Mastering App Control for Business#

flowchart LR
    subgraph REPO["Azure DevOps Repository"]
        direction TB
        XML[Policies/unsigned_original/\nBase_*.xml\nSupplemental_*.xml]
        CERT[Certs/\norg-code-sign.cer]
        PS[Publish-ACFBPolicy.ps1]
        YML[ACFB-Build-Pipeline.yml]
    end
    subgraph PIPELINE["Azure DevOps Pipeline"]
        direction TB
        T1[Task 1: Get Graph Token\nOIDC via service connection]
        T2[Task 2: Sign + Upload\nPublish-ACFBPolicy.ps1]
        T3[Task 3: Commit signed output\nback to repo]
        T1 --> T2 --> T3
    end
    subgraph INTUNE["Microsoft Intune"]
        direction TB
        POL[ACfB Configuration Policy\nCreated / Updated]
        DEV[Enrolled Devices\nPolicy applied]
        POL --> DEV
    end
    XML & CERT --> PIPELINE
    PIPELINE -->|Graph API PUT/POST| INTUNE
    T3 --> REPO
    style REPO fill:#1e3a5f,color:#93c5fd,stroke:#2563eb
    style PIPELINE fill:#162032,color:#58a6ff,stroke:#2563eb
    style INTUNE fill:#14532d,color:#86efac,stroke:#16a34a

flowchart TD
    ROOT[repo-root/] --> SCRIPT[Publish-ACFBPolicy.ps1]
    ROOT --> YML[ACFB-Build-Pipeline.yml]
    ROOT --> README[README.md]
    ROOT --> CERTS[Certs/]
    ROOT --> POLICIES[Policies/]
    CERTS --> CERT1[org-code-sign.cer]
    POLICIES --> UNSIGNED[unsigned_original/]
    POLICIES --> SIGNED[signed/\nauto-populated by pipeline]
    UNSIGNED --> BASE[Base_MyBigBusiness.xml\nBase_*.xml]
    UNSIGNED --> SUPP[Supplemental_Allow_Vendors.xml\nSupplemental_*.xml]
    style ROOT fill:#162032,color:#58a6ff
    style SIGNED fill:#14532d,color:#86efac
    style CERT1 fill:#1a0a2e,color:#c4b5fd

flowchart TD
    TRIGGER[Trigger:\nPush to main branch\nPolicies/unsigned_original/**] --> S1
    subgraph S1["Stage 1: Get Token"]
        AZ[AzureCLI@2 Task\naz account get-access-token\n--resource-type ms-graph]
        TOKEN[Secret pipeline variable\n$secret — masked in logs]
        AZ --> TOKEN
    end
    S1 --> S2
    subgraph S2["Stage 2: Build & Publish"]
        PS[PowerShell@2 Task\nPublish-ACFBPolicy.ps1]
        SIGN[Add-SignerRule\nSign XML with cert]
        VER[Compare VersionEx\nLocal vs Intune]
        UPLOAD[Graph API\nPOST or PUT policy]
        PS --> SIGN --> VER --> UPLOAD
    end
    S2 --> S3
    subgraph S3["Stage 3: Commit Signed"]
        GIT[git add Policies/signed\ngit commit skip ci\ngit push]
    end
    style TRIGGER fill:#1e3a5f,color:#93c5fd
    style S1 fill:#162032,color:#58a6ff
    style S2 fill:#14532d,color:#86efac
    style S3 fill:#1e3a5f,color:#93c5fd

sequenceDiagram
    participant DEV as Security Engineer
    participant GIT as Git Repository
    participant ADO as Azure DevOps Pipeline
    participant INTUNE as Microsoft Intune
    participant DEVICE as Enrolled Devices

    DEV->>GIT: Edit Base_Policy.xml\nIncrement VersionEx 10.0.5.1 → 10.0.5.2
    DEV->>GIT: git commit + git push → main
    GIT->>ADO: Trigger pipeline\n(path filter: Policies/unsigned_original/**)
    ADO->>ADO: Task 1: Get OIDC token
    ADO->>ADO: Task 2: Sign + compare versions
    Note over ADO: Local 10.0.5.2 > Remote 10.0.5.1
    ADO->>INTUNE: PUT configurationPolicy\nwith signed XML payload
    INTUNE-->>ADO: 200 OK — Updated
    ADO->>GIT: Commit signed XML\nto Policies/signed/ [skip ci]
    INTUNE->>DEVICE: Policy sync on next\ncheckin (8 hours or manual)
    DEVICE->>DEVICE: Apply updated\nACfB policy
    Note over DEVICE: New rules enforced\nEvent 3099 logged

flowchart TD
    MAINTAIN[Ongoing Policy Maintenance] --> MON[Monitor Event Logs\nEvent 3077 — actual blocks]
    MON --> REVIEW{Legitimate\napp blocked?}
    REVIEW -->|Yes| RULE[Add allow rule to\nSupplemental or Base policy]
    REVIEW -->|No — expected| LOG[Log + document\nthe block]
    RULE --> VER[Increment VersionEx]
    VER --> COMMIT[Commit to repo]
    COMMIT --> PIPELINE[Pipeline triggers\nautomatically]
    PIPELINE --> INTUNE[Policy updated in Intune]
    INTUNE --> DEVICES[Devices receive\nnew policy]
    DEVICES --> MON
    style MAINTAIN fill:#1e3a5f,color:#93c5fd
    style PIPELINE fill:#162032,color:#58a6ff
    style DEVICES fill:#14532d,color:#86efac