 4</li>\n<li>Entra devices: 2</li>\n<li>Licensed users: 19</li>\n<li>Unlicensed users: 3</li>\n<li>Intune managed devices: 1</li>\n</ul>\n<p>These values are a point-in-time lab snapshot and will change as the environment evolves.</p>\n<h2>Graph permissions exercised</h2>\n<ul>\n<li><code>Organization.Read.All</code></li>\n<li><code>User.Read.All</code></li>\n<li><code>Group.Read.All</code></li>\n<li><code>Directory.Read.All</code></li>\n<li><code>AuditLog.Read.All</code></li>\n<li><code>DeviceManagementManagedDevices.Read.All</code></li>\n</ul>\n<h2>Graph endpoints exercised</h2>\n<pre><code class=\"language-text\">GET /v1.0/organization\nGET /v1.0/users\nGET /v1.0/groups\nGET /v1.0/groups/{id}/members\nGET /v1.0/subscribedSkus\nGET /v1.0/directoryRoles\nGET /v1.0/directoryRoles/{id}/members\nGET /v1.0/devices\nGET /v1.0/deviceManagement/managedDevices\n</code></pre>\n<h2>Validation highlights</h2>\n<ul>\n<li>Device Code delegated authentication validated.</li>\n<li>Existing Graph sessions are checked for required scopes before reuse.</li>\n<li>Graph collection pagination is handled where supported.</li>\n<li>Windows PowerShell 5.1 hashtable behavior is handled explicitly.</li>\n<li>CSV reporting was validated for tenant, user, group, licensing, role, stale-account, and Intune inventory.</li>\n<li>A <code>400 Bad Request</code> on directory-role membership was traced to an unsupported <code>$top</code> query parameter and corrected.</li>\n<li>A <code>403 Forbidden</code> on <code>signInActivity</code> was traced to a missing <code>AuditLog.Read.All</code> scope and corrected.</li>\n</ul>\n<h2>Repository layout</h2>\n<pre><code class=\"language-text\">m365-graph-administration-lab/\n├── README.md\n├── scripts/\n│   ├── Get-M365TenantInventory.ps1\n│   ├── Get-M365UserInventory.ps1\n│   ├── Get-M365GroupMembership.ps1\n│   ├── Get-M365LicenseAssignment.ps1\n│   ├── Get-EntraRoleInventory.ps1\n│   ├── Get-EntraStaleAccounts.ps1\n│   └── Get-IntuneManagedDeviceInventory.ps1\n└── docs/\n    └── Troubleshooting.md\n</code></pre>\n<h2>Completion and claim boundary</h2>\n<p>The intended portfolio scope is complete: seven read-only administration/reporting scripts were validated across Microsoft 365, Entra ID, and Intune. The project demonstrates delegated Microsoft Graph authentication, required-scope handling, read-only administration/reporting, CSV output, pagination, and documented troubleshooting. It does not claim Graph write automation or broader administrative coverage that was not validated.</p>\n<h2>Security and publication notes</h2>\n<p>Live CSV exports are intentionally not published because they can contain user principal names, object IDs, device identifiers, and other tenant-specific information. The public repository contains the reusable code and sanitized validation documentation only.</p></article>",
    "active": "Projects"
  },
  "documentation/cc19df30f995": {
    "title": "Troubleshooting Notes",
    "description": "Retained technical documentation: Troubleshooting Notes",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting Notes</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/docs/Troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting Notes</h2>\n<h2>Microsoft.Graph.Authentication missing</h2>\n<p>Installed the authentication module:</p>\n<pre><code class=\"language-powershell\">Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force\n</code></pre>\n<p>Validated module version during the lab: <code>2.41.0</code>.</p>\n<h2>PowerShell execution policy blocked module loading</h2>\n<p>Corrected the current-user policy:</p>\n<pre><code class=\"language-powershell\">Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned\n</code></pre>\n<h2>Windows PowerShell 5.1 Graph response behavior</h2>\n<p><code>Invoke-MgGraphRequest</code> responses behaved as hashtables in this environment, so key indexing was used where appropriate:</p>\n<pre><code class=\"language-powershell\">$Org[\"displayName\"]\n</code></pre>\n<h2>Single-object count behavior</h2>\n<p>Graph collections were explicitly wrapped with <code>@(...)</code> so <code>.Count</code> remained reliable when only one object was returned.</p>\n<h2>Session-scoped project root</h2>\n<p>Reusable scripts determine the project root from their own location:</p>\n<pre><code class=\"language-powershell\">$ProjectRoot = Split-Path $PSScriptRoot -Parent\n</code></pre>\n<h2>Directory-role members returned 400 Bad Request</h2>\n<p>The role list succeeded, but calls shaped like:</p>\n<pre><code class=\"language-text\">GET /v1.0/directoryRoles/{id}/members?$top=999\n</code></pre>\n<p>returned <code>400 Bad Request</code>.</p>\n<p>Removing <code>$top</code> corrected the query:</p>\n<pre><code class=\"language-text\">GET /v1.0/directoryRoles/{id}/members\n</code></pre>\n<p>All activated roles were then processed successfully.</p>\n<h2>signInActivity returned 403 Forbidden</h2>\n<p>An existing Graph session lacked <code>AuditLog.Read.All</code>. The stale-account script was changed to compare the required scopes with <code>Get-MgContext.Scopes</code> and reconnect when a required scope was missing.</p>\n<p>After reauthentication with:</p>\n<pre><code class=\"language-text\">User.Read.All\nAuditLog.Read.All\n</code></pre>\n<p>the user sign-in activity query completed successfully.</p>\n<h2>Disconnect-MgGraph MSAL cache warning</h2>\n<p><code>Disconnect-MgGraph</code> displayed an authority-format warning while clearing the persisted MSAL token cache. The warning did not prevent a successful new Device Code authentication session.</p>\n<h2>Intune managed-device permission</h2>\n<p>The Intune inventory required:</p>\n<pre><code class=\"language-text\">DeviceManagementManagedDevices.Read.All\n</code></pre>\n<p>The script detected the missing scope, reauthenticated, and successfully retrieved the managed-device inventory.</p></article>",
    "active": "Projects"
  },
  "documentation/eb7faf9d899d": {
    "title": "Project 5 — Simulated macOS ABM to Intune Runbook",
    "description": "Retained technical documentation: Project 5 — Simulated macOS ABM to Intune Runbook",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Project 5 — Simulated macOS ABM to Intune Runbook</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Project 5 — Simulated macOS ABM to Intune Runbook</h2>\n<p><strong>Status:</strong> COMPLETE<br/>\n<strong>Project type:</strong> FREE WITH SIMULATION<br/>\n<strong>Microsoft-side implementation:</strong> REAL CONFIGURATION where validated<br/>\n<strong>Apple Business Manager / ADE:</strong> SIMULATED / DOCUMENTED</p>\n<h2>Objective</h2>\n<p>Demonstrate an enterprise macOS management design spanning Apple Business Manager (ABM), Microsoft Intune, Automated Device Enrollment (ADE), Microsoft Entra authentication, Platform SSO, enterprise Wi-Fi, certificates, FileVault, compliance, application deployment, inventory, and lifecycle administration.</p>\n<p>The project deliberately separates what was actually configured in the Microsoft Intune tenant from Apple- and endpoint-dependent workflows that could not be executed legitimately in the lab.</p>\n<h2>What was actually configured</h2>\n<p>The following work was performed in the real Microsoft Intune tenant:</p>\n<ul>\n<li>Apple MDM Push (APNs) certificate created through Apple's Push Certificates Portal and uploaded to Intune.</li>\n<li>APNs certificate validated as active in Intune; renewal due <strong>2027-09-26</strong>.</li>\n<li>macOS compliance policy created:</li>\n<li>System Integrity Protection required.</li>\n<li>Password required to unlock.</li>\n<li>Storage encryption required.</li>\n<li>Firewall enabled.</li>\n<li>Stealth Mode enabled.</li>\n<li>Gatekeeper limited to the Mac App Store and identified developers.</li>\n<li>Noncompliance marked immediately.</li>\n<li>macOS FileVault Settings Catalog profile created:</li>\n<li>FileVault enabled.</li>\n<li>Users prevented from disabling FileVault.</li>\n<li>Recovery-key escrow location guidance configured.</li>\n<li>Intune macOS enrollment restrictions reviewed and validated.</li>\n<li>Platform SSO configuration capability reviewed in the Settings Catalog.</li>\n<li>Enterprise Wi-Fi capability reviewed, including WPA/WPA2-Enterprise and EAP methods.</li>\n<li>SCEP certificate profile capability reviewed.</li>\n<li>macOS app deployment types reviewed.</li>\n<li>macOS inventory and bulk lifecycle actions reviewed.</li>\n</ul>\n<h2>What remains simulated/documented</h2>\n<p>The following workflows are documented but were <strong>not</strong> represented as implemented:</p>\n<ul>\n<li>Apple Business Manager organization enrollment and verification.</li>\n<li>Reseller/device assignment into ABM.</li>\n<li>Intune Enrollment Program Token exchange with ABM.</li>\n<li>Automated Device Enrollment synchronization.</li>\n<li>ADE enrollment profile deployment.</li>\n<li>macOS Setup Assistant ADE experience.</li>\n<li>Platform SSO registration on a managed Mac.</li>\n<li>Certificate issuance through a live enterprise PKI/SCEP path.</li>\n<li>Enterprise RADIUS authentication.</li>\n<li>FileVault recovery-key escrow from an enrolled Mac.</li>\n<li>Compliance evaluation on an enrolled Mac.</li>\n<li>App installation on a managed Mac.</li>\n<li>Device reassignment, retire, wipe, and lost/stolen execution against a real Mac.</li>\n</ul>\n<h2>Architecture</h2>\n<pre><code class=\"language-text\">Apple procurement / reseller\n        ↓\nApple Business Manager\n        ↓\nIntune Enrollment Program Token\n        ↓\nAutomated Device Enrollment profile\n        ↓\nmacOS Setup Assistant\n        ↓\nMicrosoft Entra authentication\n        ↓\nMicrosoft Intune enrollment\n        ↓\nConfiguration + applications + compliance\n        ↓\nFileVault + recovery-key escrow\n        ↓\nInventory + lifecycle administration\n</code></pre>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">architecture.md</a> for the full real-versus-simulated boundary.</p>\n<h2>Evidence</h2>\n<p>The evidence gallery is available at:</p>\n<ul>\n<li><a href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">Project 5 evidence index</a></li>\n<li><a data-route=\"projects/macos-abm-intune-runbook\" href=\"#projects/macos-abm-intune-runbook\">Live case study</a></li>\n</ul>\n<p>Screenshots are direct captures from the real Intune tenant or Apple Push Certificates Portal. No simulated screenshot is presented as real administration.</p>\n<h2>Documentation</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">Architecture</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/implementation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Implementation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/troubleshooting.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/lessons-learned.md\" rel=\"noopener noreferrer\" target=\"_blank\">Lessons learned</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/renewal-calendar.md\" rel=\"noopener noreferrer\" target=\"_blank\">Renewal calendar</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/device-lifecycle.md\" rel=\"noopener noreferrer\" target=\"_blank\">Device lifecycle</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" rel=\"noopener noreferrer\" target=\"_blank\">Simulated deployment scenario</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/portfolio-summary.md\" rel=\"noopener noreferrer\" target=\"_blank\">Portfolio summary</a></li>\n</ul>\n<h2>Security and evidence handling</h2>\n<p>The repository does not publish Apple credentials, private keys, enrollment tokens, bearer tokens, FileVault recovery keys, passwords, MFA secrets, or session cookies. Screenshots selected for publication avoid personal Apple-account identifiers and sensitive certificate material.</p>\n<h2>Technologies demonstrated</h2>\n<p>Apple Business Manager architecture, Apple Push Notification service, Microsoft Intune, Microsoft Entra ID, Automated Device Enrollment concepts, Platform SSO, Settings Catalog, FileVault, macOS compliance, enterprise Wi-Fi, EAP-TLS, SCEP/PKCS concepts, macOS application deployment, inventory, device lifecycle, renewal operations, and evidence-based administration.</p></article>",
    "active": "Projects"
  },
  "documentation/425951ec3f27": {
    "title": "Architecture — macOS ABM to Intune",
    "description": "Retained technical documentation: Architecture — macOS ABM to Intune",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Architecture — macOS ABM to Intune</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Architecture — macOS ABM to Intune</h2>\n<h2>Status boundary</h2>\n<p>This project uses three explicit implementation states:</p>\n<ul>\n<li><strong>REAL CONFIGURATION</strong> — actually configured or directly validated in the real Microsoft Intune tenant.</li>\n<li><strong>SIMULATED / DOCUMENTED</strong> — accurately designed and documented, but not executed because the required Apple infrastructure or managed macOS endpoint is unavailable.</li>\n<li><strong>NOT VALIDATED</strong> — a Microsoft-side policy may exist, but endpoint behavior was not tested on an enrolled Mac.</li>\n</ul>\n<h2>Intended enterprise flow</h2>\n<pre><code class=\"language-text\">Authorized reseller / Apple procurement\n        │\n        ▼\nApple Business Manager\n        │\n        │ device assignment to MDM server\n        ▼\nMicrosoft Intune MDM server\n        │\n        │ Enrollment Program Token\n        ▼\nAutomated Device Enrollment\n        │\n        ▼\nmacOS Setup Assistant\n        │\n        ▼\nMicrosoft Entra authentication\n        │\n        ▼\nMicrosoft Intune enrollment\n        │\n        ├───────────────┬────────────────┬────────────────┐\n        ▼               ▼                ▼                ▼\nConfiguration       Applications      Compliance       Security\nprofiles                                                controls\n        │               │                │                │\n        ├─ Platform SSO │                │                ├─ FileVault\n        ├─ Wi-Fi / PKI  │                │                └─ Firewall\n        └─ restrictions │                │\n        └───────────────┴────────────────┴────────────────┘\n                                │\n                                ▼\n                    Inventory + lifecycle\n                                │\n                  ┌─────────────┼─────────────┐\n                  ▼             ▼             ▼\n                Retire         Wipe       Reassignment\n</code></pre>\n<h2>Apple service boundary</h2>\n<h3>Apple Push Notification service — REAL CONFIGURATION</h3>\n<p>A real Apple MDM Push certificate was created in Apple's Push Certificates Portal using the Intune-generated CSR and uploaded back to the Intune tenant.</p>\n<p>Validated state:</p>\n<ul>\n<li>Vendor: Microsoft Corporation.</li>\n<li>APNs certificate created successfully.</li>\n<li>Intune upload completed successfully.</li>\n<li>Certificate expiration: <strong>2027-09-26</strong>.</li>\n</ul>\n<p>The Apple account used to own the certificate is intentionally excluded from public evidence.</p>\n<h3>Apple Business Manager — SIMULATED / DOCUMENTED</h3>\n<p>No Apple Business Manager organization is available in the lab. Therefore, the following are not represented as implemented:</p>\n<ul>\n<li>organization verification;</li>\n<li>reseller/device assignment;</li>\n<li>MDM server creation in ABM;</li>\n<li>ABM server token issuance;</li>\n<li>Enrollment Program Token import;</li>\n<li>ADE device sync;</li>\n<li>ADE profile assignment;</li>\n<li>Setup Assistant ADE behavior.</li>\n</ul>\n<h2>Microsoft service boundary</h2>\n<h3>Microsoft Intune — REAL CONFIGURATION</h3>\n<p>The real tenant was used to create or inspect:</p>\n<ul>\n<li>Apple enrollment administration;</li>\n<li>macOS compliance policy;</li>\n<li>macOS FileVault Settings Catalog profile;</li>\n<li>macOS enrollment restrictions;</li>\n<li>Platform SSO settings;</li>\n<li>enterprise Wi-Fi settings;</li>\n<li>SCEP certificate settings;</li>\n<li>macOS application types;</li>\n<li>macOS inventory;</li>\n<li>macOS bulk device lifecycle actions.</li>\n</ul>\n<h3>Microsoft Entra ID</h3>\n<p>Microsoft Entra is the intended identity provider for Company Portal enrollment and Platform SSO. Endpoint Platform SSO registration is <strong>NOT VALIDATED</strong> because there is no enrolled macOS endpoint.</p>\n<h2>Real vs. simulated matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Classification</th>\n<th>Evidence / boundary</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Intune tenant access</td>\n<td>REAL CONFIGURATION</td>\n<td>Real portal configuration captured</td>\n</tr>\n<tr>\n<td>APNs certificate</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Created in Apple portal; uploaded to Intune</td>\n</tr>\n<tr>\n<td>ABM organization</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No ABM organization available</td>\n</tr>\n<tr>\n<td>Enrollment Program Token</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Intune creation workflow inspected only</td>\n</tr>\n<tr>\n<td>ADE</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Requires ABM + eligible device</td>\n</tr>\n<tr>\n<td>macOS compliance policy</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Policy created in Intune</td>\n</tr>\n<tr>\n<td>Compliance enforcement</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Settings Catalog profile created</td>\n</tr>\n<tr>\n<td>FileVault encryption on endpoint</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>Recovery-key escrow</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>Platform SSO capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Settings exposed in Intune</td>\n</tr>\n<tr>\n<td>Platform SSO endpoint registration</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No managed Mac</td>\n</tr>\n<tr>\n<td>Enterprise Wi-Fi capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Enterprise profile surface inspected</td>\n</tr>\n<tr>\n<td>WPA2-Enterprise + EAP-TLS</td>\n<td>SIMULATED / DOCUMENTED DESIGN</td>\n<td>No RADIUS/PKI deployment</td>\n</tr>\n<tr>\n<td>SCEP certificate capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>SCEP profile surface inspected</td>\n</tr>\n<tr>\n<td>Certificate issuance</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No live enterprise PKI/SCEP service</td>\n</tr>\n<tr>\n<td>macOS application deployment capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Supported app types inspected</td>\n</tr>\n<tr>\n<td>Application installation</td>\n<td>NOT VALIDATED</td>\n<td>No managed Mac</td>\n</tr>\n<tr>\n<td>macOS inventory</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Inventory page available; 0 Macs enrolled</td>\n</tr>\n<tr>\n<td>Retire / Wipe / Delete / Restart / Rename / Sync</td>\n<td>REAL CONFIGURATION — VALIDATED CAPABILITY</td>\n<td>Actions exposed; none executed</td>\n</tr>\n<tr>\n<td>Device reassignment</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No enrolled Mac</td>\n</tr>\n<tr>\n<td>Lost/stolen workflow</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Operational procedure only</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Enterprise Wi-Fi design</h2>\n<p>The intended secure WLAN model is:</p>\n<pre><code class=\"language-text\">macOS device\n   │\n   ├─ trusted root certificate\n   ├─ SCEP/PKCS device certificate\n   │\n   ▼\nWPA2-Enterprise / EAP-TLS\n   │\n   ▼\nRADIUS / network policy service\n   │\n   ▼\nEnterprise wireless network\n</code></pre>\n<p>The Intune tenant exposed WPA-Enterprise, WPA2-Enterprise, EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP. EAP-TLS is the documented design because it supports certificate-based device authentication without depending on user passwords for Wi-Fi access.</p>\n<h2>Security design principles</h2>\n<ul>\n<li>Require FileVault encryption.</li>\n<li>Prevent users from disabling FileVault after policy enforcement.</li>\n<li>Escrow the personal recovery key to the management service when a managed Mac exists.</li>\n<li>Require System Integrity Protection.</li>\n<li>Require password-protected unlock.</li>\n<li>Enable firewall and Stealth Mode.</li>\n<li>Preserve Gatekeeper restrictions.</li>\n<li>Prefer certificate-based enterprise Wi-Fi.</li>\n<li>Keep APNs renewal ownership documented.</li>\n<li>Separate destructive lifecycle operations from routine sync/restart actions.</li>\n<li>Never publish recovery keys, token contents, credentials, or certificate private material.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/092c22682705": {
    "title": "macOS Device Lifecycle Runbook",
    "description": "Retained technical documentation: macOS Device Lifecycle Runbook",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>macOS Device Lifecycle Runbook</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/device-lifecycle.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>macOS Device Lifecycle Runbook</h2>\n<h2>1. Procurement and assignment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Preferred enterprise path:</p>\n<ol>\n<li>Purchase through Apple or an authorized reseller linked to the ABM organization.</li>\n<li>Verify the device appears in Apple Business Manager.</li>\n<li>Assign the device to the Microsoft Intune MDM server.</li>\n<li>Synchronize the Enrollment Program Token in Intune.</li>\n<li>Assign the correct ADE profile.</li>\n</ol>\n<h2>2. Enrollment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>User powers on or resets the Mac.</li>\n<li>Apple activation identifies the device as organization-owned.</li>\n<li>ADE directs the device to Intune.</li>\n<li>Setup Assistant applies the configured enrollment experience.</li>\n<li>User authenticates where required.</li>\n<li>Intune enrollment completes.</li>\n<li>Company Portal / Platform SSO registration follows the organization design.</li>\n</ol>\n<h2>3. Configuration and security</h2>\n<p>Microsoft-side configuration demonstrated in the real tenant includes:</p>\n<ul>\n<li>compliance baseline;</li>\n<li>FileVault baseline;</li>\n<li>Platform SSO capability;</li>\n<li>enterprise Wi-Fi capability;</li>\n<li>certificate profile capability;</li>\n<li>app deployment capability.</li>\n</ul>\n<p>Endpoint enforcement remains unvalidated without an enrolled Mac.</p>\n<h2>4. Inventory and ownership</h2>\n<p>The Intune macOS inventory surface exposes:</p>\n<ul>\n<li>device name;</li>\n<li>management authority;</li>\n<li>ownership;</li>\n<li>compliance;</li>\n<li>OS and version;</li>\n<li>primary user;</li>\n<li>last check-in.</li>\n</ul>\n<p>Current lab inventory: <strong>0 macOS devices</strong>.</p>\n<h2>5. Routine operations</h2>\n<p>Available real Intune actions include:</p>\n<ul>\n<li>Sync — request management check-in.</li>\n<li>Restart — restart the managed device.</li>\n<li>Rename — change device display/name where supported.</li>\n</ul>\n<h2>6. Retirement</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Use when management should be removed without treating the device as stolen or requiring a factory reset. Confirm ownership and data-handling requirements before choosing Retire.</p>\n<h2>7. Wipe</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Use only after validating:</p>\n<ul>\n<li>device identity;</li>\n<li>ownership;</li>\n<li>authorization;</li>\n<li>data-retention requirements;</li>\n<li>reassignment or disposal plan.</li>\n</ul>\n<p>A wipe is destructive and should be treated as a controlled administrative action.</p>\n<h2>8. Delete</h2>\n<p>Deleting the Intune object is not equivalent to securely wiping the device. Confirm the device has already been retired/wiped or otherwise handled appropriately before deleting the management record.</p>\n<h2>9. Reassignment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>For corporate devices:</p>\n<ol>\n<li>Capture required asset state.</li>\n<li>Retire/wipe according to policy.</li>\n<li>Reassign in ABM if the MDM destination changes.</li>\n<li>Ensure the correct ADE profile is assigned.</li>\n<li>Reset the Mac.</li>\n<li>Enroll the next user through Setup Assistant.</li>\n<li>Validate inventory, compliance, FileVault, apps, and authentication.</li>\n</ol>\n<h2>10. Lost or stolen device</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>Verify the asset and user.</li>\n<li>Escalate to security/management.</li>\n<li>Revoke or block identity sessions as policy requires.</li>\n<li>Evaluate remote wipe.</li>\n<li>Revoke device certificates where appropriate.</li>\n<li>Preserve incident records.</li>\n<li>Update asset ownership/status.</li>\n<li>Do not expose recovery keys or credentials during evidence capture.</li>\n</ol></article>",
    "active": "Projects"
  },
  "documentation/15569e574dbb": {
    "title": "Project 5 Evidence Index",
    "description": "Retained technical documentation: Project 5 Evidence Index",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Project 5 Evidence Index</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Project 5 Evidence Index</h2>\n<p>The public evidence in this folder is deliberately sanitized and narrowly captioned. It proves Microsoft-side configuration and capability without implying that Apple Business Manager, Automated Device Enrollment, or a managed macOS endpoint exists in this lab.</p>\n<h2>Published screenshot evidence</h2>\n<h3>Security and management proof board</h3>\n<p><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/evidence-board-security.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Open the screenshot proof board</a></p>\n<p>The board is a derived composite built from four screenshots captured during this Project 5 session:</p>\n<ol>\n<li><strong>Apple Push Certificates Portal confirmation</strong> — proves Apple issued a new Mobile Device Management push certificate for Microsoft Corporation with expiration <strong>September 26, 2027</strong>.</li>\n<li><strong>macOS compliance policy review</strong> — proves the real Intune policy was configured with System Integrity Protection, password, storage encryption, firewall, Stealth Mode, and Gatekeeper requirements before creation.</li>\n<li><strong>macOS FileVault Settings Catalog configuration</strong> — proves FileVault was set to On, users were prevented from disabling it, and recovery-key escrow location guidance was configured.</li>\n<li><strong>Platform SSO settings discovery</strong> — proves the real Intune Settings Catalog exposes the Platform SSO configuration surface.</li>\n</ol>\n<p>The board proves only the states described above. It does <strong>not</strong> prove macOS endpoint enforcement, recovery-key escrow, Platform SSO registration, or ADE enrollment.</p>\n<h2>Additional validated observations</h2>\n<p>The following real Intune capability observations are documented in the project runbook and were captured during the same session:</p>\n<ul>\n<li>macOS app deployment types included Microsoft Edge, Microsoft 365 Apps, Microsoft Defender for Endpoint, web clips, web links, line-of-business apps, DMG, and PKG.</li>\n<li>macOS inventory was available and showed <strong>0 devices</strong>.</li>\n<li>macOS bulk device actions exposed Delete, Retire, Wipe, Restart, Rename, and Sync.</li>\n<li>Enterprise Wi-Fi exposed WPA-Enterprise and WPA2-Enterprise.</li>\n<li>EAP methods included EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP.</li>\n<li>macOS SCEP configuration exposed certificate type, subject/SAN, validity, key usage, key size, root certificate, and EKU controls.</li>\n</ul>\n<p>These observations are classified as <strong>REAL CAPABILITY VALIDATION</strong>, not endpoint implementation.</p>\n<h2>Why only a sanitized derivative is published</h2>\n<p>Source screenshots from the working session are retained in the conversation/evidence workflow, but only the sanitized composite is published here. This prevents unnecessary exposure of Apple account identifiers, certificate identifiers, or other tenant-specific details while preserving direct visual proof of the configuration work.</p>\n<h2>Evidence handling rules</h2>\n<ul>\n<li>No Apple account identifier is intentionally published.</li>\n<li>No APNs PEM file, certificate private key, recovery key, enrollment token, ABM token, password, bearer token, session cookie, or MFA secret is stored here.</li>\n<li>No simulated ABM/ADE screenshot is used.</li>\n<li>Documentation, not fabricated portal evidence, is used for simulated Apple Business Manager and Automated Device Enrollment workflows.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/8381f00c7c09": {
    "title": "Implementation",
    "description": "Retained technical documentation: Implementation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Implementation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Implementation</h2>\n<h2>1. Apple MDM Push certificate — REAL CONFIGURATION</h2>\n<p>The Intune Apple enrollment page initially showed the Apple MDM Push Certificate as <strong>Not set up</strong>.</p>\n<p>Implementation sequence:</p>\n<ol>\n<li>Accepted Microsoft's Apple data-sharing permission prompt in Intune.</li>\n<li>Downloaded the Intune certificate signing request (CSR).</li>\n<li>Opened Apple's Push Certificates Portal.</li>\n<li>Accepted Apple's MDM certificate terms.</li>\n<li>Uploaded the Intune-generated CSR.</li>\n<li>Apple issued a new Mobile Device Management push certificate for Microsoft Corporation.</li>\n<li>Downloaded the resulting PEM certificate.</li>\n<li>Returned to Intune.</li>\n<li>Entered the Apple account used to create the certificate.</li>\n<li>Uploaded the PEM certificate.</li>\n<li>Intune reported successful MDM push certificate creation.</li>\n<li>Final Intune state showed the certificate as active.</li>\n</ol>\n<p>Validated expiration: <strong>2027-09-26</strong>.</p>\n<p>No Apple credentials, PEM file, private key material, certificate serial number, or Apple account identifier are published.</p>\n<h2>2. Enrollment Program Token / ADE — SIMULATED / DOCUMENTED</h2>\n<p>The real Intune tenant was used to inspect the Enrollment Program Token workflow.</p>\n<p>Intune exposes the expected sequence:</p>\n<ol>\n<li>Grant Microsoft permission to exchange device/user information with Apple.</li>\n<li>Download the Intune public-key certificate.</li>\n<li>Open Apple Business Manager.</li>\n<li>Create the ABM MDM server relationship.</li>\n<li>Upload the Intune public key in ABM.</li>\n<li>Download the ABM server token.</li>\n<li>Enter the Apple ID used for token ownership.</li>\n<li>Upload the token to Intune.</li>\n<li>Sync assigned devices.</li>\n<li>Create and assign ADE profiles.</li>\n</ol>\n<p>The lab has no Apple Business Manager organization, so no token was created and no device was synchronized.</p>\n<h2>3. macOS compliance baseline — REAL CONFIGURATION</h2>\n<p>Policy:</p>\n<p><code>Project 5 - macOS Enterprise Compliance</code></p>\n<p>Configured settings:</p>\n<ul>\n<li>Require System Integrity Protection.</li>\n<li>Require a password to unlock devices.</li>\n<li>Require encryption of data storage.</li>\n<li>Enable Firewall.</li>\n<li>Enable Stealth Mode.</li>\n<li>Gatekeeper: allow apps from the Mac App Store and identified developers.</li>\n<li>Mark device noncompliant immediately.</li>\n</ul>\n<p>Assignment:</p>\n<ul>\n<li>intentionally unassigned because there is no managed macOS test endpoint.</li>\n</ul>\n<p>Result:</p>\n<ul>\n<li>policy object created successfully in the real Intune tenant;</li>\n<li>monitoring showed 0 devices, which matches the known lab inventory.</li>\n</ul>\n<h2>4. FileVault baseline — REAL CONFIGURATION</h2>\n<p>Policy:</p>\n<p><code>Project 5 - macOS FileVault Baseline</code></p>\n<p>Profile type:</p>\n<ul>\n<li>macOS Settings Catalog.</li>\n</ul>\n<p>Configured controls:</p>\n<ul>\n<li><code>FileVault &gt; Enable = On</code></li>\n<li><code>FileVault Options &gt; Prevent FileVault From Being Disabled = True</code></li>\n<li>recovery-key escrow <code>Location</code> guidance configured.</li>\n</ul>\n<p>The profile was intentionally left unassigned because there is no managed macOS endpoint.</p>\n<p>What is proven:</p>\n<ul>\n<li>the policy exists;</li>\n<li>the configured settings are visible in the real Intune tenant.</li>\n</ul>\n<p>What is not proven:</p>\n<ul>\n<li>FileVault was enabled on a Mac;</li>\n<li>a recovery key was successfully escrowed;</li>\n<li>the recovery key was rotated or recovered.</li>\n</ul>\n<h2>5. Platform SSO — REAL CAPABILITY, DOCUMENTED DEPLOYMENT</h2>\n<p>A macOS Settings Catalog review confirmed:</p>\n<p><code>Authentication &gt; Extensible Single Sign On (SSO) &gt; Platform SSO</code></p>\n<p>The review profile was canceled after capability inspection to avoid leaving a nonfunctional placeholder policy.</p>\n<p>A production deployment would also require a managed macOS endpoint, Company Portal / Microsoft Enterprise SSO plug-in prerequisites, supported macOS version, and actual registration validation.</p>\n<h2>6. Enterprise Wi-Fi — REAL CAPABILITY, DOCUMENTED DEPLOYMENT</h2>\n<p>The macOS Wi-Fi template exposes:</p>\n<ul>\n<li>Device Channel deployment;</li>\n<li>Basic and Enterprise profile types;</li>\n<li>WPA-Enterprise;</li>\n<li>WPA2-Enterprise;</li>\n<li>EAP-FAST;</li>\n<li>EAP-SIM;</li>\n<li>EAP-TLS;</li>\n<li>EAP-TTLS;</li>\n<li>LEAP;</li>\n<li>PEAP;</li>\n<li>proxy options;</li>\n<li>MAC address randomization controls.</li>\n</ul>\n<p>The portfolio design uses <strong>WPA2-Enterprise + EAP-TLS</strong> with trusted-root and client-certificate deployment.</p>\n<p>No fake SSID, RADIUS server, or certificate authority was created.</p>\n<h2>7. Certificate deployment — REAL CAPABILITY, DOCUMENTED ISSUANCE</h2>\n<p>The macOS SCEP certificate template exposes:</p>\n<ul>\n<li>deployment channel;</li>\n<li>certificate type;</li>\n<li>subject name format;</li>\n<li>subject alternative names;</li>\n<li>validity period;</li>\n<li>key usage;</li>\n<li>key size;</li>\n<li>trusted root certificate;</li>\n<li>extended key usage.</li>\n</ul>\n<p>No certificate was issued because the lab does not have a configured enterprise SCEP/PKI path for macOS.</p>\n<h2>8. Application deployment — REAL CAPABILITY</h2>\n<p>The real Intune macOS app surface exposes:</p>\n<ul>\n<li>Microsoft Edge for macOS;</li>\n<li>Microsoft 365 Apps for macOS;</li>\n<li>Microsoft Defender for Endpoint (macOS);</li>\n<li>macOS web clip;</li>\n<li>web link;</li>\n<li>line-of-business app;</li>\n<li>macOS app (DMG);</li>\n<li>macOS app (PKG).</li>\n</ul>\n<p>No placeholder application was created because there is no managed Mac on which to validate installation.</p>\n<h2>9. Enrollment restrictions — REAL VALIDATION</h2>\n<p>Default macOS enrollment restrictions were reviewed.</p>\n<p>Observed state:</p>\n<ul>\n<li>macOS enrollment: Allow.</li>\n<li>personally owned macOS devices: Allow.</li>\n<li>minimum OS: not configured.</li>\n<li>maximum OS: not configured.</li>\n</ul>\n<p>The default tenant-wide restriction was not modified merely for portfolio appearance.</p>\n<h2>10. Inventory and lifecycle — REAL CAPABILITY</h2>\n<p>The macOS inventory page showed <strong>0 devices</strong>.</p>\n<p>The bulk action workflow exposed these macOS actions:</p>\n<ul>\n<li>Delete</li>\n<li>Retire</li>\n<li>Wipe</li>\n<li>Restart</li>\n<li>Rename</li>\n<li>Sync</li>\n</ul>\n<p>No destructive action was executed.</p></article>",
    "active": "Projects"
  },
  "documentation/8b539b065334": {
    "title": "Lessons Learned",
    "description": "Retained technical documentation: Lessons Learned",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Lessons Learned</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Lessons Learned</h2>\n<h2>1. Apple management has two control planes</h2>\n<p>Intune can expose Apple enrollment, configuration, compliance, application, and lifecycle administration even when Apple Business Manager is not available. ABM is a separate Apple control plane for organization ownership, device assignment, and ADE.</p>\n<p>Treating these as one system would overstate what was actually implemented.</p>\n<h2>2. APNs is foundational and operationally sensitive</h2>\n<p>The Apple MDM Push certificate is not a one-time setup artifact. It is an annual operational dependency. The same Apple account must remain available for renewal, and the existing certificate relationship should be renewed rather than casually replaced.</p>\n<h2>3. Policy creation is not endpoint validation</h2>\n<p>Creating a macOS compliance policy or FileVault profile in Intune proves administrative configuration capability. It does not prove that a Mac received, enforced, or reported the setting.</p>\n<p>This project intentionally keeps those claims separate.</p>\n<h2>4. Portfolio accuracy is stronger than fabricated completeness</h2>\n<p>ABM, ADE, Platform SSO registration, EAP-TLS authentication, FileVault escrow, and lifecycle execution are valuable concepts, but inventing screenshots or pretending a managed Mac exists would weaken the portfolio.</p>\n<p>A clearly bounded simulation demonstrates sound administration judgment.</p>\n<h2>5. Current Intune design should avoid deprecated templates</h2>\n<p>The deprecated macOS Endpoint Protection template was visible, but FileVault was configured through the current Settings Catalog instead.</p>\n<h2>6. Enterprise Wi-Fi is a dependency chain</h2>\n<p>A Wi-Fi profile alone is not enterprise authentication. EAP-TLS depends on:</p>\n<ul>\n<li>trusted root certificate;</li>\n<li>device/user certificate issuance;</li>\n<li>certificate identity/EKU design;</li>\n<li>RADIUS trust;</li>\n<li>network policy;</li>\n<li>managed endpoint delivery.</li>\n</ul>\n<p>Documenting that dependency chain is more meaningful than creating a fake SSID.</p>\n<h2>7. Lifecycle administration requires ownership context</h2>\n<p>Retire, wipe, delete, restart, rename, and sync are exposed in Intune, but the correct action depends on ownership, incident type, reassignment plan, and data-retention requirements.</p>\n<h2>8. Evidence should prove exactly what the caption claims</h2>\n<p>The evidence gallery pairs each screenshot with a narrow claim. A capability screenshot proves capability. A policy review proves settings. A policy-monitor screenshot proves the policy exists. None are used to imply an enrolled Mac where none exists.</p></article>",
    "active": "Projects"
  },
  "documentation/45686c1c2a2a": {
    "title": "Portfolio Summary",
    "description": "Retained technical documentation: Portfolio Summary",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Portfolio Summary</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/portfolio-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Portfolio Summary</h2>\n<h2>Recruiter-facing description</h2>\n<p>Designed and documented an enterprise macOS management runbook spanning Apple Business Manager, Microsoft Intune, Automated Device Enrollment, Microsoft Entra authentication, Platform SSO, FileVault, compliance, enterprise Wi-Fi, certificates, application deployment, inventory, and device lifecycle administration. Implemented the Microsoft-side controls that were legitimately available in a real Intune tenant—including APNs, macOS compliance, and a FileVault Settings Catalog profile—while clearly separating ABM/ADE and endpoint-only validation as simulated/documented.</p>\n<h2>Resume bullet</h2>\n<ul>\n<li>Built a portfolio-grade macOS enterprise management runbook integrating Apple Business Manager architecture with Microsoft Intune; configured real APNs, macOS compliance, and FileVault policies, and documented ADE, Platform SSO, EAP-TLS certificate Wi-Fi, application deployment, renewal, and lifecycle operations with explicit validation boundaries.</li>\n</ul>\n<h2>LinkedIn project description</h2>\n<p>Created an enterprise macOS management project focused on accurate operational design rather than fabricated completeness. In a real Microsoft Intune tenant, I configured an Apple MDM Push certificate, created a macOS compliance baseline, built a FileVault Settings Catalog profile, and validated available Platform SSO, enterprise Wi-Fi, certificate, app-deployment, inventory, and lifecycle controls. Because I do not have an Apple Business Manager organization or managed Mac in this lab, ADE, ABM token exchange, endpoint Platform SSO, FileVault escrow, and destructive lifecycle operations are clearly documented as simulated procedures instead of being presented as completed production work.</p>\n<h2>Interview explanation</h2>\n<blockquote>\n<p>I wanted the project to show both technical knowledge and administrative judgment. I used the real Intune tenant for everything I could legitimately configure, including APNs, compliance, and FileVault. I also inspected the real Platform SSO, Wi-Fi, SCEP, app, inventory, and lifecycle surfaces. The Apple Business Manager and ADE portions are documented as simulations because I do not have an ABM organization or enrolled Mac. That boundary matters because creating an Intune policy is not the same as proving endpoint enforcement.</p>\n</blockquote></article>",
    "active": "Projects"
  },
  "documentation/9fab6a424a55": {
    "title": "Renewal Calendar and Operational Ownership",
    "description": "Retained technical documentation: Renewal Calendar and Operational Ownership",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Renewal Calendar and Operational Ownership</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/renewal-calendar.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Renewal Calendar and Operational Ownership</h2>\n<h2>Renewal schedule</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Item</th>\n<th>Cadence</th>\n<th>Current / planned date</th>\n<th>Owner responsibility</th>\n<th>Validation</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Apple MDM Push certificate (APNs)</td>\n<td>Annual</td>\n<td>Expires <strong>2027-09-26</strong></td>\n<td>Renew with the same Apple account before expiration</td>\n<td>Confirm Intune status and expiration</td>\n</tr>\n<tr>\n<td>ABM / Intune Enrollment Program Token</td>\n<td>Annual</td>\n<td>Not created in this lab</td>\n<td>Renew existing ABM server token before expiration</td>\n<td>Sync devices and confirm token state</td>\n</tr>\n<tr>\n<td>SCEP/PKCS issuing certificate chain</td>\n<td>Based on PKI policy</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Track CA and connector certificate expiration</td>\n<td>Test issuance before renewal window</td>\n</tr>\n<tr>\n<td>Wi-Fi/RADIUS server certificates</td>\n<td>Based on PKI policy</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Renew before trust expires</td>\n<td>EAP-TLS test from pilot Mac</td>\n</tr>\n<tr>\n<td>Application packages</td>\n<td>Continuous</td>\n<td>N/A</td>\n<td>Review new versions, signing, compatibility</td>\n<td>Pilot deployment</td>\n</tr>\n<tr>\n<td>macOS compliance baseline</td>\n<td>At least quarterly + OS release</td>\n<td>N/A</td>\n<td>Review minimum OS/security requirements</td>\n<td>Test on pilot group</td>\n</tr>\n<tr>\n<td>Platform SSO profile</td>\n<td>At OS/Company Portal changes</td>\n<td>N/A</td>\n<td>Review supported settings and registration behavior</td>\n<td>Pilot sign-in validation</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>At security baseline review</td>\n<td>N/A</td>\n<td>Confirm policy and recovery workflow</td>\n<td>Escrow + recovery test on pilot Mac</td>\n</tr>\n</tbody>\n</table></div>\n<h2>APNs renewal procedure</h2>\n<ol>\n<li>Start renewal well before expiration.</li>\n<li>Identify the Apple account that owns the existing certificate.</li>\n<li>In Intune, confirm the existing APNs certificate identity.</li>\n<li>Open Apple's Push Certificates Portal using the same owning Apple account.</li>\n<li>Renew the existing certificate.</li>\n<li>Download the renewed certificate.</li>\n<li>Upload it into the existing Intune APNs configuration.</li>\n<li>Confirm status and new expiration.</li>\n<li>Record the renewal date and next renewal deadline.</li>\n<li>Do not publish certificate material or Apple-account identifiers.</li>\n</ol>\n<h2>ABM token renewal procedure</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>Confirm the existing Intune Enrollment Program Token and corresponding ABM MDM server.</li>\n<li>Sign in to ABM with an authorized account.</li>\n<li>Download a renewed server token for the same MDM server.</li>\n<li>Upload it to the existing Intune token object.</li>\n<li>Synchronize devices.</li>\n<li>Confirm device count and token expiration.</li>\n<li>Record renewal ownership.</li>\n</ol>\n<h2>Operational rule</h2>\n<p>Renew existing trust relationships whenever continuity is required. Replacing APNs certificates or recreating ABM MDM server relationships without a change reason can break management continuity.</p></article>",
    "active": "Projects"
  },
  "documentation/7aa5e620028b": {
    "title": "Simulated Enterprise Deployment Scenario",
    "description": "Retained technical documentation: Simulated Enterprise Deployment Scenario",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Simulated Enterprise Deployment Scenario</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Simulated Enterprise Deployment Scenario</h2>\n<h2>Scenario</h2>\n<p>A company purchases a batch of corporate Macs from an Apple-authorized reseller. The devices are automatically assigned to the organization's Apple Business Manager tenant and then to Microsoft Intune.</p>\n<p>This scenario is <strong>SIMULATED / DOCUMENTED</strong>. It is used to demonstrate the intended operational sequence without claiming that an ABM tenant or physical managed Mac exists in this lab.</p>\n<h2>Workflow</h2>\n<ol>\n<li><strong>Procurement</strong></li>\n<li>\n<p>Reseller associates devices with the ABM organization.</p>\n</li>\n<li>\n<p><strong>Apple Business Manager</strong></p>\n</li>\n<li>Devices appear in ABM.</li>\n<li>\n<p>Administrator assigns them to the Microsoft Intune MDM server.</p>\n</li>\n<li>\n<p><strong>Enrollment Program Token</strong></p>\n</li>\n<li>\n<p>Intune synchronizes assigned devices from ABM.</p>\n</li>\n<li>\n<p><strong>ADE profile</strong></p>\n</li>\n<li>Corporate enrollment profile is assigned.</li>\n<li>\n<p>Required Setup Assistant panes are shown or skipped according to policy.</p>\n</li>\n<li>\n<p><strong>Setup Assistant</strong></p>\n</li>\n<li>Device connects to the network.</li>\n<li>Apple activation identifies the device as organization-managed.</li>\n<li>\n<p>Remote management begins.</p>\n</li>\n<li>\n<p><strong>Microsoft Entra authentication</strong></p>\n</li>\n<li>\n<p>User authenticates with organizational identity.</p>\n</li>\n<li>\n<p><strong>Intune enrollment</strong></p>\n</li>\n<li>\n<p>Device becomes managed and appears in inventory.</p>\n</li>\n<li>\n<p><strong>Security baseline</strong></p>\n</li>\n<li>Compliance evaluates System Integrity Protection, password state, encryption, firewall, Stealth Mode, and Gatekeeper.</li>\n<li>\n<p>FileVault policy enables encryption and recovery-key escrow.</p>\n</li>\n<li>\n<p><strong>Identity</strong></p>\n</li>\n<li>\n<p>Platform SSO registration links the local macOS sign-in experience with Microsoft Entra according to the chosen authentication method.</p>\n</li>\n<li>\n<p><strong>Enterprise Wi-Fi</strong></p>\n<ul>\n<li>Trusted root certificate and client certificate are delivered.</li>\n<li>WPA2-Enterprise / EAP-TLS profile connects the device to corporate wireless.</li>\n</ul>\n</li>\n<li>\n<p><strong>Applications</strong></p>\n<ul>\n<li>Required productivity/security applications install from Intune.</li>\n</ul>\n</li>\n<li>\n<p><strong>Operations</strong></p>\n<ul>\n<li>Help desk/admin teams use inventory, sync, restart, rename, retire, wipe, and reassignment workflows according to policy.</li>\n</ul>\n</li>\n</ol>\n<h2>Validation checkpoints</h2>\n<p>A real deployment would not be marked complete until the following were observed on an enrolled Mac:</p>\n<ul>\n<li>ADE profile applied during Setup Assistant;</li>\n<li>Entra authentication succeeds;</li>\n<li>device appears in Intune;</li>\n<li>configuration profiles report success;</li>\n<li>FileVault is enabled;</li>\n<li>recovery key is escrowed;</li>\n<li>compliance reports compliant;</li>\n<li>required apps install;</li>\n<li>Platform SSO registration succeeds;</li>\n<li>enterprise Wi-Fi authenticates;</li>\n<li>lifecycle actions behave as expected.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/980d98ed3406": {
    "title": "Troubleshooting Runbook",
    "description": "Retained technical documentation: Troubleshooting Runbook",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting Runbook</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting Runbook</h2>\n<p>Every troubleshooting scenario below distinguishes between actions that can be performed in Intune now and actions that require Apple Business Manager or an enrolled Mac.</p>\n<h2>Device not appearing in Apple Business Manager</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED</p>\n<p>Check:</p>\n<ol>\n<li>Purchase source is an Apple-authorized reseller or Apple direct channel that supports ABM assignment.</li>\n<li>Organization ID and reseller/customer identifiers are correct.</li>\n<li>Device serial is eligible for automated assignment.</li>\n<li>Reseller has assigned the device to the correct ABM organization.</li>\n<li>ABM sync/import has completed.</li>\n</ol>\n<p>Do not troubleshoot Intune until the device exists in ABM.</p>\n<h2>Device not synchronizing from ABM to Intune</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED</p>\n<p>Check:</p>\n<ol>\n<li>Enrollment Program Token has not expired.</li>\n<li>Token was created for the correct ABM MDM server.</li>\n<li>Device is assigned to that MDM server in ABM.</li>\n<li>Intune token sync completes without error.</li>\n<li>Device serial appears under the correct token.</li>\n</ol>\n<p>If the token has expired, renew the existing relationship rather than creating an unrelated replacement unless the relationship is intentionally being rebuilt.</p>\n<h2>ADE profile not assigned</h2>\n<p>Check:</p>\n<ul>\n<li>device exists under the Enrollment Program Token;</li>\n<li>device was synchronized after assignment;</li>\n<li>profile assignment scope includes the device;</li>\n<li>no competing assignment exists;</li>\n<li>profile is active.</li>\n</ul>\n<h2>Setup Assistant does not show expected panes</h2>\n<p>Check:</p>\n<ul>\n<li>device is actually using ADE;</li>\n<li>device has been erased/reset after the ADE assignment;</li>\n<li>latest ADE profile has synchronized;</li>\n<li>skipped Setup Assistant panes match the assigned profile;</li>\n<li>network access to Apple activation services is available.</li>\n</ul>\n<h2>APNs communication problems</h2>\n<p><strong>REAL operational dependency</strong></p>\n<p>Check:</p>\n<ul>\n<li>Intune Apple MDM Push Certificate status;</li>\n<li>certificate expiration date;</li>\n<li>same Apple account ownership used for renewal;</li>\n<li>certificate was renewed rather than replaced;</li>\n<li>device can reach Apple Push Notification service.</li>\n</ul>\n<p>Replacing instead of renewing the APNs certificate can sever management continuity and should be treated as a high-risk administrative change.</p>\n<h2>Company Portal / Entra authentication failure</h2>\n<p>Check:</p>\n<ul>\n<li>user can authenticate to Microsoft Entra;</li>\n<li>user is licensed for required Intune services;</li>\n<li>device time is correct;</li>\n<li>Conditional Access does not unintentionally block enrollment;</li>\n<li>Company Portal is supported on the installed macOS version;</li>\n<li>browser/web authentication completes successfully.</li>\n</ul>\n<h2>Platform SSO registration failure</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED endpoint procedure</p>\n<p>Check:</p>\n<ul>\n<li>supported macOS version;</li>\n<li>Company Portal / Enterprise SSO plug-in prerequisites;</li>\n<li>Platform SSO profile is assigned;</li>\n<li>extension identifier and team identifier are correct;</li>\n<li>user completed required registration;</li>\n<li>Entra sign-in logs for authentication failures;</li>\n<li>profile conflicts or duplicate SSO payloads.</li>\n</ul>\n<h2>FileVault not enabling</h2>\n<p>Check:</p>\n<ul>\n<li>FileVault policy assignment;</li>\n<li>device is supervised/managed as required by the chosen workflow;</li>\n<li>user has secure token capability where required;</li>\n<li>no conflicting FileVault payload exists;</li>\n<li>device has checked in after policy assignment;</li>\n<li>Intune per-setting status for policy errors.</li>\n</ul>\n<h2>FileVault recovery key not escrowed</h2>\n<p>Check:</p>\n<ul>\n<li>FileVault is actually enabled;</li>\n<li>recovery-key escrow policy is assigned;</li>\n<li>device has checked in after FileVault activation;</li>\n<li>personal recovery key exists;</li>\n<li>recovery key is visible in the authorized Intune recovery workflow;</li>\n<li>no policy conflict is present.</li>\n</ul>\n<p>Never collect or publish the actual recovery key in portfolio evidence.</p>\n<h2>Compliance failure</h2>\n<p>Check each configured requirement individually:</p>\n<ul>\n<li>System Integrity Protection;</li>\n<li>password requirement;</li>\n<li>storage encryption;</li>\n<li>firewall;</li>\n<li>Stealth Mode;</li>\n<li>Gatekeeper state.</li>\n</ul>\n<p>Use per-setting compliance status rather than guessing from the overall state.</p>\n<h2>Enterprise Wi-Fi failure</h2>\n<p>Check:</p>\n<ul>\n<li>SSID spelling;</li>\n<li>security type;</li>\n<li>EAP type;</li>\n<li>trusted root certificate;</li>\n<li>client certificate availability;</li>\n<li>certificate subject/SAN requirements;</li>\n<li>certificate EKU;</li>\n<li>RADIUS trust chain;</li>\n<li>device time;</li>\n<li>wireless controller/NPS/RADIUS logs.</li>\n</ul>\n<p>For EAP-TLS, troubleshoot certificate trust and identity before user credentials because the design is certificate-based.</p>\n<h2>Application deployment failure</h2>\n<p>Check:</p>\n<ul>\n<li>app type matches packaging format;</li>\n<li>package is signed and compatible with the target macOS version;</li>\n<li>assignment is correct;</li>\n<li>detection logic/version metadata is valid;</li>\n<li>required privacy/system extension settings are deployed;</li>\n<li>device has checked in;</li>\n<li>Intune app install status and local logs.</li>\n</ul>\n<h2>Expired Enrollment Program Token</h2>\n<p>Renew through the existing Apple Business Manager server relationship and upload the renewed token to Intune. Confirm the device count and sync after renewal.</p>\n<h2>Device retirement</h2>\n<p>For user offboarding or BYOD-style management removal, prefer the least destructive action that satisfies the requirement. Preserve corporate data handling policy and confirm whether retire removes managed configuration without factory reset.</p>\n<h2>Lost or stolen device</h2>\n<p>Escalate according to organization policy. Evaluate wipe, lock-related capabilities, identity-session revocation, certificate revocation, and asset reporting. Do not execute destructive actions without identity and ownership verification.</p></article>",
    "active": "Projects"
  },
  "documentation/57955486d8ae": {
    "title": "Validation",
    "description": "Retained technical documentation: Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation</h2>\n<h2>Final validation matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Capability</th>\n<th>Real / Simulated</th>\n<th>Configured</th>\n<th>Validated</th>\n<th>Evidence</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Intune Apple enrollment administration</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Apple enrollment baseline</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>APNs certificate creation</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Apple Push Certificates Portal confirmation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>APNs upload to Intune</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Intune upload confirmation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>ABM organization</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Architecture/runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Enrollment Program Token</td>\n<td>Simulated</td>\n<td>No</td>\n<td>Workflow only</td>\n<td>Token creation page reviewed</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>ADE device synchronization</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>ADE profile</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>macOS compliance policy</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Policy object yes</td>\n<td>Review + policy monitor</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Compliance on enrolled Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Policy object yes</td>\n<td>Settings + policy list</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>FileVault encryption on Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>Recovery-key escrow</td>\n<td>Simulated</td>\n<td>Policy intent only</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>Platform SSO capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>Settings Catalog capability</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Platform SSO endpoint registration</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Enterprise Wi-Fi capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>Enterprise profile settings</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>EAP-TLS availability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>EAP dropdown</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>SCEP profile capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>SCEP configuration surface</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Certificate issuance</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enterprise PKI/SCEP path</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>macOS app deployment capability</td>\n<td>Real</td>\n<td>No app retained</td>\n<td>Yes</td>\n<td>App type selector</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>App install on Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>macOS enrollment restrictions</td>\n<td>Real</td>\n<td>Existing default</td>\n<td>Yes</td>\n<td>Restriction properties</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>macOS device inventory</td>\n<td>Real</td>\n<td>N/A</td>\n<td>Yes</td>\n<td>0-device inventory page</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Bulk device actions</td>\n<td>Real capability</td>\n<td>N/A</td>\n<td>Yes</td>\n<td>Action list</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Retire / wipe execution</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Device reassignment</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Lifecycle runbook</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Evidence interpretation</h2>\n<p>A screenshot proving that an Intune configuration surface exists is classified as <strong>capability validation</strong>, not endpoint implementation.</p>\n<p>A policy object created in Intune is classified as <strong>REAL CONFIGURATION</strong>.</p>\n<p>A result that requires an enrolled Mac is not marked validated unless an actual device reports the state.</p>\n<h2>Evidence index</h2>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/README.md\" rel=\"noopener noreferrer\" target=\"_blank\">evidence/README.md</a> and the live <a href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">evidence gallery</a>.</p></article>",
    "active": "Projects"
  },
  "documentation/a95d26aafa04": {
    "title": "ServiceNow Administration & ITSM Lab",
    "description": "Retained technical documentation: ServiceNow Administration & ITSM Lab",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>ServiceNow Administration &amp; ITSM Lab</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/servicenow-administration-itsm-lab/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>ServiceNow Administration &amp; ITSM Lab</h2>\n<p><strong>Status:</strong> In progress — Phases 1–4 completed and validated<br/>\n<strong>Environment:</strong> ServiceNow Personal Developer Instance (PDI)<br/>\n<strong>Scope:</strong> Administrative configuration and ITSM operations lab. This is not production or employer-owned ServiceNow administration.</p>\n<h2>Project objective</h2>\n<p>Build and validate a realistic small internal IT support model while demonstrating ServiceNow administration beyond catalog request fulfillment.</p>\n<p>The project follows this operating model:</p>\n<pre><code class=\"language-text\">Requirement\n→ Intended Configuration\n→ Implementation\n→ Validation\n→ Result\n</code></pre>\n<p>Configuration is added only when it solves a realistic operational problem. Native declarative platform features are preferred over unnecessary scripting.</p>\n<h2>Current checkpoint</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Phase</th>\n<th>Area</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>01</td>\n<td>Administration Foundation &amp; Incident Routing</td>\n<td>Complete / validated</td>\n</tr>\n<tr>\n<td>02</td>\n<td>Incident Experience Configuration</td>\n<td>Complete / validated</td>\n</tr>\n<tr>\n<td>03</td>\n<td>SLA Administration</td>\n<td>Complete / validated</td>\n</tr>\n<tr>\n<td>04</td>\n<td>Notifications &amp; Escalation</td>\n<td>Complete / validated</td>\n</tr>\n<tr>\n<td>05</td>\n<td>Flow Designer Automation</td>\n<td>Not started</td>\n</tr>\n<tr>\n<td>06</td>\n<td>UI Policies &amp; Business Rules</td>\n<td>Not started</td>\n</tr>\n<tr>\n<td>07</td>\n<td>Knowledge Management Administration</td>\n<td>Not started</td>\n</tr>\n<tr>\n<td>08</td>\n<td>Service Catalog Administration</td>\n<td>Not started</td>\n</tr>\n<tr>\n<td>09</td>\n<td>Reports &amp; Dashboards</td>\n<td>Not started</td>\n</tr>\n<tr>\n<td>10</td>\n<td>Final Validation &amp; Portfolio Publication</td>\n<td>Not started</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Phase 01 — Administration Foundation &amp; Incident Routing</h2>\n<h3>Requirement</h3>\n<p>Provide centralized Service Desk intake with least-privilege technician access and manual escalation to specialist support groups.</p>\n<h3>Configuration</h3>\n<p>Dedicated lab support groups:</p>\n<ul>\n<li><code>Lab Service Desk</code></li>\n<li><code>Lab Endpoint Support</code></li>\n<li><code>Lab Network Support</code></li>\n</ul>\n<p>Access is provided through group-derived <code>itil</code> role membership rather than broad direct administrator access.</p>\n<p>Separate requester and technician identities are used for impersonation-based validation.</p>\n<h3>Validation</h3>\n<p>Primary routing test record:</p>\n<pre><code class=\"language-text\">INC0010010\n</code></pre>\n<p>Validated routing path:</p>\n<pre><code class=\"language-text\">Lab Requester\n→ new Incident\n→ auto-assigned to Lab Service Desk\n→ triaged\n→ reassigned to Lab Network Support\n→ visible/workable by Network Technician\n</code></pre>\n<h3>Result</h3>\n<p>The lab demonstrates centralized Tier 1 intake, manual Service Desk triage, specialist escalation, and role-qualified technician access without allowing requesters to route their own incidents directly to specialist teams.</p>\n<h2>Phase 02 — Incident Experience Configuration</h2>\n<h3>Requirement</h3>\n<p>Make the Incident workspace useful for Service Desk triage without adding configuration merely to demonstrate platform features.</p>\n<h3>Configuration</h3>\n<p>The existing Incident form was evaluated before making changes. The form already provided useful grouping for:</p>\n<ul>\n<li>classification</li>\n<li>impact and urgency</li>\n<li>calculated priority</li>\n<li>ownership</li>\n<li>activity</li>\n</ul>\n<p>Priority remained platform-calculated/read-only rather than manually controlled.</p>\n<p>The Incident list was adjusted for operational visibility so technicians can review classification and ownership information without opening every record.</p>\n<p>The existing Phase 1 routing incident was reused instead of creating unnecessary duplicate test records.</p>\n<h3>Validation</h3>\n<p>The final Incident experience was reviewed against the Service Desk operating model rather than against a checklist of available features.</p>\n<h3>Result</h3>\n<p>The phase retained useful native behavior, improved technician visibility where needed, and avoided unnecessary UI Policies or other configuration reserved for later phases.</p>\n<h2>Phase 03 — SLA Administration</h2>\n<h3>Requirement</h3>\n<p>Apply meaningful SLA administration to the Incident process and validate actual Task SLA behavior rather than merely creating SLA definitions.</p>\n<h3>Result</h3>\n<p>SLA administration has been completed and validated in the PDI. Detailed SLA configuration, final test evidence, and any troubleshooting findings will be consolidated during Phase 10 so the repository does not publish unverified intermediate notes.</p>\n<h2>Phase 04 — Notifications &amp; Escalation</h2>\n<h3>Requirement</h3>\n<p>Use notifications for operationally useful Incident communication and escalation rather than generic email testing.</p>\n<h3>Result</h3>\n<p>Notification and escalation administration has been completed and validated in the PDI. Detailed final notification conditions, recipients, evidence, and troubleshooting findings will be consolidated during Phase 10 after the remaining project phases are complete.</p>\n<h2>Previous ServiceNow project boundary</h2>\n<p>A separate earlier project already demonstrates:</p>\n<ul>\n<li>Service Catalog fulfillment</li>\n<li>REQ → RITM → SCTASK relationships</li>\n<li>approvals</li>\n<li>Procurement and Field Services fulfillment</li>\n<li>users and groups</li>\n<li><code>itil</code> role-qualified assignment</li>\n<li>reference-qualifier troubleshooting</li>\n<li>impersonation</li>\n<li>work notes and comments</li>\n<li>vendor/backorder handling</li>\n<li>automatic progression and closure</li>\n</ul>\n<p>This administration lab intentionally does not rebuild those items simply for feature coverage.</p>\n<p>See the prior project:</p>\n<pre><code class=\"language-text\">projects/servicenow-request-fulfillment/\n</code></pre>\n<h2>Evidence policy</h2>\n<p>Evidence is retained when it proves a meaningful final administrative outcome. Routine intermediate clicks are not treated as portfolio evidence.</p>\n<p>The final Phase 10 audit will reconcile screenshots with:</p>\n<ul>\n<li>configuration demonstrated</li>\n<li>observed behavior</li>\n<li>troubleshooting findings</li>\n<li>evidence identifiers</li>\n<li>final vs supporting evidence</li>\n</ul>\n<p>No feature will be claimed as proven unless it was actually configured and validated.</p>\n<h2>Claim boundary</h2>\n<p>All work in this project is performed in a ServiceNow Personal Developer Instance for hands-on administration practice. It demonstrates lab-based ServiceNow administration capability and ITSM understanding; it does not represent production or employer-owned configuration.</p></article>",
    "active": "Projects"
  },
  "documentation/13026d5bdb49": {
    "title": "ServiceNow Request Fulfillment & Procurement Workflow",
    "description": "Retained technical documentation: ServiceNow Request Fulfillment & Procurement Workflow",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>ServiceNow Request Fulfillment &amp; Procurement Workflow</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/servicenow-request-fulfillment/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>ServiceNow Request Fulfillment &amp; Procurement Workflow</h2>\n<h2>Status</h2>\n<p><strong>COMPLETE</strong></p>\n<p>The intended request fulfillment and procurement workflow has been performed, validated, evidenced, documented, and accurately bounded. Additional ServiceNow administration work belongs in the separate ServiceNow Administration &amp; ITSM Lab rather than being required for this project's completion.</p>\n<h2>Objective</h2>\n<p>Validate a realistic ServiceNow Personal Developer Instance workflow from catalog request through approval, procurement fulfillment, deployment, and automatic request completion.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>ServiceNow Service Catalog request handling.</li>\n<li>Request (<code>REQ</code>), Requested Item (<code>RITM</code>), and Catalog Task (<code>SCTASK</code>) relationships.</li>\n<li>Approval routing and separation of duties.</li>\n<li>Assignment groups, users, and fulfillment ownership.</li>\n<li>Role-qualified assignee troubleshooting.</li>\n<li>Service Operations Workspace task handling.</li>\n<li>Work notes and customer-visible comments.</li>\n<li>Backorder and estimated-delivery tracking.</li>\n<li>Automatic workflow stage transitions and closure.</li>\n</ul>\n<h2>Validated Workflow</h2>\n<p>A Standard Laptop request for Jeremy Fontenot generated <code>REQ0010001</code> and <code>RITM0010001</code>. The requested item entered approval and was approved by David Loo. ServiceNow then automatically created Procurement task <code>SCTASK0010001</code>.</p>\n<p>The Procurement group initially had no usable fulfillment member. A dedicated lab identity, <code>procurement.agent</code>, was created and added to Procurement. Group membership alone did not make the user selectable in <code>Assigned to</code>; inspection of the <code>Task [task].assigned_to</code> dictionary configuration showed a reference qualifier requiring the <code>itil</code> role. Adding the required lab role resolved the invalid-reference condition without weakening the platform qualifier.</p>\n<p>Procurement Agent was impersonated to validate the assignee experience. The task was moved to Work in Progress and fulfillment notes were recorded. Because no stock asset was established in the lab, the request was intentionally modeled as a vendor order rather than falsely claiming physical inventory fulfillment. <code>RITM0010001</code> was marked Backordered with an estimated delivery date, and a customer-visible status update was recorded.</p>\n<p>Vendor delivery was then simulated. Backorder status was cleared, procurement completion was documented, and <code>SCTASK0010001</code> was closed complete. ServiceNow automatically advanced <code>RITM0010001</code> from Order Fulfillment to Deployment and created Field Services task <code>SCTASK0010002</code>.</p>\n<p>A separate <code>field.services.agent</code> lab identity was created, granted the required <code>itil</code> role, and added to Field Services. The deployment task was assigned to that identity and validated through impersonation. Deployment notes were explicitly labeled <code>LAB SIMULATION</code>. The Configuration item field was intentionally left blank because no legitimate CI or physical asset was created.</p>\n<p>After <code>SCTASK0010002</code> was closed complete, ServiceNow automatically changed <code>RITM0010001</code> to <code>Closed Complete</code> with Stage <code>Completed</code>. The parent <code>REQ0010001</code> then automatically changed from Open to <code>Closed Complete</code>.</p>\n<p>The Request activity recorded:</p>\n<blockquote>\n<p>Request Automatically Closed as all Line Items were complete</p>\n</blockquote>\n<p>Neither the RITM nor the parent REQ was manually forced closed.</p>\n<h2>Workflow Path</h2>\n<pre><code class=\"language-text\">Requester\n   |\n   v\nREQ0010001 / RITM0010001\n   |\n   v\nApproval — David Loo\n   |\n   v\nSCTASK0010001 — Procurement\n   |\n   +--&gt; Vendor/backorder lab path\n   |\n   v\nProcurement Closed Complete\n   |\n   v\nAutomatic RITM transition to Deployment\n   |\n   v\nSCTASK0010002 — Field Services\n   |\n   v\nLAB SIMULATION: endpoint deployment\n   |\n   v\nField Services Closed Complete\n   |\n   v\nRITM automatically Closed Complete / Completed\n   |\n   v\nREQ automatically Closed Complete\n</code></pre>\n<h2>Troubleshooting Finding</h2>\n<p>The most significant administrative issue was the inability to select the new Procurement fulfillment user in <code>Assigned to</code>. The root cause was not group membership. The <code>Task [task].assigned_to</code> reference qualifier required <code>itil</code>. Granting that role made the user a valid assignee while preserving the existing platform control.</p>\n<h2>Result</h2>\n<p>The lab validated the complete relationship between Service Catalog request records, approval, automatically generated fulfillment tasks, assignment groups, role-qualified assignee selection, impersonated fulfillment, vendor/backorder tracking, sequential deployment work, automatic stage progression, and automatic request closure.</p>\n<h2>Claim Boundary</h2>\n<p>This is personal-lab work performed in a ServiceNow Personal Developer Instance. Physical laptop procurement, vendor delivery, software installation, and user handoff were simulated. The project demonstrates platform workflow understanding and hands-on administration but does not claim production ServiceNow administration or employer-owned configuration.</p></article>",
    "active": "Projects"
  },
  "documentation/c9a874b41c67": {
    "title": "Windows Autopilot & Intune MDM Provisioning",
    "description": "Retained technical documentation: Windows Autopilot & Intune MDM Provisioning",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Windows Autopilot &amp; Intune MDM Provisioning</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Windows Autopilot &amp; Intune MDM Provisioning</h2>\n<p><strong>Status:</strong> COMPLETE<br/>\n<strong>Completion date:</strong> 2026-09-22</p>\n<h2>Project objective</h2>\n<p>Build and validate a portfolio-quality Windows Autopilot and Microsoft Intune pilot demonstrating device registration, user-driven Microsoft Entra join, automatic Intune enrollment, branded OOBE, Enrollment Status Page controls, required Microsoft 365 Apps deployment, compliance evaluation, BitLocker, Microsoft Defender, Windows Firewall, Virtualization Based Security, Secure Boot, and post-enrollment management.</p>\n<h2>Environment</h2>\n<ul>\n<li>Microsoft Entra verified domain: <code>jeremyfontenot.online</code></li>\n<li>On-premises AD DS domain: <code>ad.jeremyfontenot.online</code></li>\n<li>Autopilot mode: user-driven</li>\n<li>Join type: Microsoft Entra joined</li>\n<li>Pilot user group: <code>SG-Intune-Autopilot-Pilot-Users</code></li>\n<li>Pilot device group: <code>SG-Intune-Autopilot-Pilot-Devices</code></li>\n<li>Autopilot deployment profile: <code>AP UserDriven EntraJoin Pilot</code></li>\n<li>Enrollment Status Page: <code>ESP Autopilot Pilot</code></li>\n<li>Required application: <code>M365 Apps Autopilot Pilot</code></li>\n<li>Compliance policy: <code>Compliance Windows Autopilot Pilot</code></li>\n<li>Security configuration: <code>Config Windows Autopilot Security Pilot</code></li>\n</ul>\n<h2>End-to-end result</h2>\n<p>A registered physical Lenovo endpoint was safely backed up, reset to Windows OOBE, and successfully completed the live Windows Autopilot deployment flow.</p>\n<p>Validated outcomes include branded OOBE, Microsoft Entra join, Intune MDM enrollment, Enrollment Status Page completion, required Microsoft 365 Apps deployment, BitLocker, Defender, Windows Firewall, VBS, Secure Boot remediation, final Intune compliance, Settings Catalog success, and a separate administrative elevation path while the Autopilot user remained standard.</p>\n<h2>Security and evidence handling</h2>\n<p>Public evidence excludes passwords, recovery keys, MFA codes, private SSH keys, OpenVPN credentials, 1Password recovery material, browser password exports, and other secrets. Unique hardware and directory identifiers are redacted from public screenshots and command output.</p>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/README.md\" rel=\"noopener noreferrer\" target=\"_blank\">evidence/README.md</a> for the evidence index.</p></article>",
    "active": "Projects"
  },
  "documentation/88c6903486ec": {
    "title": "Architecture",
    "description": "Retained technical documentation: Architecture",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Architecture</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Architecture</h2>\n<h2>Logical design</h2>\n<p>The pilot separates user-scoped enrollment enablement from device-scoped Autopilot configuration.</p>\n<h3>User scope</h3>\n<p><code>SG-Intune-Autopilot-Pilot-Users</code> scopes automatic Intune MDM enrollment to the pilot.</p>\n<h3>Device scope</h3>\n<p><code>SG-Intune-Autopilot-Pilot-Devices</code> targets the Autopilot deployment profile, Enrollment Status Page, Microsoft 365 Apps required deployment, compliance policy, and Windows Settings Catalog security configuration.</p>\n<h2>Runtime flow</h2>\n<ol>\n<li>Device hardware identity is registered with Windows Autopilot.</li>\n<li>The device receives the user-driven Microsoft Entra join profile.</li>\n<li>Tenant branding is displayed during OOBE.</li>\n<li>The pilot user authenticates and the device joins Microsoft Entra ID.</li>\n<li>Automatic Intune MDM enrollment occurs.</li>\n<li>Enrollment Status Page blocks completion while required configuration and Microsoft 365 Apps are processed.</li>\n<li>The device reaches the Windows desktop.</li>\n<li>Endpoint-side PowerShell and Intune portal evidence validate the resulting security state and compliance.</li>\n</ol>\n<h2>Security controls</h2>\n<p>The compliance policy evaluates BitLocker, Secure Boot, code integrity, storage encryption, Windows Firewall, TPM, antivirus, antispyware, Microsoft Defender Antimalware, current security intelligence, and real-time protection.</p>\n<p>The Settings Catalog profile applies BitLocker/device encryption settings, Defender protections, PUA blocking, VBS, and Windows Firewall enablement for Domain, Private, and Public profiles.</p>\n<p>The enrolled pilot user remains a standard user. Administrative elevation is provided separately through the Microsoft Entra Device Administrators role.</p></article>",
    "active": "Projects"
  },
  "documentation/caff97cd6e46": {
    "title": "Project 1 Evidence Index",
    "description": "Retained technical documentation: Project 1 Evidence Index",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Project 1 Evidence Index</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Project 1 Evidence Index</h2>\n<p>Public evidence is sanitized. Passwords, recovery keys, MFA codes, private keys, VPN configuration contents, browser password exports, recovery codes, device IDs, certificate thumbprints, and hardware serial numbers are excluded or redacted.</p>\n<h2>Screenshots</h2>\n<ol>\n<li><code>screenshots/01-autopilot-branded-oobe.webp</code> — Autopilot retrieved the tenant experience and displayed custom work/school branding.</li>\n<li><code>screenshots/02-esp-device-preparation.webp</code> — Enrollment Status Page began device preparation.</li>\n<li><code>screenshots/03-esp-device-setup-complete.webp</code> — Device preparation and device setup completed while account setup continued.</li>\n<li><code>screenshots/04-compliance-before-remediation.webp</code> — Compliance policy identified BitLocker and Secure Boot as not compliant; device identifier redacted.</li>\n<li><code>screenshots/05-intune-final-compliant.webp</code> — Final Intune inventory showed the corporate device compliant; device identifier and UPN redacted.</li>\n<li><code>screenshots/06-settings-catalog-success.webp</code> — Settings Catalog check-in reported 2 succeeded, 0 errors, 0 conflicts, 0 not applicable, 0 in progress.</li>\n</ol>\n<h2>Command evidence</h2>\n<ul>\n<li><code>01-dsregcmd-sanitized.txt</code></li>\n<li><code>02-intune-enterprisemgmt-tasks-sanitized.txt</code></li>\n<li><code>03-m365-apps-validation.txt</code></li>\n<li><code>04-bitlocker-validation.txt</code></li>\n<li><code>05-defender-validation.txt</code></li>\n<li><code>06-firewall-vbs-secureboot-validation.txt</code></li>\n</ul>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">validation.md</a> for the consolidated validation matrix.</p></article>",
    "active": "Projects"
  },
  "documentation/441b5a30fb0a": {
    "title": "Implementation",
    "description": "Retained technical documentation: Implementation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Implementation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Implementation</h2>\n<h2>1. Pilot-scoped automatic MDM enrollment</h2>\n<p>Automatic Intune enrollment was scoped to <code>SG-Intune-Autopilot-Pilot-Users</code>.</p>\n<h2>2. Autopilot registration and targeting</h2>\n<p>A physical Lenovo endpoint was registered with Windows Autopilot and added to <code>SG-Intune-Autopilot-Pilot-Devices</code>. The device later reported the deployment profile as assigned.</p>\n<h2>3. User-driven Microsoft Entra join</h2>\n<p><code>AP UserDriven EntraJoin Pilot</code> was configured for user-driven Microsoft Entra join, standard-user provisioning, and the device naming template <code>AP-%SERIAL%</code>.</p>\n<h2>4. Microsoft Entra branding</h2>\n<p>Custom background, banner, square logo, sign-in hint, and lab-specific sign-in text were configured and observed during live OOBE.</p>\n<h2>5. Enrollment Status Page</h2>\n<p><code>ESP Autopilot Pilot</code> displayed provisioning progress and blocked completion while the required application and device configuration were processed.</p>\n<h2>6. Microsoft 365 Apps</h2>\n<p><code>M365 Apps Autopilot Pilot</code> was required for the pilot device group. Post-enrollment validation confirmed <code>O365ProPlusRetail</code> on x64 Click-to-Run.</p>\n<h2>7. Compliance and remediation</h2>\n<p><code>Compliance Windows Autopilot Pilot</code> initially reported BitLocker and Secure Boot as noncompliant. Local validation showed BitLocker was already fully encrypted while Secure Boot was disabled. Secure Boot was enabled in firmware and Intune was synchronized; the device then reported compliant.</p>\n<h2>8. Security configuration</h2>\n<p><code>Config Windows Autopilot Security Pilot</code> applied BitLocker, Defender, firewall, PUA, and VBS controls. Final Intune check-in status showed 2 succeeded, 0 errors, 0 conflicts, 0 not applicable, and 0 in progress.</p>\n<h2>9. Administrative access</h2>\n<p>The Autopilot user remained a standard user. A separate tenant administrator was assigned the Microsoft Entra Device Administrators role. UAC elevation was validated before running administrative endpoint checks.</p>\n<h2>10. Safe reset preparation</h2>\n<p>Before destructive reset, selected lab/business data and recovery-critical configuration were backed up to an SMB share. Secret-bearing recovery files are intentionally excluded from this public repository.</p></article>",
    "active": "Projects"
  },
  "documentation/157441b450a2": {
    "title": "Lessons Learned",
    "description": "Retained technical documentation: Lessons Learned",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Lessons Learned</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Lessons Learned</h2>\n<ol>\n<li>Pilot-scoped groups reduce blast radius and simplify troubleshooting.</li>\n<li>Assigned or Active is not proof of endpoint enforcement; validate the resulting device state.</li>\n<li>End-to-end validation matters more than portal configuration screenshots.</li>\n<li>Backup and recovery readiness are part of change management for destructive enrollment testing.</li>\n<li>Keep normal users standard and provide a separate administrative elevation path.</li>\n<li><code>runas</code> is not the same as UAC elevation; validate the actual token.</li>\n<li>Troubleshoot compliance from both endpoint evidence and the Intune management plane.</li>\n<li>Firmware settings such as Secure Boot can determine cloud compliance.</li>\n<li>Endpoint-side PowerShell plus Intune portal status provides stronger evidence than either source alone.</li>\n<li>Never publish recovery codes, private keys, VPN profiles, browser password exports, or BitLocker recovery values.</li>\n</ol></article>",
    "active": "Projects"
  },
  "documentation/826296edbb04": {
    "title": "Portfolio Summary",
    "description": "Retained technical documentation: Portfolio Summary",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Portfolio Summary</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/portfolio-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Portfolio Summary</h2>\n<h2>Windows Autopilot &amp; Intune MDM Provisioning</h2>\n<p>Implemented and validated an end-to-end Windows Autopilot deployment using Microsoft Intune and Microsoft Entra ID.</p>\n<p>The project uses dedicated pilot user/device groups, user-driven Microsoft Entra join, automatic Intune MDM enrollment, custom Entra branding, Enrollment Status Page controls, required Microsoft 365 Apps deployment, Windows compliance, and a Settings Catalog security baseline.</p>\n<p>A registered physical Lenovo endpoint was safely backed up, reset to OOBE, and provisioned through the live Autopilot workflow. Post-enrollment validation confirmed Entra join, Intune management, Microsoft 365 Apps, BitLocker, Defender, Windows Firewall, VBS, Secure Boot, and final Intune compliance.</p>\n<p>A real compliance issue was identified and remediated: Secure Boot was disabled in firmware. After enabling Secure Boot and synchronizing the endpoint, Intune reported the device compliant.</p>\n<p>The Autopilot user remains a standard user. Administrative elevation is provided separately through the Microsoft Entra Device Administrators role.</p>\n<p><strong>Status: COMPLETE</strong></p></article>",
    "active": "Projects"
  },
  "documentation/78b356285468": {
    "title": "Troubleshooting",
    "description": "Retained technical documentation: Troubleshooting",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting</h2>\n<h2>Autopilot profile propagation</h2>\n<p>Profile assignment did not appear immediately. A service sync and propagation wait were used before the device reported <code>Assigned</code>.</p>\n<h2>ESP assignment display</h2>\n<p>An ESP assignment temporarily appeared stale/soft-deleted even though the target group existed. Refreshing the portal restored the correct Active state without rebuilding the group.</p>\n<h2>Branding asset limits</h2>\n<p>The original background exceeded Microsoft Entra upload limits. It was recompressed while retaining the required dimensions.</p>\n<h2>Safe backup before reset</h2>\n<p>Because the Autopilot target was also the administrative laptop, destructive reset was delayed until a dedicated SMB backup target and independent OpenVPN recovery path were validated.</p>\n<h2>Standard user and elevation</h2>\n<p>The Autopilot profile intentionally created a standard user. BitLocker management commands failed from the standard session. Assigning a separate Entra account to Device Administrators provided the supported administrative path. A filtered <code>runas</code> token still showed the Administrators SID as deny-only; a true UAC elevation produced an enabled Administrators token.</p>\n<h2>Initial compliance failure</h2>\n<p>The first compliance report showed BitLocker and Secure Boot as not compliant. Local BitLocker validation showed the OS volume was already fully encrypted. <code>Confirm-SecureBootUEFI</code> returned <code>False</code>, identifying the real firmware gap. Secure Boot was enabled in UEFI, then an Intune sync was performed. Final compliance changed to <code>Compliant</code>.</p>\n<h2>Management boundary</h2>\n<p>After Autopilot, the endpoint is Microsoft Entra joined and Intune-managed rather than AD DS domain joined. Intune/MDM is the authoritative management path for this project endpoint.</p></article>",
    "active": "Projects"
  },
  "documentation/552a8ca8fcd7": {
    "title": "Validation",
    "description": "Retained technical documentation: Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation</h2>\n<h2>Final validation matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Evidence</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Autopilot profile</td>\n<td>Registered device received assigned profile</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Branded OOBE</td>\n<td>Custom lab sign-in displayed</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Microsoft Entra join</td>\n<td><code>AzureAdJoined : YES</code>, <code>DomainJoined : NO</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Device authentication</td>\n<td><code>DeviceAuthStatus : SUCCESS</code>, TPM protected</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>SSO</td>\n<td><code>AzureAdPrt : YES</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Intune MDM enrollment</td>\n<td>EnterpriseMgmt scheduled tasks present</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Device naming</td>\n<td>Autopilot naming template applied</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>ESP</td>\n<td>Device preparation/setup/account setup completed</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Microsoft 365 Apps</td>\n<td><code>O365ProPlusRetail</code>, x64</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>BitLocker</td>\n<td>Fully encrypted, 100%, Protection On</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Defender</td>\n<td>Antivirus, antispyware, real-time, behavior, IOAV enabled</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Windows Firewall</td>\n<td>Domain, Private, Public enabled</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>VBS</td>\n<td><code>VirtualizationBasedSecurityStatus : 2</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Secure Boot</td>\n<td><code>Confirm-SecureBootUEFI</code> returned <code>True</code> after remediation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Compliance</td>\n<td>Intune device state <code>Compliant</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Settings Catalog</td>\n<td>2 succeeded; 0 error/conflict/not-applicable/in-progress</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Standard-user posture</td>\n<td>Pilot user non-admin; separate elevation path validated</td>\n<td>COMPLETE</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Sanitized command highlights</h2>\n<h3>Entra join and SSO</h3>\n<pre><code class=\"language-text\">AzureAdJoined : YES\nEnterpriseJoined : NO\nDomainJoined : NO\nDeviceAuthStatus : SUCCESS\nTpmProtected : YES\nAzureAdPrt : YES\n</code></pre>\n<h3>Microsoft 365 Apps</h3>\n<pre><code class=\"language-text\">ProductReleaseIds : O365ProPlusRetail\nPlatform          : x64\n</code></pre>\n<h3>BitLocker</h3>\n<pre><code class=\"language-text\">Conversion Status    : Fully Encrypted\nPercentage Encrypted : 100.0%\nEncryption Method    : XTS-AES 128\nProtection Status    : Protection On\nKey Protectors       : Numerical Password, TPM\n</code></pre>\n<h3>Defender</h3>\n<pre><code class=\"language-text\">AntivirusEnabled          : True\nAntispywareEnabled        : True\nRealTimeProtectionEnabled : True\nBehaviorMonitorEnabled    : True\nIoavProtectionEnabled     : True\n</code></pre>\n<h3>Firewall</h3>\n<pre><code class=\"language-text\">Domain  True\nPrivate True\nPublic  True\n</code></pre>\n<h3>VBS</h3>\n<pre><code class=\"language-text\">VirtualizationBasedSecurityStatus : 2\n</code></pre>\n<h3>Secure Boot</h3>\n<pre><code class=\"language-text\">Confirm-SecureBootUEFI\nTrue\n</code></pre>\n<p>No recovery keys, passwords, tokens, device IDs, certificate thumbprints, or hardware serial numbers are included.</p></article>",
    "active": "Projects"
  },
  "documentation/766e6fce41e2": {
    "title": "Windows LAPS & Advanced Group Policy",
    "description": "Retained technical documentation: Windows LAPS & Advanced Group Policy",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Windows LAPS &amp; Advanced Group Policy</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Windows LAPS &amp; Advanced Group Policy</h2>\n<h2>Status</h2>\n<p><strong>COMPLETE</strong></p>\n<p>This project demonstrates a validated deployment of modern Windows LAPS in the <code>ad.jeremyfontenot.online</code> Active Directory lab using a dedicated test OU, Group Policy, encrypted password storage, least-privilege delegation, event-log validation, and forced password rotation.</p>\n<h2>Environment</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Configuration</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>AD domain</td>\n<td><code>ad.jeremyfontenot.online</code></td>\n</tr>\n<tr>\n<td>NetBIOS</td>\n<td><code>JFAD</code></td>\n</tr>\n<tr>\n<td>Domain controller</td>\n<td><code>DC01</code> - Windows Server 2022</td>\n</tr>\n<tr>\n<td>Test endpoint</td>\n<td><code>WS01</code> - Windows 10 Pro 10.0.19045</td>\n</tr>\n<tr>\n<td>Test OU</td>\n<td><code>OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></td>\n</tr>\n<tr>\n<td>LAPS GPO</td>\n<td><code>GPO - Workstations - Windows LAPS</code></td>\n</tr>\n<tr>\n<td>Managed account</td>\n<td><code>LocalAdmin</code></td>\n</tr>\n<tr>\n<td>Reader group</td>\n<td><code>JFAD\\GG-LAPS-Password-Readers</code></td>\n</tr>\n</tbody>\n</table></div>\n<h2>Validated controls</h2>\n<ul>\n<li>Modern Windows LAPS module present on DC01 and WS01</li>\n<li>AD schema inspected before modification</li>\n<li><code>Update-LapsADSchema</code> completed and six <code>msLAPS-*</code> attributes validated</li>\n<li>Dedicated <code>LAPS-Test</code> OU created and WS01 moved into scope</li>\n<li>Computer self-permission delegated with <code>Set-LapsADComputerSelfPermission</code></li>\n<li>Dedicated password-reader group created and delegated with <code>Set-LapsADReadPasswordPermission</code></li>\n<li>GPO configured for AD backup, 30-day age, 14-character complex passwords, encrypted storage, and an authorized decryptor group</li>\n<li><code>gpupdate</code>, <code>gpresult</code>, and GUI Group Policy Results/RSOP validated</li>\n<li>Windows LAPS Event IDs 10021, 10020, 10018, 10014, and 10004 validated</li>\n<li>Delegated non-admin retrieval succeeded</li>\n<li>Unauthorized standard-user retrieval returned no LAPS record</li>\n<li>Forced password rotation changed the password update and expiration timestamps</li>\n</ul>\n<h2>Security design</h2>\n<p>The built-in RID-500 <code>Administrator</code> account remains disabled. Windows LAPS manages the existing enabled <code>WS01\\LocalAdmin</code> account instead. Passwords are stored using encrypted Windows LAPS attributes in Active Directory. The actual password is intentionally excluded from all portfolio evidence.</p>\n<h2>Documentation</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">Architecture</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/implementation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Implementation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/troubleshooting.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/lessons-learned.md\" rel=\"noopener noreferrer\" target=\"_blank\">Lessons learned</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/README.md\" rel=\"noopener noreferrer\" target=\"_blank\">Sanitized evidence</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/scripts/Validate-WindowsLAPS.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Validation script</a></li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/a090b3c23be8": {
    "title": "Architecture",
    "description": "Retained technical documentation: Architecture",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Architecture</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Architecture</h2>\n<h2>Objective</h2>\n<p>Deploy modern Windows LAPS in a controlled Active Directory test scope using Group Policy, encrypted password storage, and delegated least-privilege access.</p>\n<h2>Logical path</h2>\n<p><code>Administrative laptop -&gt; DC01 -&gt; LAPS-Test OU -&gt; WS01 -&gt; LocalAdmin</code></p>\n<p>The administrative laptop is not domain joined, so domain-integrated administration was performed through DC01 by PowerShell remoting and RDP.</p>\n<h2>AD and endpoint design</h2>\n<ul>\n<li>Domain: <code>ad.jeremyfontenot.online</code></li>\n<li>Domain controller / Schema Master: <code>DC01</code></li>\n<li>Domain functional level: Windows Server 2016</li>\n<li>Endpoint: <code>WS01</code></li>\n<li>Endpoint OS: Windows 10 Pro build 19045</li>\n<li>OU: <code>OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></li>\n</ul>\n<h2>LAPS schema</h2>\n<p>The schema was first queried for <code>msLAPS-*</code> attributes. None were present. <code>Update-LapsADSchema</code> was then run with temporary Schema Admin membership, after which the membership was removed.</p>\n<p>Validated attributes:</p>\n<ul>\n<li><code>msLAPS-Password</code></li>\n<li><code>msLAPS-PasswordExpirationTime</code></li>\n<li><code>msLAPS-EncryptedPassword</code></li>\n<li><code>msLAPS-EncryptedPasswordHistory</code></li>\n<li><code>msLAPS-EncryptedDSRMPassword</code></li>\n<li><code>msLAPS-EncryptedDSRMPasswordHistory</code></li>\n</ul>\n<h2>Group Policy</h2>\n<p>GPO: <code>GPO - Workstations - Windows LAPS</code></p>\n<p>Settings:</p>\n<ul>\n<li>Backup directory: Active Directory</li>\n<li>Managed account: <code>LocalAdmin</code></li>\n<li>Password age: 30 days</li>\n<li>Password length: 14</li>\n<li>Complexity: uppercase + lowercase + numbers + special characters</li>\n<li>Password expiration protection: enabled</li>\n<li>Password encryption: enabled</li>\n<li>Authorized decryptor: <code>JFAD\\GG-LAPS-Password-Readers</code></li>\n</ul>\n<h2>Delegation</h2>\n<p><code>Set-LapsADComputerSelfPermission</code> grants managed computers permission to update their own LAPS attributes. <code>Set-LapsADReadPasswordPermission</code> delegates password-read rights to <code>JFAD\\GG-LAPS-Password-Readers</code>.</p>\n<p>The final test reader account <code>laps.reader01</code> belongs only to <code>Domain Users</code> and <code>GG-LAPS-Password-Readers</code>, demonstrating delegated access independent of Domain Admin privileges.</p></article>",
    "active": "Projects"
  },
  "documentation/f31de6857df0": {
    "title": "Sanitized Evidence Index",
    "description": "Retained technical documentation: Sanitized Evidence Index",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Sanitized Evidence Index</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Sanitized Evidence Index</h2>\n<p>This folder contains portfolio-safe evidence reconstructed from the validated command output captured during the lab. Managed passwords and authentication secrets are intentionally excluded.</p>\n<h2>Core evidence</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/validated-results.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validated results</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/troubleshooting-evidence.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting evidence</a></li>\n</ul>\n<h2>Security handling</h2>\n<p>Never publish:</p>\n<ul>\n<li>Windows LAPS managed passwords</li>\n<li>domain passwords</li>\n<li>recovery secrets</li>\n<li>private keys</li>\n<li>tokens</li>\n<li>VPN credentials</li>\n</ul>\n<p>The repository intentionally records only non-secret metadata such as account name, timestamps, encryption source, decryption status, authorized decryptor, event IDs, and GPO configuration.</p></article>",
    "active": "Projects"
  },
  "documentation/b2ce94f11b7f": {
    "title": "Troubleshooting Evidence",
    "description": "Retained technical documentation: Troubleshooting Evidence",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting Evidence</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/troubleshooting-evidence.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting Evidence</h2>\n<h2>RDP</h2>\n<ul>\n<li>TCP 3389 to DC01: reachable</li>\n<li>Local client failure: <code>mstsc.exe</code> AppHangB1 / Event ID 1002</li>\n<li>Working launch: <code>mstsc /public /admin /v:dc01.ad.jeremyfontenot.online</code></li>\n</ul>\n<h2>WMI / RSOP</h2>\n<p>Initial WMI result:</p>\n<pre><code class=\"language-text\">The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)\n</code></pre>\n<p>WMI firewall rule source:</p>\n<pre><code class=\"language-text\">PolicyStoreSourceType : Local\nPolicyStoreSource     : PersistentStore\nEnabled               : False\nProfile               : Domain\n</code></pre>\n<p>After enabling the Domain-profile PersistentStore WMI rules:</p>\n<pre><code class=\"language-text\">CSName  : WS01\nCaption : Microsoft Windows 10 Pro\nVersion : 10.0.19045\n</code></pre>\n<p>The Group Policy Results wizard then completed successfully.</p></article>",
    "active": "Projects"
  },
  "documentation/f9a626e4009a": {
    "title": "Windows LAPS Validated Results",
    "description": "Retained technical documentation: Windows LAPS Validated Results",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Windows LAPS Validated Results</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/evidence/validated-results.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Windows LAPS Validated Results</h2>\n<h2>Schema extension</h2>\n<p>Post-extension query returned all required modern attributes:</p>\n<pre><code class=\"language-text\">msLAPS-EncryptedDSRMPassword\nmsLAPS-EncryptedDSRMPasswordHistory\nmsLAPS-EncryptedPassword\nmsLAPS-EncryptedPasswordHistory\nmsLAPS-Password\nmsLAPS-PasswordExpirationTime\n</code></pre>\n<h2>OU and delegation</h2>\n<p>WS01 final OU:</p>\n<pre><code class=\"language-text\">OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online\n</code></pre>\n<p>Extended-right holders:</p>\n<pre><code class=\"language-text\">NT AUTHORITY\\SYSTEM\nJFAD\\Domain Admins\nJFAD\\GG-LAPS-Password-Readers\n</code></pre>\n<p>Final reader group membership:</p>\n<pre><code class=\"language-text\">Name           : LAPS Reader Test\nSamAccountName : laps.reader01\nObjectClass    : user\n</code></pre>\n<p><code>laps.reader01</code> group memberships:</p>\n<pre><code class=\"language-text\">Domain Users\nGG-LAPS-Password-Readers\n</code></pre>\n<h2>GPO application</h2>\n<p><code>gpresult /r /scope computer</code> included:</p>\n<pre><code class=\"language-text\">GPO - Workstations - Windows LAPS\n</code></pre>\n<h2>Effective policy - Event 10021</h2>\n<pre><code class=\"language-text\">Policy source: GPO\nBackup directory: Active Directory\nLocal administrator account name: LocalAdmin\nPassword age in days: 30\nPassword complexity: 4\nPassword length: 14\nPassword expiration protection enabled: 1\nPassword encryption enabled: 1\nPassword encryption target principal: JFAD\\GG-LAPS-Password-Readers\n</code></pre>\n<h2>Final encrypted retrieval</h2>\n<pre><code class=\"language-text\">ComputerName        : WS01\nAccount             : LocalAdmin\nPasswordUpdateTime  : 9/11/2026 7:06:17 PM\nExpirationTimestamp : 10/11/2026 7:06:17 PM\nSource              : EncryptedPassword\nDecryptionStatus    : Success\nAuthorizedDecryptor : JFAD\\GG-LAPS-Password-Readers\n</code></pre>\n<h2>AD attribute presence</h2>\n<pre><code class=\"language-text\">Name                          : WS01\nmsLAPS-PasswordExpirationTime : 134362343115244738\nEncryptedPasswordPresent      : True\n</code></pre>\n<h2>Final rotation events</h2>\n<pre><code class=\"language-text\">10014 - Administrator-initiated password update\n10020 - LocalAdmin password successfully updated\n10018 - Active Directory successfully updated\n10004 - LAPS policy processing succeeded\n</code></pre>\n<h2>Negative access test</h2>\n<pre><code class=\"language-text\">ACCESS TEST RESULT: No LAPS record returned for unauthorized user.\n</code></pre>\n<p>No managed password value is present in this evidence.</p></article>",
    "active": "Projects"
  },
  "documentation/f0fb6888ddbb": {
    "title": "Implementation",
    "description": "Retained technical documentation: Implementation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Implementation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Implementation</h2>\n<ol>\n<li>Validated the modern <code>LAPS</code> PowerShell module on DC01 and WS01.</li>\n<li>Queried the AD schema for <code>msLAPS-*</code> attributes before making changes.</li>\n<li>Temporarily added <code>jeremy.fontenot</code> to <code>Schema Admins</code>, refreshed the logon token, and ran <code>Update-LapsADSchema -Verbose</code>.</li>\n<li>Verified all six modern Windows LAPS schema attributes and removed the temporary Schema Admin membership.</li>\n<li>Created <code>OU=LAPS-Test</code> under <code>OU=Workstations</code> with accidental-deletion protection.</li>\n<li>Moved WS01 from the existing Windows 10 OU into <code>LAPS-Test</code>.</li>\n<li>Delegated computer self-permission with <code>Set-LapsADComputerSelfPermission</code>.</li>\n<li>Created <code>GG-LAPS-Password-Readers</code> and delegated read permission with <code>Set-LapsADReadPasswordPermission</code>.</li>\n<li>Created and linked <code>GPO - Workstations - Windows LAPS</code> to the LAPS-Test OU.</li>\n<li>Configured AD backup, 30-day age, 14-character complex passwords, encryption, and <code>GG-LAPS-Password-Readers</code> as the authorized decryptor.</li>\n<li>Initially allowed LAPS to target the built-in Administrator account. Event ID 10067 showed that the account was disabled.</li>\n<li>Reviewed WS01 local Administrators and found the existing enabled <code>LocalAdmin</code> account.</li>\n<li>Updated the GPO to manage <code>LocalAdmin</code> rather than enabling the built-in Administrator account.</li>\n<li>Forced Group Policy processing and validated the effective policy through Event ID 10021.</li>\n<li>Created non-admin reader account <code>laps.reader01</code>, added it to the reader group, and validated encrypted retrieval.</li>\n<li>Created a temporary unauthorized standard user and confirmed it could not retrieve the LAPS record; the account was then deleted.</li>\n<li>Forced a final <code>Reset-LapsPassword</code> and validated the new timestamps and Event IDs 10014, 10020, 10018, and 10004.</li>\n</ol></article>",
    "active": "Projects"
  },
  "documentation/cf8e9d648157": {
    "title": "Lessons Learned",
    "description": "Retained technical documentation: Lessons Learned",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Lessons Learned</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Lessons Learned</h2>\n<ul>\n<li>Verify <code>msLAPS-*</code> schema state before running <code>Update-LapsADSchema</code>.</li>\n<li>Use temporary privilege for schema changes and remove it immediately afterward.</li>\n<li>Scope testing to a dedicated OU rather than broad workstation containers.</li>\n<li>Separate LAPS password-read rights from Domain Admin privileges.</li>\n<li>Prefer encrypted password storage and an explicit decryptor group.</li>\n<li>Select the managed account intentionally; LAPS can rotate a disabled account, but that does not make the account usable for recovery.</li>\n<li>Event IDs 10021, 10020, 10018, 10014, and 10004 provide strong operational evidence.</li>\n<li><code>gpresult</code> and GUI RSOP validate complementary layers of Group Policy application.</li>\n<li>Troubleshoot the failing layer from evidence: transport, WMI/RPC, firewall policy source, policy application, and finally LAPS processing.</li>\n<li>Portfolio evidence should show timestamps, source, account, decryption status, and authorization metadata while excluding the password itself.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/c3c22f68fe5b": {
    "title": "Troubleshooting",
    "description": "Retained technical documentation: Troubleshooting",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting</h2>\n<h2>RDP client hang</h2>\n<p>TCP 3389 to DC01 was reachable, but the local Remote Desktop Connection client hung or closed. Windows Error Reporting showed <code>mstsc.exe</code> <code>AppHangB1</code> / Application Hang Event ID 1002.</p>\n<p>Resolution:</p>\n<pre><code class=\"language-text\">mstsc /public /admin /v:dc01.ad.jeremyfontenot.online\n</code></pre>\n<p>The administrative RDP session then opened successfully.</p>\n<h2>RSOP / WMI RPC failure</h2>\n<p>The Group Policy Results wizard initially failed to query WS01. A direct WMI test returned <code>0x800706BA - The RPC server is unavailable</code>.</p>\n<p>Inspection showed all <code>Windows Management Instrumentation (WMI)</code> firewall rules were disabled and originated from the local <code>PersistentStore</code>.</p>\n<p>The Domain-profile WMI rules were enabled in <code>PersistentStore</code>. A subsequent <code>Get-WmiObject Win32_OperatingSystem -ComputerName WS01</code> succeeded and the GUI Group Policy Results report generated correctly.</p>\n<h2>Disabled built-in Administrator</h2>\n<p>LAPS Event ID 10067 reported that the built-in <code>Administrator</code> account was disabled. WS01 already had an enabled custom <code>LocalAdmin</code> account in the local Administrators group.</p>\n<p>The LAPS GPO was updated to manage <code>LocalAdmin</code>. Event IDs 10021 and 10020 then confirmed the intended account and successful password update.</p>\n<h2>Reader account could not WinRM to DC01</h2>\n<p><code>laps.reader01</code> intentionally lacked administrative/WinRM rights on DC01. Rather than granting unnecessary remote-administration permission, <code>Get-LapsADPassword -Credential</code> and <code>-DecryptionCredential</code> were used inside the existing administrative remoting session to validate the delegated reader credentials.</p></article>",
    "active": "Projects"
  },
  "documentation/2044a931d6f0": {
    "title": "Validation",
    "description": "Retained technical documentation: Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-laps-gpo/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation</h2>\n<h2>Group Policy</h2>\n<p><code>gpupdate /force</code> completed successfully on WS01. <code>gpresult /r /scope computer</code> listed <code>GPO - Workstations - Windows LAPS</code> under Applied Group Policy Objects. The Group Policy Results wizard was also generated after WMI/RPC remediation.</p>\n<h2>Effective policy</h2>\n<p>Event ID 10021 reported:</p>\n<pre><code class=\"language-text\">Policy source: GPO\nBackup directory: Active Directory\nLocal administrator account name: LocalAdmin\nPassword age in days: 30\nPassword complexity: 4\nPassword length: 14\nPassword expiration protection enabled: 1\nPassword encryption enabled: 1\nPassword encryption target principal: JFAD\\GG-LAPS-Password-Readers\n</code></pre>\n<h2>AD backup and retrieval</h2>\n<p>Sanitized final retrieval:</p>\n<pre><code class=\"language-text\">ComputerName        : WS01\nAccount             : LocalAdmin\nPasswordUpdateTime  : 9/11/2026 7:06:17 PM\nExpirationTimestamp : 10/11/2026 7:06:17 PM\nSource              : EncryptedPassword\nDecryptionStatus    : Success\nAuthorizedDecryptor : JFAD\\GG-LAPS-Password-Readers\n</code></pre>\n<p>The <code>Password</code> property was deliberately excluded.</p>\n<h2>Forced rotation</h2>\n<p>Event sequence:</p>\n<ul>\n<li>10014 - administrator-initiated password update</li>\n<li>10020 - <code>LocalAdmin</code> password updated</li>\n<li>10018 - Active Directory updated with the new password</li>\n<li>10004 - LAPS policy processing succeeded</li>\n</ul>\n<h2>Least privilege</h2>\n<p><code>laps.reader01</code> was validated with only <code>Domain Users</code> and <code>GG-LAPS-Password-Readers</code> memberships and successfully decrypted the encrypted LAPS record.</p>\n<p>A standard user outside the reader group produced:</p>\n<pre><code class=\"language-text\">ACCESS TEST RESULT: No LAPS record returned for unauthorized user.\n</code></pre>\n<h2>AD attribute presence</h2>\n<pre><code class=\"language-text\">Name                          : WS01\nmsLAPS-PasswordExpirationTime : 134362343115244738\nEncryptedPasswordPresent      : True\n</code></pre></article>",
    "active": "Projects"
  },
  "home": {
    "title": "Jeremy C. Fontenot",
    "description": "Enterprise IT support experience and evidence-backed Microsoft systems administration, cloud, identity, and infrastructure projects.",
    "body": "<section class=\"hero\"><div class=\"hero-grid\"><div><p class=\"eyebrow\">Jeremy C. Fontenot / IT portfolio</p><h1>Support experience.<br><span class=\"accent\">Systems<br>administration proof.</span></h1><p class=\"title-role\">IT Professional | Microsoft Systems Administration<br>Cloud & Infrastructure</p><p class=\"lead\">Enterprise Service Desk experience. Hands-on Microsoft infrastructure. Explore the configurations, troubleshooting, and validation behind the work.</p><div class=\"actions\"><a href=\"#projects\" data-route=\"projects\" class=\"button primary\">Explore projects <span aria-hidden=\"true\">↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"button\">Technical evidence</a></div><div class=\"hero-links\"><a href=\"#resume\" data-route=\"resume\" class=\"text-link\">View resume</a><a href=\"#contact\" data-route=\"contact\" class=\"text-link\">Contact me</a></div></div><div><div class=\"blueprint\" role=\"img\" aria-label=\"Retained core lab overview: Dell PowerEdge R710 running Proxmox, with pfSense, DC01, WS01 and Linux01 virtual machines. This is a documentation diagram, not live telemetry.\"><div class=\"blueprint-top\"><span>PERSONAL LAB / CORE TOPOLOGY</span><span>01—04</span></div><div class=\"hardware\"><div class=\"blueprint-label\">VIRTUALIZATION PLATFORM</div><strong>Dell PowerEdge R710</strong><small>Proxmox VE · retained infrastructure snapshot</small><div class=\"server-lines\"><i></i><i></i><i></i><i></i><i></i><i></i></div></div><div class=\"connector\"></div><div class=\"vm-grid\"><div class=\"vm\"><b><i class=\"dot\"></i>pfSense</b><span>Routing / firewall</span></div><div class=\"vm\"><b><i class=\"dot\"></i>DC01</b><span>AD DS / DNS / DHCP</span></div><div class=\"vm\"><b><i class=\"dot\"></i>WS01</b><span>Domain workstation</span></div><div class=\"vm\"><b><i class=\"dot\"></i>Linux01</b><span>Ubuntu / SSSD / VLAN 30</span></div></div><div class=\"blueprint-foot\">DOCUMENTED CONFIGURATION<br>Personal nonproduction environment · no uptime claim</div></div><p class=\"hero-caption\">The lab behind the portfolio → <a href=\"#home-lab\" data-route=\"home-lab\" class=\"\">Explore the environment</a></p></div></div></section><div class=\"metrics\"><div><strong>13</strong><span>Documented projects</span></div><div><strong>Microsoft</strong><span>Administration focus</span></div><div><strong>7 scripts</strong><span>Validated Graph reporting</span></div><div><strong>Evidence first</strong><span>Bounded technical claims</span></div></div><section class=\"section\"><div class=\"section-head\"><div><p class=\"eyebrow\">Selected technical work</p><h2>Built. Troubleshot. Validated.</h2><p>Start with the outcomes. Go deeper into the implementation and proof.</p></div><a href=\"#projects\" data-route=\"projects\" class=\"text-link\">All 13 projects ↗</a></div><div class=\"grid grid-2\"><article class=\"project-card\" data-project data-category=\"Identity &amp; security\" data-search=\"windows laps &amp; advanced group policy encrypted local administrator passwords, scoped group policy, delegated readers, and positive and negative access tests. windows laps active directory group policy powershell\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 01</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/windows-laps-gpo\" data-route=\"projects/windows-laps-gpo\" class=\"\">Windows LAPS &amp; Advanced Group Policy</a></h3><p>Encrypted local administrator passwords, scoped Group Policy, delegated readers, and positive and negative access tests.</p><div class=\"tags\"><span class=\"tag\">Windows LAPS</span><span class=\"tag\">Active Directory</span><span class=\"tag\">Group Policy</span><span class=\"tag\">PowerShell</span></div><div class=\"card-footer\"><a href=\"#projects/windows-laps-gpo\" data-route=\"projects/windows-laps-gpo\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article><article class=\"project-card\" data-project data-category=\"Identity &amp; security\" data-search=\"microsoft entra hybrid identity &amp; cloud sync scoped ad-to-entra provisioning with source-anchor correlation, password hash sync, and lifecycle validation. entra id cloud sync password hash sync ad ds\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 02</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/entra-cloud-sync\" data-route=\"projects/entra-cloud-sync\" class=\"\">Microsoft Entra Hybrid Identity &amp; Cloud Sync</a></h3><p>Scoped AD-to-Entra provisioning with source-anchor correlation, Password Hash Sync, and lifecycle validation.</p><div class=\"tags\"><span class=\"tag\">Entra ID</span><span class=\"tag\">Cloud Sync</span><span class=\"tag\">Password Hash Sync</span><span class=\"tag\">AD DS</span></div><div class=\"card-footer\"><a href=\"#projects/entra-cloud-sync\" data-route=\"projects/entra-cloud-sync\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article><article class=\"project-card\" data-project data-category=\"Endpoint management\" data-search=\"windows autopilot &amp; intune mdm provisioning physical-device provisioning through branded oobe, esp, entra join, security policy, and final intune compliance. autopilot intune entra join bitlocker\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 11</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/windows-autopilot-intune\" data-route=\"projects/windows-autopilot-intune\" class=\"\">Windows Autopilot &amp; Intune MDM Provisioning</a></h3><p>Physical-device provisioning through branded OOBE, ESP, Entra join, security policy, and final Intune compliance.</p><div class=\"tags\"><span class=\"tag\">Autopilot</span><span class=\"tag\">Intune</span><span class=\"tag\">Entra join</span><span class=\"tag\">BitLocker</span></div><div class=\"card-footer\"><a href=\"#projects/windows-autopilot-intune\" data-route=\"projects/windows-autopilot-intune\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article><article class=\"project-card\" data-project data-category=\"Automation\" data-search=\"microsoft 365 graph administration lab seven validated read-only scripts for tenant, user, group, license, role, stale-account, and intune reporting. microsoft graph powershell rest api csv\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 13</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/m365-graph-administration-lab\" data-route=\"projects/m365-graph-administration-lab\" class=\"\">Microsoft 365 Graph Administration Lab</a></h3><p>Seven validated read-only scripts for tenant, user, group, license, role, stale-account, and Intune reporting.</p><div class=\"tags\"><span class=\"tag\">Microsoft Graph</span><span class=\"tag\">PowerShell</span><span class=\"tag\">REST API</span><span class=\"tag\">CSV</span></div><div class=\"card-footer\"><a href=\"#projects/m365-graph-administration-lab\" data-route=\"projects/m365-graph-administration-lab\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article></div></section><section class=\"section split\"><div><p class=\"eyebrow\">How I work</p><h2>Understand the system.<br>Prove the result.</h2><p>My professional support experience emphasizes triage, clear communication, documentation, and escalation. My personal lab extends that foundation into systems administration.</p><a href=\"#experience\" data-route=\"experience\" class=\"text-link\">Explore professional experience ↗</a></div><div class=\"method\"><article><div><h3>Establish scope</h3><p>Separate symptoms, dependencies, and assumptions before changing configuration.</p></div></article><article><div><h3>Investigate with evidence</h3><p>Inspect logs, permissions, effective policy, connectivity, and actual system state.</p></div></article><article><div><h3>Make a deliberate change</h3><p>Use a bounded correction and preserve working infrastructure.</p></div></article><article><div><h3>Validate and document</h3><p>Retain the result, the troubleshooting record, and the limits of what was proven.</p></div></article></div></section><section class=\"section\"><div class=\"section-head\"><div><p class=\"eyebrow\">Capability areas</p><h2>Across the Microsoft environment.</h2></div><a href=\"#skills\" data-route=\"skills\" class=\"text-link\">View skills map ↗</a></div><div class=\"grid grid-4\"><article class=\"panel\"><p class=\"eyebrow\">01</p><h3>Identity & access</h3><p>Active Directory, Group Policy, Windows LAPS, Entra ID, and hybrid identity.</p></article><article class=\"panel\"><p class=\"eyebrow\">02</p><h3>Endpoint & cloud</h3><p>Intune, Autopilot, Exchange Online, Defender, and Conditional Access.</p></article><article class=\"panel\"><p class=\"eyebrow\">03</p><h3>Infrastructure</h3><p>Windows Server, Hyper-V, Proxmox, SCVMM, Azure Arc, and networking.</p></article><article class=\"panel\"><p class=\"eyebrow\">04</p><h3>Operations & automation</h3><p>PowerShell, Microsoft Graph, ServiceNow, and evidence-driven troubleshooting.</p></article></div></section><section class=\"section\"><div class=\"callout\"><div><p class=\"eyebrow\">Let’s talk about your team</p><h2>Support experience. Infrastructure ambition.</h2><p>Systems administration, Microsoft 365, infrastructure support, and IT operations.</p></div><div class=\"actions\"><a href=\"#contact\" data-route=\"contact\" class=\"button primary\">Get in touch ↗</a><a href=\"#resume\" data-route=\"resume\" class=\"button\">View resume</a></div></div></section>",
    "active": "Home"
  }
}