Design principles
Highwind for organizations runs entirely in your environment. It adds no service that Highwind operates, and endpoints hold no secrets.
- Endpoints only make outbound HTTPS connections. Nothing connects in to a device.
- Every caller is authenticated with Entra ID or a device certificate that your service issued.
- Services use managed identities for Azure resources, not keys or connection strings.
- Devices answer only a fixed set of read-only questions. There is no remote command or script execution.
No secrets on endpoints
Endpoints store no storage keys, connection strings, client secrets or shared certificates.
- Client reporting uploads with the signed-in user's Entra ID token, obtained silently from the device's primary refresh token.
- Central management devices prove their identity with the key Entra ID issued at join, then receive a device certificate whose private key stays in the TPM. A copied credential cannot speak for another device.
- The Highwind configuration report from a device masks any value that looks like a secret.
Authentication model
| Caller | Authenticates with | Authorized by |
|---|---|---|
| Endpoint uploading a report | User's Entra ID token for the Function App's app registration | Function App authentication (Easy Auth) and, optionally, Conditional Access on device compliance |
| Fleet Agent | Device certificate issued by your Management API, or an Entra ID token for the Highwind.Agent role | The API, per tenant. Disabled or revoked devices are refused on their next request |
| Administrator or analyst | Entra ID sign-in to the portal, which calls the API with a delegated token | App roles Highwind.Operator and Highwind.Admin, narrowed by Access assignments per device tag |
Apply Conditional Access to the portal and API registrations. Analysts and administrators are the accounts an attacker is most likely to target.
Managed identity
- The reporting Function App writes to Table Storage with a system-assigned managed identity holding Storage Table Data Contributor on the storage account. Endpoints need no storage permissions.
- The Management API connects to Azure SQL as a database user mapped to its managed identity, and uses its managed identity for the Key Vault key that signs device certificates.
- The Management Portal holds no database connection and no identity of its own for data access.
Data ownership
- Reports, posture, audit records and App Control data are stored only in resources in your subscription or data center. You control retention, backup and access.
- Highwind does not receive telemetry from your deployment. The Fleet license is verified offline with a public key, with no activation service and no phone-home.
- Optional AI features send data to a model only when a tenant setting allows it and an administrator approves an egress grant. See the Privacy Policy.
Tenant isolation
The Management API serves one or more tenants from the same database and keeps them apart in every request.
- The tenant comes from the caller's token or certificate, never from the request body. A body that names a tenant or device is rejected with
400 HW-REQUEST-006. - A device in another tenant returns
404, so the API does not confirm that it exists. - Requests carry a nonce and timestamp, and heartbeat sequence numbers must increase, so captured requests cannot be replayed.
The full list of service protections is in Central management architecture and Protecting the service.
Guardrails and security boundaries
Client policy settings such as ForceReadOnlyMode, DisableExportButtons and the page visibility settings are guardrails. They prevent mistakes and configuration drift by people doing their jobs. They are not a security boundary: a local administrator can still run the underlying Windows commands. The client's audit ledger records changes made through Highwind.
The security boundaries are Entra ID authentication, the app roles and Access assignments on the Management API, and the fixed set of read-only operations the Fleet Agent accepts.