From d0842913c643fa9585d3e2dcbce4f45f455ba3c7 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Fri, 3 Apr 2026 14:26:21 +0200 Subject: [PATCH] fix settings docs: correct group ordering, add missing settings, merge enrollment summary into agent parameters Co-Authored-By: Claude Opus 4.6 (1M context) --- .../app/docs/sections/SectionSettings.tsx | 316 ++++++++++-------- 1 file changed, 169 insertions(+), 147 deletions(-) diff --git a/src/Web/autopilot-monitor-web/app/docs/sections/SectionSettings.tsx b/src/Web/autopilot-monitor-web/app/docs/sections/SectionSettings.tsx index 2095e373..ee6b831f 100644 --- a/src/Web/autopilot-monitor-web/app/docs/sections/SectionSettings.tsx +++ b/src/Web/autopilot-monitor-web/app/docs/sections/SectionSettings.tsx @@ -46,6 +46,27 @@ export function SectionSettings() { Below is a reference for every available option.

+ {/* ═══════════════════════════════════════════════════════ + TENANT GROUP + ═══════════════════════════════════════════════════════ */} + + {/* Access Management */} + + + Manage who has access to the portal and at what level. New members are added by entering their UPN + (e.g. user@contoso.com). + The first user to sign in for a tenant is automatically granted Admin rights. Each member is assigned + one of three roles: +
    +
  • Admin — Full access to all tenant configuration, sessions, diagnostics, and settings.
    • +
  • Operator — Can view sessions, manage settings, and execute actions on devices.
    • +
+ + Admins can enable or disable individual members, update roles, and grant bootstrap token management permissions. + + + + {/* Enrollment Device Validation */} @@ -79,97 +100,6 @@ export function SectionSettings() { - {/* Agent Collectors */} - - - When enabled, the agent periodically collects CPU, memory, disk, and network metrics during enrollment and - streams them to the portal. The interval (30–300 seconds) controls how often samples are taken. Disabling - this reduces network traffic but removes the performance timeline from session diagnostics. - Core collectors (enrollment event tracking, Windows Hello detector) are always active and cannot be disabled. - - - How long the agent waits for the Windows Hello wizard to appear after ESP exit (range: 30–300 seconds). - If Hello does not appear within this window, the agent proceeds with enrollment completion. Increase this - value if your devices consistently take longer to reach the Hello screen. - - - - {/* Agent Parameters */} - - - After enrollment finishes, the agent removes its scheduled task and all agent files from the device. - This is the recommended mode — the agent is temporary by design and should not remain on enrolled devices. - - - Only available when Self-Destruct is enabled. If turned on, the agent's local log file is preserved on - the device even after self-destruct. Useful for troubleshooting when you need a local record of what happened. - - - Triggers an automatic reboot of the device once the Autopilot enrollment is detected as complete. - When enabled, a configurable Reboot Delay (0–3600 seconds, default 10 s) gives the user - a brief window to see the result before the reboot happens. - - - The agent queries an external IP geolocation service to capture the device's public IP address, - approximate location, and ISP at enrollment time. This data appears in the session detail view and can - help identify where devices are being enrolled. Disable this if your security policy prohibits outbound - requests to third-party services. - - - When enabled, the agent writes matched Intune Management Extension (IME) log lines to a local file at{" "} - %ProgramData%\AutopilotMonitor\Logs\ime_pattern_matches.log. - Useful for offline analysis of app deployment patterns captured during enrollment. - - - When enabled, standard output from PowerShell scripts (platform and remediation scripts tracked by IME) is - shown in the session timeline. Disable this if scripts may output sensitive data. Note: error output (stderr) - is always shown regardless of this setting. - - - Controls the verbosity of the agent's own log file.{" "} - Info covers normal operation, Debug adds detailed step tracing for - troubleshooting, and Verbose produces a full trace of every internal operation. - Only change this if actively diagnosing an agent issue — Verbose can produce large log files. - - - - {/* Enrollment Summary Dialog */} - - - Displays a visual enrollment summary dialog to the end user after enrollment completes (on both success and failure). - Requires the SummaryDialog companion to be deployed alongside the agent. - - - How long the summary dialog remains open before closing automatically (range: 0–3600 seconds). - Set to 0 to disable auto-close — the user must close the dialog manually. Only available when - Show Enrollment Summary is enabled. - - - How long the agent retries launching the summary dialog when the desktop is locked by credential UI - (e.g. Windows Hello setup). Set to 0 to disable retries (range: 0–3600 seconds). Only available when - Show Enrollment Summary is enabled. - - - Optional URL to a banner image displayed at the top of the summary dialog. Recommended size: 540 × 80 px. - Larger images will be center-cropped to fit. Only available when Show Enrollment Summary is enabled. - - - - {/* Agent Analyzers */} - - - Detects pre-enrollment local admin account creation — a known Autopilot bypass technique. The analyzer - runs at enrollment start and completion, comparing local accounts against an expected baseline. - Unexpected accounts trigger an alert visible in the session detail view. - - - Accounts considered expected on enrolled devices (will not trigger alerts). Built-in Windows accounts - (Administrator, Guest, DefaultAccount, WDAGUtilityAccount, defaultuser0–2, etc.) are always allowed and - shown as read-only. Use this list to add custom service accounts or local accounts that are expected - in your environment. Only available when Local Admin Analyzer is enabled. - - - {/* Notifications */} @@ -208,6 +138,136 @@ export function SectionSettings() { + {/* Bootstrap Sessions */} +
+ + + + + Bootstrap Sessions is an optional feature that is enabled on request only. + To get access, open a{" "} + + GitHub issue + {" "} + to request activation for your tenant. + +
+ + + Bootstrap tokens allow new devices to register with Autopilot Monitor before device validation is fully + configured. Each token generates a unique short code and URL that can be shared with technicians or + included in provisioning scripts. Tokens have a configurable validity duration + (1 h, 4 h, 8 h, 24 h, 48 h, or 7 days) and can be revoked at any time. The token list shows status + (Active, Expired, Revoked), creation date, expiry, creator, and usage count. A copy button provides + both the URL and a ready-to-use PowerShell command. + + + + {/* ═══════════════════════════════════════════════════════ + AGENT GROUP + ═══════════════════════════════════════════════════════ */} + + {/* Agent Parameters */} + + + After enrollment finishes, the agent removes its scheduled task and all agent files from the device. + This is the recommended mode — the agent is temporary by design and should not remain on enrolled devices. + + + Only available when Self-Destruct is enabled. If turned on, the agent's local log file is preserved on + the device even after self-destruct. Useful for troubleshooting when you need a local record of what happened. + + + Triggers an automatic reboot of the device once the Autopilot enrollment is detected as complete. + When enabled, a configurable Reboot Delay (0–3600 seconds, default 10 s) gives the user + a brief window to see the result before the reboot happens. + + + The agent queries an external IP geolocation service to capture the device's public IP address, + approximate location, and ISP at enrollment time. This data appears in the session detail view and can + help identify where devices are being enrolled. Disable this if your security policy prohibits outbound + requests to third-party services. + + + Only available when Geo-Location Detection is enabled. Automatically sets the device timezone based on + the IP geolocation result using tzutil /s. + Useful for shared device scenarios where devices may be enrolled in different time zones. + + + When enabled, the agent writes matched Intune Management Extension (IME) log lines to a local file at{" "} + %ProgramData%\AutopilotMonitor\Logs\ime_pattern_matches.log. + Useful for offline analysis of app deployment patterns captured during enrollment. + + + When enabled, standard output from PowerShell scripts (platform and remediation scripts tracked by IME) is + shown in the session timeline. Disable this if scripts may output sensitive data. Note: error output (stderr) + is always shown regardless of this setting. + + + Controls the verbosity of the agent's own log file.{" "} + Info covers normal operation, Debug adds detailed step tracing for + troubleshooting, Verbose produces a full trace of every internal operation, and{" "} + Trace enables full diagnostic output including low-level details. + Only change this if actively diagnosing an agent issue — Verbose and Trace can produce large log files. + + + Displays a visual enrollment summary dialog to the end user after enrollment completes (on both success and failure). + Requires the SummaryDialog companion to be deployed alongside the agent. When enabled, the following + sub-settings become available: + + + How long the summary dialog remains open before closing automatically (range: 0–3600 seconds). + Set to 0 to disable auto-close — the user must close the dialog manually. Only available when + Show Enrollment Summary is enabled. + + + How long the agent retries launching the summary dialog when the desktop is locked by credential UI + (e.g. Windows Hello setup). Set to 0 to disable retries (range: 0–3600 seconds). Only available when + Show Enrollment Summary is enabled. + + + Optional URL to a banner image displayed at the top of the summary dialog. Recommended size: 540 × 80 px. + Larger images will be center-cropped to fit. Only available when Show Enrollment Summary is enabled. + + + + {/* Agent Collectors */} + + + When enabled, the agent periodically collects CPU, memory, disk, and network metrics during enrollment and + streams them to the portal. The interval (30–300 seconds) controls how often samples are taken. Disabling + this reduces network traffic but removes the performance timeline from session diagnostics. + Core collectors (enrollment event tracking, Windows Hello detector) are always active and cannot be disabled. + + + How long the agent waits for the Windows Hello wizard to appear after ESP exit (range: 30–300 seconds). + If Hello does not appear within this window, the agent proceeds with enrollment completion. Increase this + value if your devices consistently take longer to reach the Hello screen. + + + + {/* Agent Analyzers */} + + + Detects pre-enrollment local admin account creation — a known Autopilot bypass technique. The analyzer + runs at enrollment start and completion, comparing local accounts against an expected baseline. + Unexpected accounts trigger an alert visible in the session detail view. + + + Accounts considered expected on enrolled devices (will not trigger alerts). Built-in Windows accounts + (Administrator, Guest, DefaultAccount, WDAGUtilityAccount, defaultuser0–2, etc.) are always allowed and + shown as read-only. Use this list to add custom service accounts or local accounts that are expected + in your environment. Only available when Local Admin Analyzer is enabled. + + + Experimental + Pre-Release + {" "}Collects installed software from the Windows registry at enrollment start and completion. + Produces a normalized inventory snapshot, detects software installed during enrollment (delta detection), + and correlates findings against known vulnerabilities (NVD CVEs, CISA KEV, MSRC). + + + {/* Diagnostics Package */} @@ -262,62 +322,6 @@ export function SectionSettings() { - {/* Data Management */} - - - Sessions and their associated events are automatically deleted after this many days. Deletion runs as part - of a periodic maintenance job. Reduce this value to limit storage usage; increase it if you need a longer - history for auditing or trend analysis. - - - Sessions that remain in In Progress state beyond this threshold are automatically marked as{" "} - Failed – Timed Out by the maintenance job. Set this to match (or slightly exceed) your - Enrollment Status Page (ESP) timeout so stalled sessions don't permanently inflate your in-progress count. - - - - {/* Access Management */} - - - Manage who has access to the portal and at what level. New members are added by entering their UPN - (e.g. user@contoso.com). - The first user to sign in for a tenant is automatically granted Admin rights. Each member is assigned - one of three roles: -
    -
  • Admin — Full access to all tenant configuration, sessions, diagnostics, and settings.
    • -
  • Operator — Can view sessions, manage settings, and execute actions on devices.
    • -
- - Admins can enable or disable individual members, update roles, and grant bootstrap token management permissions. - - - - - {/* Bootstrap Sessions */} -
- - - - - Bootstrap Sessions is an optional feature that is enabled on request only. - To get access, open a{" "} - - GitHub issue - {" "} - to request activation for your tenant. - -
- - - Bootstrap tokens allow new devices to register with Autopilot Monitor before device validation is fully - configured. Each token generates a unique short code and URL that can be shared with technicians or - included in provisioning scripts. Tokens have a configurable validity duration - (1 h, 4 h, 8 h, 24 h, 48 h, or 7 days) and can be revoked at any time. The token list shows status - (Active, Expired, Revoked), creation date, expiry, creator, and usage count. A copy button provides - both the URL and a ready-to-use PowerShell command. - - - {/* Unrestricted Mode */}
@@ -342,6 +346,24 @@ export function SectionSettings() { + {/* ═══════════════════════════════════════════════════════ + MAINTENANCE GROUP + ═══════════════════════════════════════════════════════ */} + + {/* Data Management */} + + + Sessions and their associated events are automatically deleted after this many days. Deletion runs as part + of a periodic maintenance job. Reduce this value to limit storage usage; increase it if you need a longer + history for auditing or trend analysis. + + + Sessions that remain in In Progress state beyond this threshold are automatically marked as{" "} + Failed – Timed Out by the maintenance job. Set this to match (or slightly exceed) your + Enrollment Status Page (ESP) timeout so stalled sessions don't permanently inflate your in-progress count. + + + {/* Danger Zone */}