How to attestation for verify pc security boot,... by using TPM Azure Attestation in C# Project

Hello @PThanh ,

Thanks for your question.

You can’t directly verify Secure Boot from C# by calling Azure Attestation alone. Azure Attestation only works if your app can first collect TPM attestation evidence from the PC (a TPM quote + measured boot log). Then Azure Attestation checks that evidence against a policy and returns a signed result token.

You can refer to the following flow:

1. PC creates “proof” The PC (Windows + TPM) creates proof that includes:

• TPM quote (signed by TPM)
• PCR values (numbers that represent boot measurements)
• Measured Boot Log / Event Log (what was measured during boot)

2. Send proof to Azure Attestation Your C# app sends that proof to your Azure Attestation Provider endpoint.
3. Azure Attestation returns a result Azure returns an attestation token (JWT) that is signed by Azure. Your app verifies the JWT and checks the claims

I hope this addresses your question. If this response was helpful, please consider following the guidance to provide feedback.

The context only documents the high-level TPM attestation workflow and policy behavior, not the exact JSON payload format, nonce handling, or quote/signature encoding required by the Azure Attestation TPM protocol. It does not describe the request schema for AttestTpmAsync, nor how to construct the quote, signature, nonce, and service_context fields for the second call, so the root cause of the 400 invalid data field error cannot be determined or corrected from the available information.

References:

• Trusted Platform Module attestation
• Workflow
• Examples of an attestation policy for TPM endpoint
• Using Trusted Platform Module (TPM)/Virtualization-Based Security (VBS) attestation
• Azure Attestation client library for .NET - version 1.0.0
• Attestation policy version 1.2