Entra ID Device Trust enables binding Function Apps to Entra ID joined devices by validating requests originate from trusted devices via the device certificate enrolled during device registration. It combines client-side data gathering (signature hash, device CN, public key, thumbprint) with server-side validation, and can be embedded as a module in your Function App or installed as a dependency. The solution supports embedding EntraIDDeviceTrust.Client on clients and EntraIDDeviceTrust.FunctionApp in Function Apps for seamless, enhanced request security.
16 files scanned on Sep 20, 2026
Overall assessment: The codebase appears to be a legitimate Microsoft Intune/Entra ID device trust utility with cryptographic signing for attestation, Graph API usage, and certificate-based operations. No remote script downloads or hardcoded secrets are present. Primary security considerations involve protecting the private signing keys, ensuring secure transmission and access controls for attestation endpoints, and sanitizing error information to avoid leaking internal details.
A PowerShell module that automates Microsoft Intune tenant setup by deploying 70+ security baselines, 43 dynamic groups, 24 device filters, compliance policies, app protection policies, and Conditional Access policies in a single command. Integrates OpenIntuneBaseline and supports multi-cloud environments.
A PowerShell module with UI for extending Microsoft Intune device management. Adds custom properties to Intune devices, enables bulk operations including device sync and BitLocker key rotation, with both PowerShell module and standalone UI interfaces.
A comprehensive PowerShell module for operating system deployment with 400+ functions for WinPE and Windows. Includes OSDCloud for cloud-based deployment, disk management, Windows image operations, driver management for Dell, HP, Lenovo, and Microsoft, BIOS/firmware updates, BitLocker management, and WinPE customization.
A PowerShell script that enrolls devices into Windows Autopilot using Azure App Registration credentials. Works without hybrid Azure AD join or SCCM, enabling unattended deployment via RMM tools. Uses community hardware hash collection module for reliable device registration.