XFA checks every device at sign-in through the identity provider you already use. The app installs without admin rights and takes no control, so personal and contractor laptops are checked too.
JumpCloud is a cloud directory with device management built in. It runs users, devices, and access from one console. To check a device, JumpCloud needs it enrolled through its MDM agent.
It manages macOS, Windows, and Linux computers, and iOS and Android phones. JumpCloud's conditional access works on network conditions. XFA checks the device itself at sign-in.
| XFA | JumpCloud | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | Yes |
| Jailbreak and root detection | Yes | Yes |
| Browser version is up to date | Yes | No |
| Antimalware is switched on | Yes | NoJumpCloud can only read CrowdStrike Falcon status, through a separate EDR integration and as a premium conditional access condition |
| Recent reboot check | Yes | No |
| BYOD | ||
| Works for company-owned devices | Yes | Yes |
| Built for people to install themselves | Yes | NoPeople can install the JumpCloud agent, which runs with system-level privileges, but it only starts working once an admin binds the person to that device |
| Never takes control of the device | Yes | No |
| Finds devices through sign-in logs, before anything is installed | Yes | No |
| Setup and admin | ||
| One admin dashboard | Yes | Yes |
| Set up yourself, no IT rollout | Yes | NoAn admin binds each person to each laptop in the Admin Portal before the agent manages it, and again for every new or replaced laptop |
| Known vulnerabilities per device, from OS and browser versions | Yes | No |
| Warns people before they are blocked at sign-in | Yes | No |
| Ecosystem | ||
| Works with your identity provider for single sign-on | Yes | Only JumpCloud SSO |
| Keeps your current identity provider, no migration | Yes | NoJumpCloud's device checks only work once your users and apps move to JumpCloud |
JumpCloud details from JumpCloud's documentation, checked October 2026. Sources: JumpCloud device management (opens in a new tab).
A freelancer's own laptop gets the same check at sign-in as a company one. There is nothing to enroll. The XFA app installs without admin rights and takes no control of the laptop.
XFA for personal and contractor devicesXFA connects to Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. Your directory stays where it is.
See the integrationsXFA checks security settings and does not collect personal files, messages, or browsing history. Nothing changes without their OK.
“XFA has a user-friendly and straightforward process for onboarding people. Additionally, I value that it supports a bring-your-own-device policy, unlike many other tools out there, which are both costly and restrictive.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies story
Yes. JumpCloud can keep managing the company devices it has enrolled. XFA checks every device at sign-in through Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, or Keycloak, including the personal and contractor laptops JumpCloud does not reach.
No. The XFA app checks security settings. It does not collect personal files, messages, or browsing history. Nothing changes without the person’s OK.
Only if you choose to. For each check, you decide whether a device that fails it gets a warning or is blocked at sign-in, and after how many days. Either way, the person sees what to fix.
Nothing. XFA is free to start, with no cap on people. It checks the operating system version, disk encryption, screen lock, and antimalware at every sign-in, and the Fix button is included. The pricing page shows what the paid plans add.
Compare plansDevice security used to mean a project. With XFA it means connecting your identity provider and picking your checks.
Starting with XFA