Oliver Kieselbach
d6895f2c7e
The Intune roots the chain is pinned to are shared by every Intune tenant, so a valid certificate only ever proved "issued by Intune to someone". Tenant scoping rested on the device serial, which is printed on the chassis. A Mismatch now returns 403. Switched on against measured data, not a hunch: 35,684 requests across 32 tenants since the shadow telemetry landed, every one a Match, with the Warning channel independently verified to be carrying other traffic so the zero could not be a telemetry artefact. Only Mismatch blocks, and the rule lives in one function so "what rejects a request" has a single answer. ExtensionMissing, Unparseable and RequestTenantNotAGuid mean "cannot tell" and are tolerated: the sample only covers devices active in the window, so an older certificate or a sovereign-cloud CA could still lack the extension, and rejecting on absence would lock those devices out for something outside their control. ExtensionMissing is the candidate for later tightening and has its own test pinning the tolerance, so removing it must be a decision. Evaluation fails open on its own exception — a defect on our side is not evidence of a cross-tenant certificate. The 403 body does not echo which tenant the certificate belongs to; that pair goes to the rejection log. Device binding (stage 3) is untouched: still shadow, still Global-Admin-only. Backend 4638/4638, 0 warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
AutopilotMonitor
Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
Availability
Autopilot Monitor is publicly available — the Community plan is free. Sign in with your work account at autopilotmonitor.com; new organizations complete a short activation step after first sign-in.
Overview
Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
- Bootstrap Script — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
- Monitoring Agent — Lightweight .NET application that collects telemetry and evidence during enrollment
- Backend API — Azure Functions-based ingestion and processing pipeline
- Web Dashboard — Next.js application for real-time monitoring and fleet analytics
Architecture
For detailed information about the system architecture, components, and data flow, see Architecture Documentation.
Documentation
Full admin documentation is available at docs.autopilotmonitor.com
License
This project uses a split licensing model:
- MIT License — Agent (
src/Agent/) and Shared library (src/Shared/) — unrestricted use on end-user devices - AGPL-3.0 — Backend (
src/Backend/), Web Dashboard (src/Web/), and MCP Server (src/McpServer/) — server-side components remain open source
See LICENSE for full details.