diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapGetAgentConfigFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapGetAgentConfigFunction.cs
index ba94daab..0ed9885a 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapGetAgentConfigFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapGetAgentConfigFunction.cs
@@ -21,6 +21,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public BootstrapGetAgentConfigFunction(
@@ -30,6 +31,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -38,6 +40,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -75,7 +78,8 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
                 var (validation, errorResponse) = await req.ValidateSecurityAsync(
                     tenantId, _configService, _rateLimitService,
                     _autopilotDeviceValidator, _corporateIdentifierValidator,
-                    _logger, bootstrapSessionService: _bootstrapSessionService);
+                    _logger, bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator);
 
                 if (errorResponse != null)
                 {
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapIngestEventsFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapIngestEventsFunction.cs
index f87d1bee..b437c025 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapIngestEventsFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapIngestEventsFunction.cs
@@ -22,6 +22,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public BootstrapIngestEventsFunction(
@@ -31,6 +32,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -39,6 +41,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -77,7 +80,8 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
                 var (validation, errorResponse) = await req.ValidateSecurityAsync(
                     tenantId, _configService, _rateLimitService,
                     _autopilotDeviceValidator, _corporateIdentifierValidator,
-                    _logger, bootstrapSessionService: _bootstrapSessionService);
+                    _logger, bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator);
 
                 if (errorResponse != null)
                 {
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapRegisterSessionFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapRegisterSessionFunction.cs
index 0ca031ac..922ed666 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapRegisterSessionFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapRegisterSessionFunction.cs
@@ -24,6 +24,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public BootstrapRegisterSessionFunction(
@@ -33,6 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -41,6 +43,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -91,7 +94,8 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
                     registration.TenantId, _configService, _rateLimitService,
                     _autopilotDeviceValidator, _corporateIdentifierValidator,
                     _logger, registration.SessionId,
-                    bootstrapSessionService: _bootstrapSessionService);
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator);
 
                 if (errorResponse != null)
                 {
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapReportAgentErrorFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapReportAgentErrorFunction.cs
index b3d35280..9230e08c 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapReportAgentErrorFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Bootstrap/BootstrapReportAgentErrorFunction.cs
@@ -21,6 +21,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public BootstrapReportAgentErrorFunction(
@@ -30,6 +31,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -38,6 +40,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -74,7 +77,8 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
                 var (_, errorResponse) = await req.ValidateSecurityAsync(
                     tenantId, _configService, _rateLimitService,
                     _autopilotDeviceValidator, _corporateIdentifierValidator,
-                    _logger, bootstrapSessionService: _bootstrapSessionService);
+                    _logger, bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator);
 
                 if (errorResponse != null)
                 {
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs
index a9522439..c8c719e3 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs
@@ -24,6 +24,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public GetAgentConfigFunction(
@@ -35,6 +36,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -45,6 +47,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -76,7 +79,8 @@ namespace AutopilotMonitor.Functions.Functions.Config
                     _autopilotDeviceValidator,
                     _corporateIdentifierValidator,
                     _logger,
-                    bootstrapSessionService: _bootstrapSessionService
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator
                 );
 
                 if (errorResponse != null)
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs
index aa25be9b..747b8399 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs
@@ -39,6 +39,7 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public GetDiagnosticsUploadUrlFunction(
@@ -47,6 +48,7 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -54,6 +56,7 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -101,7 +104,8 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
                     _autopilotDeviceValidator,
                     _corporateIdentifierValidator,
                     _logger,
-                    bootstrapSessionService: _bootstrapSessionService
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator
                 );
 
                 if (errorResponse != null)
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/IngestEventsFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/IngestEventsFunction.cs
index 4000a39f..53f2df00 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/IngestEventsFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/IngestEventsFunction.cs
@@ -24,6 +24,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly AnalyzeRuleService _analyzeRuleService;
         private readonly WebhookNotificationService _webhookNotificationService;
         private readonly BlockedDeviceService _blockedDeviceService;
@@ -46,6 +47,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             AnalyzeRuleService analyzeRuleService,
             WebhookNotificationService webhookNotificationService,
             BlockedDeviceService blockedDeviceService,
@@ -67,6 +69,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _analyzeRuleService = analyzeRuleService;
             _webhookNotificationService = webhookNotificationService;
             _blockedDeviceService = blockedDeviceService;
@@ -107,7 +110,8 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
                     _autopilotDeviceValidator,
                     _corporateIdentifierValidator,
                     _logger,
-                    bootstrapSessionService: _bootstrapSessionService
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator
                 );
 
                 if (errorResponse != null)
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/ReportAgentErrorFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/ReportAgentErrorFunction.cs
index 04d93dd2..7dd0c95d 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/ReportAgentErrorFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Ingest/ReportAgentErrorFunction.cs
@@ -29,6 +29,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly TelemetryClient _telemetryClient;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
@@ -38,6 +39,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             TelemetryClient telemetryClient,
             BootstrapSessionService bootstrapSessionService)
         {
@@ -46,6 +48,7 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _telemetryClient = telemetryClient;
             _bootstrapSessionService = bootstrapSessionService;
         }
@@ -77,7 +80,8 @@ namespace AutopilotMonitor.Functions.Functions.Ingest
                     _autopilotDeviceValidator,
                     _corporateIdentifierValidator,
                     _logger,
-                    bootstrapSessionService: _bootstrapSessionService
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator
                 );
 
                 if (errorResponse != null)
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Sessions/RegisterSessionFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Sessions/RegisterSessionFunction.cs
index 36334631..26d5ef48 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Sessions/RegisterSessionFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Sessions/RegisterSessionFunction.cs
@@ -20,6 +20,7 @@ namespace AutopilotMonitor.Functions.Functions.Sessions
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
+        private readonly DeviceAssociationValidator _deviceAssociationValidator;
         private readonly BootstrapSessionService _bootstrapSessionService;
 
         public RegisterSessionFunction(
@@ -30,6 +31,7 @@ namespace AutopilotMonitor.Functions.Functions.Sessions
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
+            DeviceAssociationValidator deviceAssociationValidator,
             BootstrapSessionService bootstrapSessionService)
         {
             _logger = logger;
@@ -39,6 +41,7 @@ namespace AutopilotMonitor.Functions.Functions.Sessions
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
+            _deviceAssociationValidator = deviceAssociationValidator;
             _bootstrapSessionService = bootstrapSessionService;
         }
 
@@ -78,7 +81,8 @@ namespace AutopilotMonitor.Functions.Functions.Sessions
                     _corporateIdentifierValidator,
                     _logger,
                     registration.SessionId,
-                    bootstrapSessionService: _bootstrapSessionService
+                    bootstrapSessionService: _bootstrapSessionService,
+                    deviceAssociationValidator: _deviceAssociationValidator
                 );
 
                 if (errorResponse2 != null)
diff --git a/src/Backend/AutopilotMonitor.Functions/Security/SecurityValidationExtensions.cs b/src/Backend/AutopilotMonitor.Functions/Security/SecurityValidationExtensions.cs
index 3dfeade8..7e9b73e9 100644
--- a/src/Backend/AutopilotMonitor.Functions/Security/SecurityValidationExtensions.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Security/SecurityValidationExtensions.cs
@@ -31,9 +31,10 @@ namespace AutopilotMonitor.Functions.Security
             CorporateIdentifierValidator corporateIdentifierValidator,
             ILogger logger,
             string? sessionId = null,
-            BootstrapSessionService? bootstrapSessionService = null)
+            BootstrapSessionService? bootstrapSessionService = null,
+            DeviceAssociationValidator? deviceAssociationValidator = null)
         {
-            var validator = new SecurityValidator(configService, rateLimitService, autopilotDeviceValidator, corporateIdentifierValidator, logger, bootstrapSessionService);
+            var validator = new SecurityValidator(configService, rateLimitService, autopilotDeviceValidator, corporateIdentifierValidator, logger, bootstrapSessionService, deviceAssociationValidator);
             var validation = await validator.ValidateRequestAsync(req, tenantId, sessionId);
 
             if (!validation.IsValid)