entra1-9  Exercise 1: Building and Ranking the Register
=========================================================

Source: Microsoft Learn pages on credential renewal, SAML certificate
management and Entra recommendations. Re-check before relying on any detail.

TODAY: 2026-10-01. Lead-time schedule: 90 flag, 60 plan, 30 create new,
14 install and prove, 7 escalate.

REGISTER ROWS (abridged)
  client     arrangement  type            expires      days left  owner
  Fabrikam   B            client secret   2026-10-20   19         (client: IT mgr) / ours
  Contoso    C (SAML)     signing cert    2026-12-05   65         departed admin -> NEEDS NEW OWNER
  Northwind  A            client secret   2027-03-01   151        ours only
  Tailspin   (cert cred)  certificate     2026-10-09   8          NONE RECORDED

WHERE EACH IS IN THE SCHEDULE
  Tailspin  8 days left: inside the 14-day band and almost at the 7-day
            escalation. Overdue for every earlier step. CRITICAL.
  Fabrikam  19 days left: past the 30-day step (create new credential), approaching
            the 14-day step. HIGH: the new secret should be created now.
  Contoso   65 days left: between 90 and 60 (plan stage). The credential
            itself is fine, but the notification recipient left in August, so
            Entra's 60/30/7 emails are going nowhere. The 60-day step is days
            away. MEDIUM-HIGH because of the broken warning.
  Northwind 151 days left: not yet at 90. LOW. It is ours, so just enter it in
            the register and set the 90-day flag for about 2026-12-01.

RANKING
  1. Tailspin  2. Fabrikam  3. Contoso  4. Northwind

NEXT ACTION FOR EACH
  Tailspin: today, find the owner (ask the account manager; check the audit log
            and the Owners page); confirm the certificate expiry in the portal
            with the client's administrator (screen share); agree the renewal
            this week: upload the new certificate, record the thumbprint, install,
            prove, then remove the old.
  Fabrikam: today, email the IT manager (the 30-day reminder, Exercise 2); ask
            the client's administrator to create a second secret now (alongside
            the old); book the install and test; tell our own team who owns it.
  Contoso:  this week, ask for the SAML Certificates page: add a distribution
            list (up to five recipients) as notification address, and verify
            the setting in the portal (a script-set value may not register);
            record a new owner; plan the new certificate and the one-certificate
            window if the product accepts only one.
  Northwind: add to the register with our team owner and a 90-day flag; check
            later whether product can support two credentials at once.

WHY THIS WORKS AS AN ANSWER
---
It computes days left, maps each item to the schedule, separates an urgent
expiry from a broken warning, and names one concrete next action.