mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
249e39bc68
A chain-valid Intune MDM certificate only proves "issued to some tenant" — the pinned roots are shared by every Intune tenant. Tenant scoping rested entirely on the device serial in the downstream validators, which is not a secret. Bind the tenant stamped into the auth cert to the requested tenant. The Entra tenant id sits in OID 1.2.840.113556.5.14 of the cert the agent already presents for mTLS, so this needs no Graph call, no consent and no agent release. Not 5.6 (Intune Account id, a different GUID) and not 5.4 (device id, stored as 16 bare bytes) — the decoder handles both encodings and now lives once in Shared, used by agent and backend. Stage 1 observes only: ObserveCertTenantBinding returns void and swallows its own exceptions, so it cannot fail an otherwise valid request. Match is logged only on cert-cache miss, keeping the denominator without per-request volume. Grep marker for stage 2: CERT-TENANT-BINDING-SHADOW. Backend 4604/4604, Agent V2.Core 2519/2519, 0 warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>