Assign ownership for Device Health Attestation reports

Source facts

Microsoft documents an on-premises Device Health Attestation server role beginning with Windows Server 2016. The DHA service validates a device’s TPM and PCR logs and issues an attestation report. The cloud-service description explains that the report represents how the device started, using TPM-protected data, and is delivered to the requesting MDM server over a protected channel. Microsoft documentation.

Applicability

Use this review when evaluating a DHA reporting arrangement. Identify whether the proposed service is hosted locally or in the cloud, the requesting management system, and the applicable device requirements in the current source.

DSE recommendation

Define who operates the attestation service and who decides what a returned report means for device access. Write down the fields that matter to that decision and how a missing report will be handled. Keep the device identity and report time with each reviewed result. Obtain a separate policy decision before turning an observed attestation result into an access restriction.

Verification

Use an approved test device to follow a request through report receipt and administrative review. Check that the report belongs to the intended device and observation. Exercise the agreed missing-report handling and record the outcome. Retain any uncertainty about the service configuration or interpretation for the responsible management-system owner.

Official references

Microsoft Learn: Device Health Attestation. Source reviewed September 8, 2026.