These are actual portal captures. Identifying account, subscription, tenant, workspace, and object labels are masked in the review images; the underlying observations and displayed settings are unchanged. Source originals are retained privately. The cat-head and Nine Lives footer sits below the original capture area. Captions distinguish observed state, announced changes, and unverified outcomes. The article uses a smaller selection.
12 security admin response permissions
The current Security Administrator definition contains the four response actions. Its broad display labels must be read alongside target restrictions and the measured results.
Captured 2026-09-11T23:58:16.0848077Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
13 audit reset actor
Successful reset audit from the Security Administrator test. The actor type is User. The operator was established from the object ID in the retained private evidence; identifying values are masked here. The bottom was cropped during capture to omit the IP-address row.
Captured 2026-09-12T00:01:24.4086607Z · capture 1280 × 700 pixels; branded export 1280 × 779 pixels.
06 legacy user risk retirement
The legacy user-risk policy is read-only, displays the October 1 retirement notice, and has Disabled selected. This is current-state evidence, not a migration result.
Captured 2026-09-11T23:53:18.8792473Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
07 legacy signin risk retirement
The legacy sign-in-risk policy shows the same retirement notice and Disabled state. It was inspected separately from the Conditional Access inventory.
Captured 2026-09-11T23:53:50.4139124Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
09 cspm free plan on
Foundational CSPM is Free and On in the existing subscription. The separate paid Defender CSPM plan is also visible. No plan was changed for this work.
Captured 2026-09-11T23:54:55.3133919Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
10 cspm october notice
The October 27 opt-in announcement appears inside the lab portal. The banner documents a future new-subscription change; it does not demonstrate that future default.
Captured 2026-09-11T23:55:58.0771570Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
11 dynamic group inventory
The Dynamic membership filter returns zero groups. Separate completed Graph reads covered administrative units and access-package assignment policies.
Captured 2026-09-11T23:56:41.7528951Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
04 sentinel primary playbook options
The primary East US 2 workspace exposed only classic Logic Apps creation choices in this preflight. AI generation and execution were not validated.
Captured 2026-09-11T23:46:09.0988662Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
05 sentinel rbac preflight
Unified-RBAC workload settings show no active Sentinel workspaces in that permission model. This is different from whether a workspace is onboarded to Defender, and is not a proven cause of the missing generator menu.
Captured 2026-09-11T23:51:21.8606401Z · capture 1280 × 720 pixels; branded export 1280 × 799 pixels.
Supplemental captures
- 01-security-admin-assignment.png: Initial narrow capture of the temporary direct role assignment, before cleanup. Supplemental evidence only.
- 02-security-admin-response-permissions.png: Initial narrow permissions capture. Use the later desktop capture numbered 12 for article layout.
- 03-sentinel-playbook-options.png: The secondary Central US workspace showed the same classic creation options. Retained as a second workspace observation.
- 08-cspm-subscription-scope.png: The inspected Azure subscription beneath the tenant root group. This capture shows environment scope; the October notice is in capture 10.
