public static bool CanUpdateUntrustEnrol(this Device d) { if (!UserService.CurrentAuthorization.Has(Claims.Device.Actions.AllowUnauthenticatedEnrol)) return false; return !d.IsDecommissioned() && d.AllowUnauthenticatedEnrol; }