Check every laptop, with or without MDM.

Some laptops are in your MDM. Contractor laptops are not, and some teams have no MDM at all. XFA checks every laptop against the same rules at sign-in, without enrolling it.

Start for free Talk to us

Free to start for your whole team: 4 device checks at every sign-in, and people are guided to fix issues themselves, automatically or by hand.

Working on a laptop at a high table in an open office

Signing into Project files

XFA is performing a device security check

Before accessing the application, we like to make sure your device is safe and compliant with your organization’s policy.

Your device is not compliantDevice is safe and compliant

Firefox should use HTTPS‑Only ModeFirefox uses HTTPS‑Only ModeResolve manuallyFixFixDone

XFA

Turn on HTTPS-Only Mode in Firefox?

XFA turns HTTPS-Only Mode on.

Not nowTurn on HTTPS-Only Mode

What the MDM sees,
and what signs in.

Today

Nobody wants to ask a contractor to enroll their own laptop.
A missed update on an unmanaged laptop goes unnoticed.
An auditor asks if every laptop is secure. You can only vouch for the ones in your MDM.

With XFA

The contractor installs the XFA app at sign-in. Nothing is enrolled.
The sign-in check shows it, and the laptop’s owner fixes it with the Fix button.
Every laptop that signs in is checked, and the dashboard shows your auditor where each one stands.

One checkpoint,
enrolled or not.

Your MDM keeps managing what it manages. You write one set of rules and choose, per check, whether a failing laptop gets a warning or is blocked. Every laptop meets those rules when someone signs in to a work app.

Sign-in is the checkpoint.XFA connects to your identity provider. The check runs every time someone signs in to a work app, whether the laptop is in an MDM or not.Nothing is pushed to the laptop. The XFA app shows what is off. The owner presses the Fix button and approves the change, or follows a step by step guide.Nothing changes without their OK.XFA finds the laptops in your sign-in logs that never set up the app, and can invite their owners automatically. Reminders and risk alerts go out by email, Slack, or Microsoft Teams.How XFA works

The owner fixes it, not the MDM.

XFA finds the laptops the MDM never saw.

files.halden.example

Project filesHalden

DrawingsSitesReportsShared

Drawings

Managed or not,
the same check.

Three laptops sign in to your work apps. One is in your MDM, two are not. Each has the XFA app, so the same four checks run on all three at sign-in.

Your device policy

One set of rules for all three, checked at every sign-in.

In your MDM
MacBook Pro
macOS, company issued
XFA app installed
4 of 4 checks pass
- Operating system up to date: meets the rule
- Disk encryption on: meets the rule
- Screen lock on: meets the rule
- Antimalware protection on: meets the rule
At sign-in: Signed in
Not in an MDM
ThinkPad X1 Carbon
Windows 11, the contractor’s own
XFA app installed
4 of 4 checks pass
- Operating system up to date: meets the rule
- Disk encryption on: meets the rule
- Screen lock on: meets the rule
- Antimalware protection on: meets the rule
At sign-in: Signed in
Not in an MDM
MacBook Air
macOS, company owned, bought before the MDM
XFA app installed
- Operating system up to date: needs attention
- Disk encryption on: meets the rule
- Screen lock on: meets the rule
- Antimalware protection on: meets the rule
At sign-in: Missed an update. Its owner installed it, then signed in.

Nobody enrolled the MacBook Air in an MDM. The sign-in check still caught the missed update, and its owner installed it.

How the rest
of the fleet joins.

Connect the identity provider you use.
XFA checks devices at sign-in, through the identity provider your team already uses. Your MDM stays as it is.
The first unknown laptop signs in.
Its owner is asked to install the XFA app. Installing it takes about a minute, without admin rights.
Company laptops, if you like.
They need no extra step and get the app at sign-in, or through your MDM if you prefer. With every laptop checked, some teams find they need less from their MDM.
Then the ones nobody saw.
Connect your sign-in logs. XFA looks back 30 days, keeps looking for new laptops, and can invite their owners.

**Stephane Jans**CTO and CPO, DnergyRead the Dnergy story

**Stephane Jans**CTO and CPO, DnergyRead the Dnergy story

Questions about running beside an MDM

Compare plans

Working on a personal laptop at the kitchen table

Is XFA for us?

It is if your team signs in through an identity provider and some laptops are outside an MDM, or you have no MDM and want to keep it that way. XFA takes no control of a laptop, so it cannot wipe or lock one remotely. If you need that, you need an MDM.

XFA for teams in larger companies

We already have an MDM. Does XFA replace it?

It can. Every laptop is checked at sign-in, enrolled or not. If you keep the MDM for company laptops, XFA covers the rest. If you no longer need the MDM’s management features, XFA runs the security check without it.

XFA compared with an MDM

Is XFA a unified endpoint management (UEM) tool?

It covers the security side of it. XFA holds every device, inside and outside your MDM, to one set of rules at sign-in, and shows them all in one dashboard. It does not enroll, configure, or wipe devices.

How do laptops outside the MDM get set up?

Their owners set it up at the first sign-in from that laptop. The XFA app installs in about a minute without admin rights, so a contractor can do it without asking anyone.

What about laptops that signed in last month and never joined?

They are in your sign-in logs. Connect those logs and XFA finds the laptops from the last 30 days. After that, it keeps looking for new ones and can invite their owners automatically.

What does XFA see on a contractor’s laptop?

Its security settings, such as the operating system version, disk encryption, and screen lock. XFA does not collect files, messages, or browsing history. The contractor sees the same results in their own XFA app.

Personal and contractor laptops