The configuration families: mostly a re-index
| Plane | Primary Rev. 3 families | Rev. 3-specific notes |
|---|---|---|
| ENTRA ID | 3.1 Access Control · 3.5 Identification & Authentication | Session and inactivity windows, authenticator rules, and review cadences become ODP values your policies must literally match |
| INTUNE | 3.4 Configuration Management · 3.7 Maintenance | Baseline profiles are the "examine" evidence; compliance policies enforce parameterized timeframes |
| PURVIEW | 3.8 Media Protection · 3.1 CUI flow · 3.13 Comms Protection | Labels and DLP remain the enforcement layer for CUI flow objectives; retention settings pick up ODP values |
| DEFENDER | 3.6 Incident Response · 3.14 System Integrity · 3.3 Audit | Detection and response evidence maps to expanded IR-testing objectives; alert-review cadence is a parameter |
| WDAC | 3.4 Least functionality · 3.14 Integrity | Allow-listing remains the strongest "test"-method demonstration in the stack |
| AUDIT & LOGGING | 3.3 Audit & Accountability · 3.14 System monitoring | Which event types are logged and how often records are reviewed become ODP values; collection designed so evidence is a byproduct of operations |
All six run on the platform substrate, GCC High or Azure Government, which carries 3.13 boundary and cryptography: its sovereignty posture is unchanged by the revision, and cryptography objectives inherit ODP-expressed requirements.
The process families: tooling assists, people satisfy
- 3.15 Planning — the SSP and planning discipline live here now. Compliance tooling can host and track the documents; the family is satisfied by a planning practice with owners and cadence.
- 3.16 System & Services Acquisition — a security gate on buying. Your tenant can inventory and restrict what's deployed (Intune, WDAC, Defender), but the evaluation-before-purchase record is a process artifact only your acquisition workflow can produce.
- 3.17 Supply Chain Risk Management — vendor identification, evaluation, and monitoring. Microsoft's own compliance posture (FedRAMP High-based government cloud) becomes an input to your SCRM records — inherited assurance still has to be documented as such, alongside every other vendor inside the boundary.
The honest summary: if your Rev. 2 environment was engineered properly on these six planes, the configuration families of Rev. 3 are a re-index plus ODP alignment. The net-new build is process: planning, acquisition security, and SCRM. Scope accordingly — and check the readiness checklist before believing any estimate, including ours.
Re-aim the stack
Get your tenant mapped to Rev. 3 objectives.
We audit the six planes against the Rev. 3 objective set, produce the ODP-to-configuration wiring, and scope the process-family build. Or email rj@indirectit.com directly.