Picking the first close

The short list is still a list. A list is how programmes avoid starting. They refine the criteria, add a column, wait for a tool to agree, and call the wait prioritisation. Prioritisation is over when one verb is chosen, every object that grants it is in the change, and a date is written down to check the verb again. One. Not a wave, not a phase, not the top ten. The first close is small enough to finish and serious enough that finishing it changes can, on a morning you can name.

What is allowed to win the choice

You already have the material. Harm, in sentences. State, from the morning test. Objects, including the second one that would survive a tidy removal. A note on whether the control you wish you had can even see the row. An owner of the fourth statement, who will brief the choice. A neighbourhood small enough that the change can be checked. The choice is the row on the short list where those line up. Wide enough to hurt. Standing, or break-glass that is in practice standing, unless a requested window is so wide and so long that it is the same fact. Knowable with the stacks you have. Closeable by a removal you can actually perform on the winning description, not by a connector that would merely display it.

Closeable is the new word, and it is the one hygiene uses to sneak back in. A stale guest is closeable. That is not a reason. Closeable modifies the short list. It does not replace it. If the highest-harm verb is closeable by a local change the application owner can make, pick it even if a federation project would be the elegant version. If the highest-harm verb is not closeable until a product exists, do not pretend the product is the close. Either pick the next verb that is closeable and say, in the monthly brief, that you skipped a worse one because you cannot yet remove it, or do the non-product remov al that reduces that worse verb now. Skipping without the sentence is how the list decays into whatever the directory team can click.

Do not pick a row because it is the team boundary you control. The directory team picking a directory role, while the winning description is a local account, will close the losing story. The description that grants the verb is the one the change must hit. If that description is a vaulted password and a second copy, both are in the change. If it is an app role and a secret, removing the secret alone is not the close. The permission is the verb. The secret is how it authenticates. A close that rotates and leaves the permission has done custody again. The rotation is a button and the permission removal is an argument with an application team.

Where a standing administrative password won the short list, the close is a different shape, not a tidier vault. Temporary elevation of a named person, an ephemeral vendor account, or a short-lived workload token. Today the verb succeeds with no request. After the close, on an ordinary morning, it should not. If the organisation will not accept that shape, the honest result is an acceptance with a living owner and a date. Rotating the static password and briefing the state as requested is a fake close, because the state never moved.

Break-glass that made the short list is closed carefully or it is not closed. Care means you know who can invoke what remains, you know the verb, and you have removed the everyday path: the shared retrieval, the exclusion that was wider than the dead-path case, the owner who has left. It does not mean deleting the emergency account on a Friday to satisfy the short list. The recreation is often wider than before. If the right first close on that row is to remove the leaver, restrict retrieval, and keep one path, write those objects. If you cannot touch it in this month because the recovery procedure is untested, say so and pick a different verb. An untested recovery is a reason to test, not a reason to call the account out of scope again.

What the first close is not

It is not a percentage from the baseline. That number is a size, not a change. Federating a neighbourhood is a programme. The first close inside it might be one local admin on one of those applications.

It is not "implement just-in-time". Just-in-time is a property of a specific verb after a specific policy change. A programme to make all administrators eligible is a relabel, especially if they can activate themselves. If eligibility with a real second approver is the replacement shape for this one verb, write that approver's role into the change. If you cannot name them, you are not implementing a gate. You are buying a form.

It is not onboarding the account to the vault, unless the verb is the unvaulted copy and the close includes removing the copy and deciding the state of the account. Onboarding alone is coverage. Let the privileged-access team help with the shape you actually chose.

It is not a campaign. Certifying the verb, or revoking an entitlement that was the losing description, produces a green row and a living grant. The first close is allowed to include a model fix so the next campaign does not resurrect a ghost. Sequence them. Remove the grant. Then stop the model lying.

It is not a wave of quick wins chosen to show momentum. Five small revocations of low verbs will photograph better than one awkward removal and will leave the short list standing. If a sponsor asks for momentum, offer the date you will re-check the one verb. A date is momentum a sceptic can test. A wave is momentum that fills the month and muddles the recount. One change, one recount. That is the whole design of the first close.

It is not an agent framework. If an agent is on the short list, the close is the permission set. If the exit cell is still empty, you may still remove the per mission. Take the permission off. Leave the exit empty. Do not brief the agent platform as closed.

A change that names a morning

Write the change in the sheet before it goes into the ticketing tool. Keep the source of truth in the table until the recount.

The verb, written as verb plus resource, copied from the row, not translated into "harden admin access". The identity as found. The state today. The objects, each with an identifier, each with the chain, each with a line that says what will be done to it. Remove the membership. Delete the exclusion. Replace the static account with an ephemeral one. Shorten the token. Disable the local account. Revoke the app role. If any object is "review later", it is not in the change, and you do not have a first close.

If the Billing-Readers row were the one you picked, the close would be the application role taken off the group, and the sync rule checked so the role cannot return. Renaming the group would be hygiene. The sheet would record a morning after one sync cycle, and until that morning it would say changed, awaiting recount.

The morning you will test. Not a post-implementation review in due course. A date, a person, and the test: with no new approval and no incident, does this verb succeed. The person should be the owner of the fourth statement or the deputy, not only the engineer who made the change. Engineers confirm their change landed. The owner confirms the winning description moved. Name both so the engineer is not asked to certify the fourth statement.

What would count as failure before the recount. The sync puts the membership back. The pipeline redeploys the principal with the old permission. A second copy of the secret still authenticates. The exclusion remains in a second policy you did not export. They are the ways this particular close fails, drawn from the chains you already recorded.

Who is affected in the operational sense. The person whose standing admin is becoming a request. The pipeline that must fetch a short-lived token. The vendor who will get an ephemeral account instead of the shared one. Tell them before the change, in whatever channel you already use.

The acceptance path, if the organisation refuses the close. Name the refuser. Name the verb they are accepting. Name the date they will look again. Put the row on the design pile if it was not already there. Do not leave a rejected change to imply the conversation is unfinished in a hopeful way. An ownerless refusal is an exception with no end.

Entra is where many first closes will be clicked, and the click is not the whole change. Removing a member from a cloud group does nothing lasting if the chain says synced and the source still has them. Removing an eligible assignment does nothing to an active grant you forgot to end. Deleting one Conditional Access exclusion does nothing if a second policy, or a report-only configuration you have been calling enforced, still describes the path. Before the window, write the exact result that shows the object, and say what that result must look like after a sync cycle. "Gone from the group" is a check. "Gone from the group and absent from the on-premises source and not reappearing after sync" is the check when the chain demands it.

Application permissions close in the directory and survive in the habit of the pipeline. Revoke the app role on the service principal. Confirm with Get-MgServicePrincipalAppRoleAssignment that the list no longer contains the verb. Then look at the credential. If you leave a long-lived secret in place, the next deployment can put the verb back without a new design discussion. Shorten or remove what the close requires, and say which. A managed identity's close is the role assignment on the resource, not a secret rotation that cannot exist. System-assigned identities offer a brutal version of a close: remove the resource and the identity dies with it. That is only a close if the resource itself is the thing you meant to end. Remove the assignment. Leave the resource unless the resource is the harm.

The governance platform is updated after the grant moves, so that a campaign does not ask a reviewer to re-approve a ghost, and so that an access request cannot re-provision the entitlement on the old mapping. If the platform is the system that provisions, and provisioning is still armed, the close is not real until provisioning will not put the object back. The owner of the fourth statement does not disarm it by writing a sentence. They confirm it was disarmed. Confirmation is a look at the workflow, not a status in the ticket.

The vault closes the rows where a credential is in the path. Remove the second copy you found, or record that you looked and the unknown became a no. Rotate if the secret was exposed. If the replacement shape is ephemeral, the standing account should become unusable because the account is disabled or gone, not because the password is long. A long password on a living admin is the old state with better entropy. A vault report that shows the old account still onboarded and still enabled is a failed close, however green the rotation policy.

Local accounts and resource policies close where they live. There is no Entra click. The person named to make the change must be someone that system will obey. If the application team has refused access, and this verb still won the short list, the first close is the management conversation that gets the removal done, not a directory change that looks similar. Do not substitute a nearby Entra group because it is reachable. The winning description is the local account. Close that, or accept it in writing.

The change, in ordinary time

Pick a window the affected team already respects. A change on the morning of their release manufactures the recreation you fear. The sheet needs a day when a failed job will be noticed by someone who was told, and when the morning test can be run again after the cycles that undo closes. On the day, the objects are done in an order that does not lock you out of a repair path you still need. If one of the objects is break-glass for the repair, it is not in this change. Do not discover that mid-change and skip it quietly. A quiet skip is an object left off the list, which means the close was not the close you briefed.

After the change, the same day, capture the evidence pointer again. The old pointer stays, so the recount can see before and after. Overwriting the pointer is sanding. Then do not update the fourth statement to "closed" yet. The statement updates on the recount date, when the morning test is run again, including after at least one sync cycle and one pipeline run if those were watch-items. The engineer may say done. The sheet says changed, awaiting recount.

If the change breaks a job, the repair is not allowed to be "put it back as it was" without passing through the owner of the fourth statement. Putting it back is a new grant, a new exception, or a discovery that the verb was load-bearing in a way the harm note missed. All three are allowed. None of them are allowed to happen in a chat and stay out of the sheet. A restored verb is standing again, with an origin story called the first close. Record it.

Some rows should not end as gone. They should end as requested, with a window that is real. The close removes standing and leaves an eligible assignment whose activation rule you have actually read. The rule needs a second person if you claimed a gate. It needs an end shorter than the harm can spread unnoticed, which is a judgment you write down, not a default copied from a slide. It needs the activator to be someone other than a shared account. After the close, the morning test on an ordinary day should fail, and the test during an approved window should succeed. Both belong on the recount. A recount that only checks the ordinary morning will miss a window left open, or a window that is six months long.

Vendor access closes to ephemeral or it stays on the design pile. Ephemeral means the account did not exist yesterday and will not exist after the window, not that the password was reset. If you cannot create and destroy the account, you do not have the shape, and you should not brief the word. Destruction of the account is the test.

Workload tokens close to short-lived when the minting path is gated by something you can name. A token that is short-lived but minted by anyone who can read a client secret in a variable group is standing access to the mint, which is the same verb one step back. Walk one step back before you congratulate the expiry field. If the mint stays standing, the close has not met the test of removing the object. Put the mint in the change or do not claim the token lifetime as the close.

One verb becomes a programme the moment a committee can approve only programmes. Put the harm sentences and the object list in front of them and ask for a yes on this change. Offer the recount date instead of a stage gate. Discovery of the whole enterprise may run beside the close. It may not block it. Say, in the brief, that the same shape elsewhere is next, or not yet looked at. For this one account a manual bridge is allowed: a named person creates the temporary account, the standing one is disabled, the recount is this month. Manual is better than standing. Write the bridge you are actually doing.

A quiet removal, without the sheet updated, without the second object, without the date, is a favour, not a close. If the only person who can perform the removal is a specialist, they are a dependency, named.

The administrator who is losing standing access does not need the book's vocabulary. They need the verb, the reason it is the one that can hurt, and what they do on the morning they next need it. Write three lines next to the change. What changed. What you do now when you need this. Who you call if the new path fails. The third line stops the recreation of a wider hole.

One change. If you have two, you have not picked. The first close cannot be twins.

The owner of the answer and the person making the change are not the same duty, even when they are the same human. One judges the morning. One edits the object. A sponsor should be able to say which worse verb you did not pick, and why. You have a date. Dates that move are human. Dates that disappear into "after the programme mobilises" are the close being cancelled in polite language.