AutopilotMonitor

mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 12:42:38 +00:00

Files

T

Oliver Kieselbach 2e736f40ad feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282)

The certificate's Intune managedDevice id is looked up in the tenant's Intune. With the tenant
switch ValidateIntuneDeviceBinding on, that lookup is the last accepting link of the validator
chain: an enrolled device that is not being retired, wiped or deleted is admitted as
ValidatorType.IntuneEnrollment. A 404 for a certificate younger than 60 minutes is
NotFoundRecentEnrollment (503, never cached); a missing grant is 503 with 120 s.

For devices another validator admitted, the lookup only observes: in the background, never
admitting or rejecting, and only when the app token carries
DeviceManagementManagedDevices.Read.All, so a tenant without the add-on costs no Graph call.
Outcomes ride on the request row (CertDeviceBinding, role, serial match, owner and enrollment
type).

TenantConfiguration.HasAnyDeviceValidation() is the single gate precondition; the feature flags
expose it as deviceValidationEnabled (replaces validateAutopilotDevice).

The agent parses ValidatorType strictly: release the agent before this backend.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-25 11:57:26 +02:00

DataAccess

feat(web,backend): AI Integration settings page; one self-hosted client per tenant, raisable by a Global Admin

2026-09-24 15:00:15 +02:00

Extensions

feat(auth): client-app binding for delegated tokens - measured always, enforced behind a switch (D-279)

2026-09-24 13:28:21 +02:00

Functions

feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282)

2026-09-25 11:57:26 +02:00

Helpers

feat(web,backend): AI Integration settings page; one self-hosted client per tenant, raisable by a Global Admin