Oliver Kieselbach
ea6a375c4b
feat(security): cert-to-device binding, stage 3 GA-gated shadow
...
Tenant binding (stage 1) proves the client certificate was issued to this
tenant. It does not prove the certificate belongs to a device the tenant
still has: a cert lifted from a decommissioned machine keeps working.
IntuneDeviceBindingValidator resolves the Intune managedDevice id from the
certificate's Subject CN against the tenant's own managedDevices inventory.
Point-GET on managedDevices/{id} rather than an OData filter, so there is no
filter literal to inject into and a 404 is unambiguous. Cache/retry/transient
contract mirrors CloudPcDeviceValidator.
Shadow only, and visible only to Global Admins (same gate as the DevPrep
association preview) because the open question is a race, not an attack: a
device object can appear after the agent's first call. Every result carries
enrolledDateTime and the log line records enrolledAgeSeconds, so a device
created seconds before the request is distinguishable from a foreign cert.
Grep marker: CERT-DEVICE-BINDING-SHADOW.
The lookup is fire-and-forget like the DevPrep shadow so a cold Graph
round-trip never sits in the agent request path. That rules out stage 1's
request-row dimension (the row is written before the task finishes), hence
the Warning log; widening beyond preview should move to inline + dimension.
Needs DeviceManagementManagedDevices.Read.All, granted per tenant via the
customer script as feature IntuneDeviceBinding. The script's catalog,
ValidateSet and help block stay pinned to GraphFeatureCatalog by
GraphFeatureCatalogSyncTests (extended with the help-block case).
Build 0 warnings, backend 4629/4629, web 874/874, tsc clean, eslint 0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-24 18:26:33 +02:00
..
2026-07-31 18:12:25 +02:00
2026-05-19 18:45:01 +02:00
2026-08-22 23:26:32 +02:00
2026-05-28 17:15:04 +02:00
2026-05-28 12:19:54 +02:00
2026-07-28 21:42:56 +02:00
2026-07-31 14:30:57 +02:00
2026-04-21 11:48:27 +02:00
2026-04-30 22:54:30 +02:00
2026-08-18 00:20:53 +02:00
2026-05-13 01:08:04 +02:00
2026-08-03 14:30:05 +02:00
2026-07-31 19:52:23 +02:00
2026-05-15 12:59:40 +02:00
2026-04-21 10:27:54 +02:00
2026-08-20 01:24:59 +02:00
2026-08-20 01:24:59 +02:00
2026-07-18 17:48:48 +02:00
2026-08-14 15:53:02 +02:00
2026-07-29 01:44:32 +02:00
2026-07-08 18:22:41 +02:00
2026-04-14 21:51:57 +02:00
2026-07-31 19:52:23 +02:00
2026-08-03 14:30:05 +02:00
2026-07-07 21:33:57 +00:00
2026-08-20 01:25:28 +02:00
2026-07-26 17:29:36 +02:00
2026-04-27 19:44:13 +02:00
2026-08-21 13:40:47 +02:00
2026-07-26 16:24:45 +02:00
2026-06-07 18:25:10 +02:00
2026-07-27 14:50:55 +02:00
2026-08-21 13:40:47 +02:00
2026-06-05 21:33:34 +02:00
2026-06-06 11:36:39 +02:00
2026-05-06 20:53:46 +02:00
2026-08-15 09:42:24 +02:00
2026-07-31 18:12:25 +02:00
2026-08-03 14:30:05 +02:00
2026-07-31 14:30:57 +02:00
2026-06-18 18:41:34 +02:00
2026-08-13 09:38:41 +02:00
2026-07-27 18:39:22 +02:00
2026-08-18 10:21:26 +02:00
2026-04-25 12:26:34 +02:00
2026-05-26 15:19:07 +02:00
2026-05-26 15:19:07 +02:00
2026-05-26 16:33:46 +02:00
2026-05-12 19:13:21 +02:00
2026-05-12 23:44:20 +02:00
2026-06-09 22:43:39 +02:00
2026-06-09 22:43:39 +02:00
2026-07-07 11:26:29 +02:00
2026-07-28 21:42:56 +02:00
2026-08-21 14:13:46 +02:00
2026-08-18 01:01:02 +02:00
2026-07-20 11:29:53 +02:00
2026-07-20 11:29:53 +02:00
2026-07-20 11:29:53 +02:00
2026-05-13 12:08:28 +02:00
2026-05-20 19:54:43 +02:00
2026-08-24 16:40:04 +02:00
2026-08-07 12:31:08 +02:00
2026-08-20 22:30:10 +02:00
2026-08-03 14:30:05 +02:00
2026-08-03 14:30:05 +02:00
2026-08-03 14:30:05 +02:00
2026-07-28 14:25:17 +02:00
2026-04-02 01:31:47 +02:00
2026-08-06 13:51:25 +02:00
2026-08-18 10:21:26 +02:00
2026-07-08 14:02:43 +02:00
2026-08-11 13:30:44 +02:00
2026-05-26 16:33:46 +02:00
2026-08-15 09:42:24 +02:00
2026-05-27 12:44:45 +02:00
2026-08-23 17:52:02 +02:00
2026-05-06 20:53:46 +02:00
2026-05-04 18:36:37 +02:00
2026-07-31 13:04:47 +02:00
2026-07-31 13:04:47 +02:00
2026-06-26 19:13:36 +02:00
2026-05-15 12:59:40 +02:00
2026-08-13 23:17:48 +02:00
2026-05-12 19:13:21 +02:00
2026-05-18 23:06:51 +02:00
2026-08-13 23:17:48 +02:00
2026-05-08 15:28:21 +02:00
2026-04-14 20:33:14 +02:00
2026-05-28 17:03:48 +02:00
2026-07-27 10:52:39 +02:00
2026-05-29 16:57:54 +02:00
2026-07-24 18:05:39 +02:00
2026-08-23 04:09:50 +02:00
2026-05-19 18:45:01 +02:00
2026-06-22 21:29:29 +02:00
2026-08-22 21:09:12 +02:00
2026-03-31 17:10:59 +02:00
2026-07-29 10:30:47 +02:00
2026-08-23 00:50:10 +02:00
2026-08-23 00:50:10 +02:00
2026-08-23 04:09:50 +02:00
2026-08-23 11:06:37 +02:00
2026-07-31 18:12:25 +02:00
2026-06-17 18:54:39 +02:00
2026-06-16 17:30:02 +02:00
2026-05-29 23:10:08 +02:00
2026-08-21 13:40:47 +02:00
2026-08-20 01:24:59 +02:00
2026-07-10 10:51:57 +02:00
2026-07-03 16:06:39 +02:00
2026-07-31 13:04:47 +02:00
2026-08-21 12:49:42 +02:00
2026-08-10 13:41:14 +02:00
2026-07-20 09:50:35 +02:00
2026-07-08 18:22:41 +02:00
2026-08-11 12:29:05 +02:00
2026-08-10 13:41:14 +02:00
2026-06-19 14:34:53 +02:00
2026-05-31 15:22:22 +02:00
2026-04-15 00:52:44 +02:00
2026-08-15 14:59:42 +02:00
2026-07-24 09:47:31 +02:00
2026-07-28 11:58:53 +02:00
2026-08-23 04:09:50 +02:00
2026-05-31 14:54:15 +02:00
2026-07-20 13:13:26 +02:00
2026-07-29 01:44:32 +02:00
2026-08-07 10:52:35 +00:00
2026-08-23 04:09:50 +02:00
2026-05-19 18:45:01 +02:00
2026-04-05 13:36:02 +02:00
2026-08-18 00:20:53 +02:00
2026-06-26 23:21:39 +02:00
2026-04-21 10:37:27 +02:00
2026-08-02 17:58:49 +02:00
2026-07-24 20:47:06 +02:00
2026-04-08 13:40:02 +02:00
2026-08-24 18:26:33 +02:00
2026-07-31 19:52:23 +02:00
2026-07-28 21:42:56 +02:00
2026-07-27 09:10:52 +02:00
2026-07-24 20:47:06 +02:00
2026-04-05 13:36:02 +02:00
2026-07-19 11:42:40 +02:00
2026-07-19 11:42:40 +02:00
2026-07-31 18:59:21 +02:00
2026-07-24 18:05:39 +02:00
2026-08-18 10:21:26 +02:00
2026-08-18 10:21:26 +02:00
2026-04-21 12:29:12 +02:00
2026-04-21 11:48:27 +02:00
2026-04-21 11:48:27 +02:00
2026-04-21 12:03:06 +02:00
2026-04-21 12:29:12 +02:00
2026-04-21 11:29:35 +02:00
2026-07-28 11:44:46 +02:00
2026-07-28 14:25:17 +02:00
2026-08-21 00:44:29 +02:00
2026-07-23 23:43:59 +02:00
2026-07-16 13:24:21 +02:00
2026-07-25 00:17:31 +02:00
2026-06-09 22:43:39 +02:00
2026-07-07 21:33:57 +00:00
2026-08-21 00:44:29 +02:00
2026-07-07 21:33:57 +00:00
2026-08-24 18:26:33 +02:00
2026-07-03 13:49:32 +02:00
2026-04-09 19:50:13 +02:00
2026-07-22 10:31:48 +02:00
2026-08-20 13:12:49 +02:00
2026-05-08 16:16:12 +02:00
2026-07-22 14:43:00 +02:00
2026-07-31 18:59:21 +02:00
2026-05-31 18:09:39 +02:00
2026-07-18 16:38:15 +02:00
2026-08-23 12:19:41 +02:00
2026-07-31 13:04:47 +02:00
2026-07-31 13:04:47 +02:00
2026-06-06 15:39:49 +02:00
2026-04-30 08:45:55 +02:00
2026-05-27 16:52:52 +02:00
2026-07-27 14:50:55 +02:00
2026-07-01 15:35:51 +02:00
2026-07-02 08:53:20 +02:00
2026-05-11 19:02:59 +02:00
2026-08-22 21:09:12 +02:00
2026-06-24 17:11:28 +02:00
2026-07-20 11:29:53 +02:00
2026-04-01 02:39:11 +02:00
2026-05-18 23:06:51 +02:00
2026-08-13 19:29:27 +02:00
2026-08-23 12:19:41 +02:00
2026-08-13 23:17:48 +02:00
2026-07-28 21:42:56 +02:00
2026-05-07 09:58:53 +02:00
2026-08-22 21:00:53 +02:00
2026-08-02 17:58:49 +02:00
2026-08-20 01:24:59 +02:00
2026-07-11 12:12:00 +02:00
2026-08-20 01:24:59 +02:00
2026-08-21 15:24:41 +02:00
2026-07-31 14:30:57 +02:00
2026-08-15 09:42:24 +02:00
2026-05-06 20:53:46 +02:00
2026-07-01 15:35:51 +02:00
2026-07-08 14:02:43 +02:00
2026-07-07 11:26:29 +02:00
2026-08-23 16:26:44 +02:00
2026-05-30 13:23:23 +02:00
2026-05-07 10:55:39 +02:00
2026-06-08 13:11:52 +02:00
2026-04-24 13:39:47 +02:00
2026-04-21 10:56:18 +02:00
2026-05-13 12:08:28 +02:00
2026-08-20 19:28:43 +02:00
2026-05-14 11:38:34 +02:00
2026-05-26 17:04:33 +02:00
2026-07-31 13:04:47 +02:00
2026-08-13 23:17:48 +02:00
2026-07-06 12:32:32 +02:00
2026-08-21 00:44:29 +02:00
2026-06-09 22:43:39 +02:00
2026-08-14 16:50:29 +02:00
2026-08-14 19:29:45 +02:00
2026-08-20 22:30:10 +02:00
2026-06-30 00:47:11 +02:00
2026-08-14 16:07:39 +02:00
2026-07-06 12:32:32 +02:00
2026-06-09 22:43:39 +02:00
2026-07-23 14:07:01 +02:00
2026-08-13 13:38:52 +02:00
2026-08-06 14:15:43 +02:00
2026-08-01 00:40:29 +02:00
2026-07-27 09:10:52 +02:00
2026-08-13 19:29:27 +02:00
2026-05-19 18:45:01 +02:00
2026-05-27 20:49:01 +02:00
2026-05-07 10:55:39 +02:00
2026-05-06 20:53:46 +02:00
2026-05-07 11:31:50 +02:00
2026-05-21 14:26:12 +02:00
2026-08-17 16:41:57 +02:00
2026-07-16 13:24:21 +02:00
2026-07-24 18:05:39 +02:00
2026-08-13 19:29:27 +02:00
2026-04-29 19:00:39 +02:00
2026-06-09 22:43:39 +02:00
2026-07-03 16:06:39 +02:00
2026-05-19 18:45:01 +02:00
2026-07-22 01:33:26 +02:00
2026-05-12 21:34:42 +02:00
2026-05-12 21:18:40 +02:00
2026-06-05 14:56:41 +02:00
2026-05-13 01:08:04 +02:00
2026-05-12 20:41:32 +02:00
2026-08-03 14:30:05 +02:00
2026-08-13 19:29:27 +02:00
2026-08-13 19:29:27 +02:00
2026-08-23 11:06:37 +02:00
2026-08-07 12:31:08 +02:00
2026-05-06 20:53:46 +02:00
2026-07-29 13:53:12 +02:00
2026-05-06 20:53:46 +02:00
2026-07-29 14:13:33 +02:00
2026-08-13 23:17:48 +02:00
2026-08-22 21:00:53 +02:00
2026-08-13 19:29:27 +02:00
2026-08-23 11:06:37 +02:00
2026-08-21 12:49:42 +02:00
2026-08-21 12:49:42 +02:00
2026-07-11 10:59:31 +02:00
2026-08-06 15:13:19 +02:00
2026-06-09 22:43:39 +02:00
2026-08-13 23:17:48 +02:00
2026-08-15 09:42:24 +02:00
2026-06-25 12:16:04 +02:00
2026-06-25 12:16:04 +02:00
2026-08-21 19:41:56 +02:00
2026-05-12 19:59:28 +02:00
2026-05-20 19:54:43 +02:00
2026-08-23 16:04:31 +02:00
2026-08-23 18:31:32 +02:00
2026-08-17 11:55:19 +02:00
2026-07-07 13:06:04 +02:00
2026-05-19 13:14:09 +02:00
2026-06-08 17:09:46 +02:00
2026-04-21 10:50:14 +02:00
2026-05-19 12:44:36 +02:00
2026-04-21 11:29:35 +02:00
2026-08-13 19:29:27 +02:00
2026-05-19 12:44:36 +02:00
2026-08-23 15:33:45 +02:00
2026-08-12 16:13:04 +02:00
2026-04-21 10:37:27 +02:00
2026-05-11 18:47:58 +02:00
2026-04-11 11:17:48 +02:00
2026-05-12 19:59:28 +02:00
2026-05-12 19:59:28 +02:00
2026-05-12 23:44:20 +02:00
2026-05-13 10:44:54 +02:00
2026-05-04 18:36:37 +02:00
2026-04-21 14:31:28 +02:00
2026-08-13 17:51:59 +02:00
2026-08-22 23:26:32 +02:00
2026-08-22 23:26:32 +02:00
2026-05-27 19:39:02 +02:00
2026-08-07 16:25:03 +02:00
2026-07-31 18:12:25 +02:00
2026-08-22 21:00:53 +02:00
2026-08-03 14:30:05 +02:00
2026-08-03 14:30:05 +02:00
2026-08-22 21:00:53 +02:00
2026-08-13 13:39:03 +02:00
2026-05-08 18:32:22 +02:00
2026-05-08 18:32:22 +02:00
2026-08-03 14:30:05 +02:00
2026-07-02 08:53:20 +02:00
2026-08-05 22:48:10 +02:00
2026-06-22 21:29:29 +02:00
2026-07-07 13:06:04 +02:00
2026-08-21 19:41:56 +02:00
2026-08-21 19:41:56 +02:00
2026-08-22 21:00:53 +02:00
2026-06-05 20:54:16 +02:00
2026-05-05 12:12:54 +02:00
2026-07-11 12:10:56 +02:00
2026-07-11 12:10:56 +02:00
2026-07-11 12:10:56 +02:00
2026-07-11 12:10:56 +02:00
2026-06-23 19:44:30 +02:00
2026-07-23 08:37:42 +02:00
2026-08-23 12:32:00 +02:00
2026-08-23 11:22:17 +02:00
2026-08-23 11:06:37 +02:00
2026-07-08 14:02:43 +02:00
2026-04-30 15:25:28 +02:00
2026-04-30 15:25:28 +02:00
2026-05-12 19:59:28 +02:00
2026-04-30 15:25:28 +02:00
2026-06-09 22:43:39 +02:00
2026-08-21 13:57:16 +02:00
2026-05-27 17:56:22 +02:00
2026-08-22 21:09:12 +02:00
2026-07-10 18:42:48 +02:00