XFA checks every device when someone signs in through your identity provider. People install the app themselves without admin rights, so personal and contractor devices get checked too.
1Password Device Trust checks devices. It used to be Kolide. 1Password now sells it as part of its platform, next to the password manager.
An agent on each computer runs more than 125 prebuilt checks, and admins can write their own in osquery SQL. Mobile apps for iOS and Android run a smaller set of checks.
When a device fails a check, the person is warned first and can then be blocked. One edition does this at single sign-on, through Okta, Microsoft Entra ID, or Google Workspace. The other does it through the password manager's browser extension.
| XFA | 1Password1Password Device Trust, formerly Kolide | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | Yes |
| Jailbreak and root detection | Yes | Yes |
| Browser kept up to date | Yes | Yes |
| Active antimalware verified | Yes | Yes |
| Last reboot check | Yes | Yes |
| BYOD | ||
| Works for company-owned devices | Yes | Yes |
| People install it themselves | Yes | YesPeople have to give it admin rights on their own device |
| Installs without admin rights on the device | Yes | NoThe agent needs admin rights to install |
| Finds devices through SSO sign-ins, before anything is installed | Yes | NoA device is listed only once the agent or mobile app is installed on it |
| Setup and admin | ||
| Admin dashboard | Yes | Yes |
| Known vulnerabilities (CVEs) per device, from OS and browser versions | Yes | No1Password checks that the OS and browsers are up to date, without listing CVEs per device |
| Warns users before they are blocked at sign-in | Yes | Yes |
| Ecosystem | ||
| Works with your identity provider (SSO) | Yes | Okta, Entra ID, and Google |
| Standalone product, not part of a platform | Yes | NoPart of the 1Password platform |
1Password details from 1Password's product page and support documentation, checked 5 October 2026. Sources: Product page (opens in a new tab); Getting started (opens in a new tab).
People install the XFA app themselves at sign-in, without admin rights. Personal and contractor devices get the same checks as company machines, and nobody has to file an IT ticket.
XFA for personal and contractor laptopsXFA reads the sign-in logs of Microsoft 365, Google Workspace, or Okta and lists the devices people sign in from, also the ones without the XFA app. You can invite their owners from the dashboard.
XFA emails people what to fix before they are blocked at sign-in. They fix it themselves from the XFA app, without a ticket to IT.
How XFA works“XFA has a user-friendly and straightforward process for onboarding people. Additionally, I value that it supports a bring-your-own-device policy, unlike many other tools out there, which are both costly and restrictive.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies story
Yes. XFA does not depend on a password manager. Keep 1Password for passwords. XFA connects to your identity provider and checks devices at sign-in. It can also check that a password manager is installed, and the dashboard shows which one, 1Password included.
No. People install the XFA app themselves, without admin rights, on macOS, Windows, Linux, iOS, and Android. The app checks the device and takes no control of it.
Yes. 1Password lists more than 125 prebuilt checks, and admins can write their own for desktop devices. XFA starts with four checks and goes up to 34. Those include checks for developer laptops, such as secrets in environment variables and AI agents running on their own.
Yes, if you turn blocking on. You choose per check whether a failed check warns or blocks. With a warning, people can still sign in while they fix it. A block stops sign-in until the device is fixed.
Compare plansGoogle Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. You add XFA to yours as an MFA method or as an external identity provider, whichever it uses. You can also add the check to a single app over SAML or OpenID Connect (OAuth 2.0).
Nothing. Start for free and XFA checks every device at sign-in, for your whole team.
Start for free, connect your identity provider, and see that laptop checked at its next sign-in.
