{
  "schemaVersion": "1.2",
  "count": 13,
  "timezoneNote": "Capture timestamps are UTC; the local work date was September 11, America/Chicago.",
  "records": [
    {
      "file": "screenshots/12-security-admin-response-permissions.png",
      "recommended": true,
      "caption": "The current Security Administrator definition contains the four response actions. Its broad display labels must be read alongside target restrictions and the measured results.",
      "page": "Entra > Roles and administrators > Security Administrator > Description",
      "capturedAtUtc": "2026-09-11T23:58:16.0848077Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "0aecd8359e155f83614725c07e84689ec3ed935fe8627309f8cb311f9039caeb",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/13-audit-reset-operator-v2.png",
      "recommended": true,
      "caption": "Successful reset audit from the Security Administrator test. The actor type is User. The operator was established from the object ID in retained private evidence; identifying values are masked here. The bottom was cropped during capture to omit the IP-address row.",
      "page": "Entra > Users > Audit logs > Reset user password > Activity",
      "capturedAtUtc": "2026-09-12T00:01:24.4086607Z",
      "format": "PNG",
      "width": 1280,
      "height": 779,
      "sha256": "6027361bb8f8f02739f5d3a4be6d53b265128b926bce471e14efed7c8a2cfd00",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 5,
        "editedAtUtc": "2026-09-13T01:47:22.972538+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true,
        "displayNameLabel": "Lab test operator"
      },
      "captureDimensions": {
        "width": 1280,
        "height": 700
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/06-legacy-user-risk-retirement.png",
      "recommended": true,
      "caption": "The legacy user-risk policy is read-only, displays the October 1 retirement notice, and has Disabled selected. This is current-state evidence, not a migration result.",
      "page": "Entra > ID Protection > User risk policy",
      "capturedAtUtc": "2026-09-11T23:53:18.8792473Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "cf037286d6ecb06e801a36e10c8906a5f89d012934484892a57d0826cf4e166e",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/07-legacy-signin-risk-retirement.png",
      "recommended": true,
      "caption": "The legacy sign-in-risk policy shows the same retirement notice and Disabled state. It was inspected separately from the Conditional Access inventory.",
      "page": "Entra > ID Protection > Sign-in risk policy",
      "capturedAtUtc": "2026-09-11T23:53:50.4139124Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "7d6b31b8ad1bdea377baeb56837b9ac7209ca7f3efc2286e332ee017e014bb03",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/09-cspm-free-plan-on.png",
      "recommended": true,
      "caption": "Foundational CSPM is Free and On in the existing subscription. The separate paid Defender CSPM plan is also visible. No plan was changed for this work.",
      "page": "Azure > Defender for Cloud > Environment settings > Subscription > Defender plans",
      "capturedAtUtc": "2026-09-11T23:54:55.3133919Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "0dd8890f890c8d0752c59b5398ceb9ff99bb639d5103d18a30940a1ccd2f6db8",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 2,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/10-cspm-october-notice.png",
      "recommended": true,
      "caption": "The October 27 opt-in announcement appears inside the lab portal. The banner documents a future new-subscription change; it does not demonstrate that future default.",
      "page": "Azure > Defender for Cloud > Environment settings",
      "capturedAtUtc": "2026-09-11T23:55:58.0771570Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "7da551d5836a852332b88f02d1e3a91a92cc66bf10487b33d3af6959a4de52ec",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 2,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/11-dynamic-group-inventory.png",
      "recommended": true,
      "caption": "The Dynamic membership filter returns zero groups. Separate completed Graph reads covered administrative units and access-package assignment policies.",
      "page": "Entra > Groups > All groups > Membership type: Dynamic",
      "capturedAtUtc": "2026-09-11T23:56:41.7528951Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "f37c66eecd2cf966198e71629b97124ebabb12b1943b0d8833eea627c8b43b63",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 2,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/04-sentinel-primary-playbook-options.png",
      "recommended": true,
      "caption": "The primary East US 2 workspace exposed only classic Logic Apps creation choices in this preflight. AI generation and execution were not validated.",
      "page": "Defender > Sentinel > Automation > Active playbooks > Create; primary workspace",
      "capturedAtUtc": "2026-09-11T23:46:09.0988662Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "6a4a895a7f3b3ec3e776351036421dee31614a2169986e9e1c63ab1c06b0d210",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/05-sentinel-rbac-preflight.png",
      "recommended": true,
      "caption": "Unified-RBAC workload settings show no active Sentinel workspaces in that permission model. This is different from whether a workspace is onboarded to Defender, and is not a proven cause of the missing generator menu.",
      "page": "Defender > Settings > Microsoft Defender XDR > Permissions and roles",
      "capturedAtUtc": "2026-09-11T23:51:21.8606401Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "3ec31e6f97605ad78e6f3b6b8745163c2f754976723aae6af96eac4877fbcbb9",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/01-security-admin-assignment.png",
      "recommended": false,
      "caption": "Initial narrow capture of the temporary direct role assignment, before cleanup. Supplemental evidence only.",
      "page": "Entra > Security Administrator > Active assignments",
      "capturedAtUtc": "2026-09-11T23:34:01.7869280Z",
      "format": "PNG",
      "width": 462,
      "height": 691,
      "sha256": "b2c69635d436178230d1ae1e1c431f3d6d23f0f88023093dc0ca3f2e35c9f411",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 462,
        "height": 638
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 53,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/02-security-admin-response-permissions.png",
      "recommended": false,
      "caption": "Initial narrow permissions capture. Use the later desktop capture numbered 12 for article layout.",
      "page": "Entra > Security Administrator > Description",
      "capturedAtUtc": "2026-09-11T23:41:22.2069312Z",
      "format": "PNG",
      "width": 462,
      "height": 691,
      "sha256": "4e9cf2efd01d757ee31f5961e9c7dc31955d06c0f2c5a00cd44de8b158cbec31",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": false,
        "maskCount": 0,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 462,
        "height": 638
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 53,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/03-sentinel-playbook-options.png",
      "recommended": false,
      "caption": "The secondary Central US workspace showed the same classic creation options. Retained as a second workspace observation.",
      "page": "Defender > Sentinel > Automation > Active playbooks > Create; secondary workspace",
      "capturedAtUtc": "2026-09-11T23:44:30.9279547Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "f78c8f0c69a2b81e4fcd46a8d5d79a1f49c5e94bca7bc24efbd6225feaa39b2a",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 1,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    },
    {
      "file": "screenshots/08-cspm-subscription-scope.png",
      "recommended": false,
      "caption": "The inspected Azure subscription beneath the tenant root group. This capture shows environment scope; the October notice is in capture 10.",
      "page": "Azure > Defender for Cloud > Environment settings",
      "capturedAtUtc": "2026-09-11T23:54:03.8546102Z",
      "format": "PNG",
      "width": 1280,
      "height": 799,
      "sha256": "74ce6132bf7829199c330a72bf6ce92f18cd155c2b54266085fcd76669d40dbd",
      "captureMethod": "Native browser screenshot, privacy-masked and exported as lossless PNG with a separate brand footer; no generative image editing",
      "redaction": {
        "applied": true,
        "maskCount": 3,
        "editedAtUtc": "2026-09-12T01:03:02.021745+00:00",
        "unmaskedPixelsUnchanged": true,
        "metadataRemoved": true
      },
      "captureDimensions": {
        "width": 1280,
        "height": 720
      },
      "branding": {
        "applied": true,
        "editedAtUtc": "2026-09-12T01:07:53.829779+00:00",
        "footerHeight": 79,
        "capturePixelsUnchanged": true,
        "brand": "nineliveszerotrust.com"
      }
    }
  ],
  "privacyNote": "Account, tenant, subscription, temporary actor and audit identifiers are replaced with opaque masks and generic labels where present. Original captures are retained privately; only redacted PNGs are distributed. The manifest sha256 identifies the delivered PNG.",
  "brandingNote": "The established Nine Lives cat-head and site-domain footer is appended below each redacted capture. Width and height describe the distributed image; captureDimensions describe the original capture area. Capture pixels and all privacy masks are unchanged by branding."
}