Welcome to Policy Pipelines
Your control plane for Windows policy is up and running. It normalizes Group Policy ADMX, Windows CSPs and Intune Settings Catalog configurations into one model — then automates cross-tenant policy migrations across your customers.
Illustrative demo — tenant names, device counts, key fingerprints & run numbers are sample values.
Initialize the Windows Hello vault
Register a passkey via navigator.credentials.create(). The WebAuthn PRF extension derives a 256-bit master key in-memory, then the SQLite schema and AES-256-GCM pipeline are provisioned to protect tenant tokens at rest.
Connect your tenants
Authenticate with an MSP / partner account to enumerate GDAP customer directories, or add standalone admin identities directly.
OAuth 2.0 + PKCE flow
A safe way to sign in with Microsoft without ever giving us your password. Think of it like handing over a hotel key card instead of the master key — the card only opens specific doors, expires on its own, and can be revoked at any time.
Authorization Code flow with Proof Key for Code Exchange (RFC 6749 + RFC 7636). The client generates a high-entropy code_verifier, sends code_challenge = BASE64URL(SHA-256(verifier)) to the multi-tenant /common authorize endpoint, then redeems the authorization code at /token where the IdP re-checks the verifier against the stored challenge. PKCE defeats authorization-code interception and replay, and /common defers tenant resolution until credentials are presented.
GDAP enumeration
As an IT partner, your customers have granted you limited, time-boxed access to look after their tenants. Once you sign in as the partner, we simply list every customer who has granted you access — no separate sign-in for each one.
Granular Delegated Admin Privileges — Microsoft's least-privilege partner delegation model. After partner authentication at /common, the backend queries Partner Center / Graph for the list of GDAP relationships, resolves each customer's tenantId, then acquires per-customer tokens scoped to the delegated directory roles (e.g. Intune Administrator) with explicit expiry boundaries.
Delegated API scope
A permission label that tells Microsoft exactly what this app may do — here: read and change device configuration policies (update rings, BitLocker, settings catalog). Nothing else. You approve each permission before anything happens.
A Microsoft Graph delegated permission. Grants read/write over deviceManagement configuration resources — settingsCatalog policies, configurationPolicies, compliance policies and group-policy configurations. Consented by an admin, honored per-tenant through GDAP role mapping, and enforced on every call via the token's scp claim.
No tenants connected yet
Start an OAuth 2.0 PKCE flow against /common/oauth2/v2.0/authorize. Partner accounts enumerate every delegated customer; standalone identities register a single environment.
Tenant details
GET /organizationOS breakdown
operatingSystemDevices
—| Device | Primary user | OS | Compliance | Management | Last sync |
|---|