XFA checks every device when someone signs in through your identity provider. People install the XFA app themselves, without admin rights, on personal and contractor laptops too, and fix what it finds.
Cisco Duo is a product for multi-factor authentication and access. Its Duo Desktop app checks a device against your policies when someone signs in.
Device health checks, such as OS version, disk encryption, and firewall, come with the Advantage edition and up. The Free and Essentials editions cover MFA only.
| XFA | Cisco Duo | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | YesOn computers, Cisco Duo needs the Duo Desktop app and the Duo Advantage or Premier plan for these checks |
| Jailbreak and root detection | Yes | Yes |
| Browser kept up to date | Yes | Yes |
| Active antimalware verified | Yes | YesOnly on Duo Premier, Cisco Duo's highest plan, through the Duo Desktop app |
| Last reboot check | Yes | No |
| BYOD | ||
| Works for company-owned devices | Yes | Yes |
| People install it themselves | Yes | NoDuo Desktop needs admin rights, so IT installs it. Few people want admin-level company software on their own device |
| Finds devices through SSO sign-ins, before anything is installed | Yes | Yes |
| Setup and admin | ||
| Admin dashboard | Yes | Yes |
| Self-serve setup, no IT rollout | Yes | No |
| Known vulnerabilities (CVEs) per device, from OS and browser versions | Yes | No |
| Warns users before they are blocked at sign-in | Yes | NoOnly for outdated OS and browser versions. Other failed checks block the sign-in first, then show how to fix it |
Details come from the Cisco Duo documentation, checked in October 2026. Sources: Duo Device Health (opens in a new tab).
Personal and contractor laptops get the same check at sign-in as company ones. The XFA app installs without admin rights and takes no control of the device.
XFA for personal and contractor devicesPeople install the XFA app at their next sign-in and fix issues themselves from the app. Nobody in IT has to roll it out.
How XFA worksYou connect your identity provider once. XFA then checks every device at sign-in, warns people before it blocks them, and sends invites and reminders by email, Slack, or Microsoft Teams.
“XFA has a user-friendly and straightforward process for onboarding people. Additionally, I value that it supports a bring-your-own-device policy, unlike many other tools out there, which are both costly and restrictive.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies story
Yes. XFA does not replace your MFA. Keep Cisco Duo for MFA, and XFA checks the device at every sign-in through your identity provider.
No. People install the XFA app themselves, without admin rights, on macOS, Windows, Linux, iOS, and Android.
Only if you set that check to block. In a policy you decide, per check, whether a failed check shows a warning or blocks the sign-in, and after how many days. Either way the person sees what to fix.
Compare plansNothing. XFA is free to start, with no cap on people. It runs four checks at every sign-in and comes with the Fix button.
Compare plansConnect your identity provider, then sign in on your own laptop and watch it get checked first.
