One Activation, Every Role with PIM Groups
A practical guide to just-in-time admin access with PIM for Groups in Microsoft Entra ID.
The AirGap Blueprints · Book two
One Name, Every Answer. Out Wednesday, November 18, free.
One Name, Every Answer by Convention: one naming convention for groups, accounts and policies across Entra ID, Intune and Defender XDR, and a way to clean up the names you already have. The second of four free AirGap Blueprints.
--days
--hours
--min
--sec
Book one is out: download One Activation, Every Role, free ↓
The series board
One out, three on the way
Arrivals
| Flight | Arriving | Status |
|---|---|---|
| AGB 01 | ONE ACTIVATION, EVERY ROLE | ARRIVED |
| AGB 02 | ONE NAME, EVERY ANSWER | WED 18 NOV |
| AGB 03 | IN CASE OF EMERGENCY | EXPECTED |
| AGB 04 | EVERY ADMIN, ZERO PHISH | EXPECTED |
Next arrival: One Name, Every Answer, Wednesday, November 18. Join the list and I’ll email you the day it’s out.
- Books out
- 1
- Coming soon
- 3
- Price
- Free, every book
- Format
- PDF + fillable worksheets
- Built on
- 25+ years in the field
- Platforms
- Entra ID · Intune · Defender
The books
Four blueprints for your Entra ID tenant
Each guide takes one control from rationale to adoption. One Activation, Every Role is out now, free. One Name, Every Answer follows on Wednesday, November 18, then two more — join the list to hear the day each one is out.
One Name, Every Answer by Convention
A practical guide to naming conventions for groups, accounts and policies across Microsoft Entra ID, Intune and Defender XDR.
In Case of Emergency, Break Glass
A practical guide to break-glass emergency access accounts in Microsoft Entra ID.
Every Admin, Zero Phish with Passkeys
A practical guide to phishing-resistant MFA for administrators in Microsoft Entra ID.
4 books
-
Free · available now
One Activation, Every Role with PIM Groups
A practical guide to just-in-time admin access with PIM for Groups in Microsoft Entra ID.
Out now, free
Book details Download free ↓ -
Launching Nov 18, 2026
One Name, Every Answer by Convention
A practical guide to naming conventions for groups, accounts and policies across Entra ID, Intune and Defender XDR.
Out Wednesday, November 18
Book details Notify me when it’s out -
Coming soon
In Case of Emergency, Break Glass
A practical guide to break-glass emergency access accounts in Microsoft Entra ID.
Date coming soon
Book details Notify me when it’s out -
Coming soon
Every Admin, Zero Phish with Passkeys
A practical guide to phishing-resistant MFA for administrators in Microsoft Entra ID.
Date coming soon
Book details Notify me when it’s out
About the series
The AirGap Blueprints
Cloud security strategy guides built on more than 25 years of real-world public and private sector experience. Every book follows the same four stages. Open one to see real pages from book one.
-
Why it matters, in terms a sponsor can sign off on: the problem, the proposal and a printable executive brief.
-
The decisions to make before anything touches the tenant: who needs what, how it is named and how it is tiered.
-
The build, step by step in the admin center, with the settings I recommend and the reasons behind them.
-
Getting people to use it and keeping it working: who leads it, the go-live plan, reviews and audits.
How a book gets made
Every blueprint goes through the same eight steps before it reaches you.
Book one, One Activation, Every Role, is out. Book two, One Name, Every Answer, is at step 4: writing, one chapter at a time. It’s out Wednesday, November 18, 2026. Updated November 5, 2026
- One Name, Every Answer (done) by Convention
- Outline (done) Rationale, planning, implementation, adoption.
- Design (done) Cover and layout in the AirGap style.
- Write (in progress now) Evenings, one chapter at a time. Writing and proofreading repeat for several rounds.
- Proofread I read it through and re-check every step.
- Copyright I put the copyright notice in place.
- Final review One last read of the whole book.
- Release A free download on launch day.
The office security team
Meet Lola and Jerry, my two cats
Lola and Jerry are my cats, sister and brother, both Ragdoll–Persian mixes. They keep me company every evening while I write these books after my day job. They have never read a chapter, but they take their jobs very seriously, so I gave them job titles.
Lola
Ragdoll–Persian mix · Jerry’s sister
Chief Keyboard Inspector
Night shift
24/7
Motivations Tap a strip
Personality
Lola has been on the team since the first chapter. She inspects every keyboard I use, usually mid-sentence, and her edits always make it into the first draft. She has never filed an access request. She just takes the warm spot.
Standing access
100% Permanent. Please don’t.
Jerry
Ragdoll–Persian mix · Lola’s brother
Head of Audit Glares
Read-only
5 pm
Motivations Tap a strip
Personality
Jerry reviews everything and approves almost nothing. He audits my evenings from the arm of the chair and escalates the moment dinner is late. If a change isn’t logged, he already knows.
Audit coverage
92% Expert. Nothing gets past him.Lola's only edit to chapter 4
▍
Follow the series
Field lessons, between the books
YouTubeWatch the walkthroughsStep-by-step PIM, Entra ID and Intune builds — and the lessons behind them.
@airgapblueprints →
LinkedInFollow the pageExcerpts, checklists and diagrams from the books, every day.
The AirGap Blueprints →
XGet the short takesQuick lessons, launch news and new guides as they land.
@AirGapEbooks →
BlueskyFollow alongShort lessons and launch news, for those of you on Bluesky.
@airgapblueprints.com →
Hear when the next book is out
One email as each book comes out, plus the occasional field note. Written for identity and security teams. No spam, and you can unsubscribe at any time.