mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
d6895f2c7e
The Intune roots the chain is pinned to are shared by every Intune tenant, so a valid certificate only ever proved "issued by Intune to someone". Tenant scoping rested on the device serial, which is printed on the chassis. A Mismatch now returns 403. Switched on against measured data, not a hunch: 35,684 requests across 32 tenants since the shadow telemetry landed, every one a Match, with the Warning channel independently verified to be carrying other traffic so the zero could not be a telemetry artefact. Only Mismatch blocks, and the rule lives in one function so "what rejects a request" has a single answer. ExtensionMissing, Unparseable and RequestTenantNotAGuid mean "cannot tell" and are tolerated: the sample only covers devices active in the window, so an older certificate or a sovereign-cloud CA could still lack the extension, and rejecting on absence would lock those devices out for something outside their control. ExtensionMissing is the candidate for later tightening and has its own test pinning the tolerance, so removing it must be a decision. Evaluation fails open on its own exception — a defect on our side is not evidence of a cross-tenant certificate. The 403 body does not echo which tenant the certificate belongs to; that pair goes to the rejection log. Device binding (stage 3) is untouched: still shadow, still Global-Admin-only. Backend 4638/4638, 0 warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>