Beyond Identity signs people in with keys bound to their devices. XFA checks each device at sign-in, personal and contractor laptops included, with nothing enrolled. People fix what it finds from the XFA app.
Beyond Identity is a passwordless sign-in platform. Instead of passwords, it uses cryptographic keys bound to each device, and it checks the device during sign-in.
Its focus is phishing-resistant authentication. The device checks rely on certificates installed on managed devices.
| XFA | Beyond Identity | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | Yes |
| Jailbreak and root detection | Yes | Yes |
| Browser kept up to date | Yes | No |
| Antimalware is running | Yes | Yes |
| Last reboot check | Yes | No |
| Personal devices (BYOD) | ||
| Works for company-owned devices | Yes | Yes |
| People install it themselves | Yes | NoRequires certificate enrollment |
| Finds devices through SSO sign-ins, before anything is installed | Yes | No |
| Setup and admin | ||
| Admin dashboard | Yes | Yes |
| Set up without an IT rollout | Yes | No |
| Known vulnerabilities (CVEs) per device, from OS and browser versions | Yes | No |
| Warns people before they are blocked at sign-in | Yes | No |
| Ecosystem | ||
| Works with your identity provider (SSO) | Yes | Yes |
| Keep your current identity provider | Yes | No |
New people install the XFA app at their first sign-in, without admin rights or a certificate to enroll. Nobody in IT has to prepare their laptop first.
How XFA worksCompany laptops, personal ones, and a contractor's get the same check at sign-in, with no enrollment or management profile. XFA takes no control of the device and does not collect personal files, messages, or browsing history.
XFA for personal and contractor devicesAt sign-in, XFA shows people what is wrong and how to fix it, with a Fix button or a step by step guide. With a warning set, they still get in while they fix it.
“XFA has a user-friendly and straightforward process for onboarding people. Additionally, I value that it supports a bring-your-own-device policy, unlike many other tools out there, which are both costly and restrictive.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies story
Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. You add XFA to yours as an MFA method or as an external identity provider, whichever it uses. You can also add the check to a single app over SAML or OpenID Connect (OAuth 2.0). You keep the one you have, with nothing to migrate.
No. People install the XFA app themselves, without admin rights. It runs on macOS, Windows, Linux, iOS, and Android.
Only if you set it to. Each check in your policy warns or blocks, and you choose after how many days. With a warning, people see what is wrong at sign-in and still get in while they fix it.
Compare plansNothing. XFA is free to start, with no cap on people. Every device is checked at sign-in for its operating system version, disk encryption, screen lock, and antimalware.
Compare plansConnect your identity provider. Each device is checked the next time its owner signs in.
