diff --git a/src/Web/autopilot-monitor-web/app/docs/page.tsx b/src/Web/autopilot-monitor-web/app/docs/page.tsx index 60b98013..68aa0c10 100644 --- a/src/Web/autopilot-monitor-web/app/docs/page.tsx +++ b/src/Web/autopilot-monitor-web/app/docs/page.tsx @@ -10,6 +10,7 @@ const NAV_SECTIONS = [ { id: "overview", label: "Overview" }, { id: "setup", label: "Setup" }, { id: "agent-setup", label: "Agent Setup" }, + { id: "settings", label: "Settings" }, ]; function SectionPrivatePreview() { @@ -392,11 +393,202 @@ function SectionAgentSetup() { ); } +function SettingsGroup({ title, color, children }: { title: string; color: string; children: React.ReactNode }) { + return ( +
+
+

{title}

+
+
+ {children} +
+
+ ); +} + +function SettingsRow({ name, defaultVal, children }: { name: string; defaultVal?: string; children: React.ReactNode }) { + return ( +
+
+

{name}

+ {defaultVal &&

Default: {defaultVal}

} +
+
{children}
+
+ ); +} + +function SectionSettings() { + return ( +
+
+ + + + +

Settings Reference

+
+ +

+ The Settings page (accessible to Tenant Admins) controls all aspects of how Autopilot Monitor + behaves for your tenant — from security and device filtering, to agent behavior, notifications, and data retention. + Below is a reference for every available option. +

+ + {/* Security */} + + + Validates that only devices registered in your Intune tenant as Windows Autopilot devices can register sessions. + When enabled, the backend checks each incoming agent request against the Intune Autopilot device list — unauthorized + devices are rejected. Enabling this setting requires granting admin consent for the{" "} + DeviceManagementServiceConfig.Read.All{" "} + Microsoft Graph permission. This is required before the agent can send any data (see{" "} + Setup). + + + + {/* Hardware Whitelist */} + + + Comma-separated list of manufacturer names that are permitted to register sessions. Wildcards (*) are + supported — e.g. Dell* matches any string starting with "Dell". + Devices with a manufacturer not on this list will have their session registration rejected by the backend. + Set to * to allow all manufacturers. + + + Comma-separated list of device model names to allow. Works the same as the manufacturer filter with wildcard support. + Use this to restrict telemetry to specific hardware lines, e.g. Latitude*,EliteBook*. + + + + {/* Agent Collectors */} + + + When enabled, the agent periodically collects CPU, memory, disk, and network metrics during enrollment and + streams them to the portal. The interval (30–300 seconds) controls how often samples are taken. Disabling + this reduces network traffic but removes the performance timeline from session diagnostics. + Core collectors (enrollment event tracking, Windows Hello detector) are always active and cannot be disabled. + + + + {/* Agent Parameters */} + + + After enrollment finishes, the agent removes its scheduled task and all agent files from the device. + This is the recommended mode — the agent is temporary by design and should not remain on enrolled devices. + + + Only available when Self-Destruct is enabled. If turned on, the agent's local log file is preserved on + the device even after self-destruct. Useful for troubleshooting when you need a local record of what happened. + + + Triggers an automatic reboot of the device once the Autopilot enrollment is detected as complete. + When enabled, a configurable Reboot Delay (0–3600 seconds, default 10 s) gives the user + a brief window to see the result before the reboot happens. + + + The agent queries an external IP geolocation service to capture the device's public IP address, + approximate location, and ISP at enrollment time. This data appears in the session detail view and can + help identify where devices are being enrolled. Disable this if your security policy prohibits outbound + requests to third-party services. + + + When enabled, the agent writes matched Intune Management Extension (IME) log lines to a local file at{" "} + %ProgramData%\AutopilotMonitor\Logs\ime_pattern_matches.log. + Useful for offline analysis of app deployment patterns captured during enrollment. + + + Controls the verbosity of the agent's own log file.{" "} + Info covers normal operation, Debug adds detailed step tracing for + troubleshooting, and Verbose produces a full trace of every internal operation. + Only change this if actively diagnosing an agent issue — Verbose can produce large log files. + + + + {/* Teams Notifications */} + + + A Microsoft Teams Incoming Webhook URL. Once configured, the portal can send enrollment outcome notifications + directly to a Teams channel. To create one: open the target channel in Teams → Connectors → search + for Incoming Webhook → configure and copy the URL. + + + Send a Teams notification when an enrollment session completes successfully. + + + Send a Teams notification when an enrollment session ends in failure. Recommended to keep enabled so + failed enrollments are surfaced immediately without having to check the portal manually. + + + + {/* Diagnostics Package */} + + + An Azure Blob Storage Container SAS URL where the agent uploads diagnostics packages. The SAS URL must grant + at minimum Read, Write, and Create permissions at the + container level. Diagnostic data is uploaded directly from the device to Blob Storage — it does + not pass through the Autopilot Monitor backend. + + + Controls when diagnostics packages are uploaded:{" "} + Off — never upload,{" "} + Always — upload after every session,{" "} + OnFailure — upload only when the session ends in failure (recommended if storage costs + are a concern). Only available when a Blob Storage URL is configured. + + + + {/* Data Management */} + + + Sessions and their associated events are automatically deleted after this many days. Deletion runs as part + of a daily maintenance job. Reduce this value to limit storage usage; increase it if you need a longer + history for auditing or trend analysis. + + + Sessions that remain in In Progress state beyond this threshold are automatically marked as{" "} + Failed – Timed Out by the daily maintenance job. Set this to match (or slightly exceed) your + Enrollment Status Page (ESP) timeout so stalled sessions don't permanently inflate your in-progress count. + + + + {/* Admin Users */} + + + The list of users with full admin access to the portal. Admins can view all sessions, access diagnostics, + manage settings, and add or remove other admins. The first user to sign in for a tenant is automatically + granted Tenant Admin rights. Additional admins can be added by entering their UPN (e.g.{" "} + user@contoso.com). + Users without admin access can only use the Progress portal to track a specific device + by serial number. + + + + {/* Danger Zone */} +
+
+

Danger Zone

+
+
+

Offboard Tenant

+

+ Permanently and irreversibly deletes all tenant data: sessions, events, analyze rules, + audit logs, configuration, and all admin accounts. You will be signed out immediately. This action + requires typing OFFBOARD{" "} + as a confirmation step and cannot be undone. +

+
+
+
+ ); +} + const SECTION_COMPONENTS: Record JSX.Element> = { "private-preview": SectionPrivatePreview, "overview": SectionOverview, "setup": SectionSetup, "agent-setup": SectionAgentSetup, + "settings": SectionSettings, }; export default function DocsPage() {