“I have tried a lot of MDM solutions over the past week, and none of them felt right. All of them seemed intrusive and too complex to roll out.”
Aljoša KlišanićCEO, Stratus Add-onsRead the Stratus Add-ons storyAn MDM alternative with nothing to enroll
XFA checks each device at sign-in, on the laptops your team uses, and takes no control of them. This page compares that with Intune, Jamf, JumpCloud, and Iru, and says when an MDM fits better.
When an MDM is the right tool
An MDM manages the devices IT enrolls, usually the ones the company owns. IT pushes apps, settings, and updates to each one, and can wipe it remotely.
If the company buys every laptop, someone on the team runs the MDM and you want that control, an MDM is the right tool. XFA can run beside it.
When XFA is the better fit
- Your team works on the laptops they already have, company issued or personal, and nobody’s job is IT. Contractors rarely put their own laptop in your MDM.
- XFA checks each device when someone signs in. If something needs fixing, the person fixes it themselves, with the Fix button or a step by step guide. The app installs without admin rights and takes no control of the device.
Four MDMs and XFA, at a glance
Each row is one MDM. It shows what the MDM is built for, whether it checks unmanaged laptops at sign-in, and where XFA fits, with a link to the full comparison.
| Built for | Checks unmanaged laptops at sign-in | Where XFA fits | |
|---|---|---|---|
| Compared one on one | |||
| Microsoft IntuneWith Conditional Access in Entra IDXFA and Intune compared | Company devices in a Microsoft 365 and Entra ID setup | NoRefused, not checkedConditional Access refuses it, or covers Microsoft apps only through app protection | Keep Intune for the laptops you own. XFA checks every device at sign-in through Entra ID, personal ones included. |
| JamfXFA and Jamf compared | Company owned Macs, iPhones, and iPads | NoEnrolled Apple devices onlyYour identity provider decides, from what Jamf reports on the Apple devices it manages. Windows and Linux laptops are out of scope | Keep Jamf for your Macs. XFA checks the rest too, on macOS, Windows, Linux, iOS, and Android. |
| JumpCloudXFA and JumpCloud compared | One cloud directory for users, access, and devices | YesA few settingsOperating system version and disk encryption, plus firewall status in preview, through a managed Chrome browser | XFA checks every laptop at sign-in through Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, or Keycloak. People install it themselves without admin rights, and no admin has to link each device to its owner. |
| IruFormerly KandjiXFA and Iru compared | Devices IT enrolls, with identity and compliance in the same platform | NoOnly devices it managesWith Okta or Entra ID, sign-in checks whether Iru manages the device, documented for Apple devices only | Keep Iru for the devices IT enrolls. XFA checks personal and contractor laptops at sign-in too, Linux included, with nothing to enroll. |
| MDMs in generalXFA and MDM compared | Devices the company buys, enrolls, and manages | NoOnly once enrolledEnrolling hands IT management rights | XFA checks the device at every sign-in and leaves it in the owner’s hands. |
Intune, Jamf, JumpCloud, and Iru details from each vendor’s documentation, as cited on the one on one comparisons linked in each row, checked 5 October 2026. The MDMs in general row describes MDM as a category. Sources: XFA and Intune compared; XFA and Jamf compared; XFA and JumpCloud compared; XFA and Iru compared.
Three ways teams run it
XFA instead of an MDM
For a team on its own laptops with nobody in IT. Connect your identity provider and every device is checked at sign-in. You can also make a laptop that fails wait until it is fixed.
XFA next to your MDM
Keep the MDM for the laptops you own. XFA checks every device that signs in, including the personal and contractor laptops the MDM never sees.
An MDM later, if you need one
Start with XFA now. If you buy company laptops and hire IT one day, add an MDM for those laptops. XFA keeps checking at sign-in either way. People fix what XFA finds themselves, so you do not need IT to start.
Aljoša KlišanićCEO, Stratus Add-onsRead the Stratus Add-ons storyQuestions about XFA and MDMs
Is XFA an MDM?
No. An MDM enrolls a device and manages it. XFA checks a device’s security settings when someone signs in, and takes no control of it. People install the XFA app themselves, without admin rights.
How XFA worksWhat can XFA see on a personal laptop?
Its security settings, such as the operating system version, disk encryption, screen lock, and antimalware. XFA does not collect private messages or emails, personal files, browsing history, screen recordings or screenshots, passwords, or location data.
How XFA handles privacyWhich MDM comparison should I read?
The one for the MDM you use. Each row in the table above links to its comparison. If you have no MDM yet, start with XFA and MDM compared.
XFA and MDM comparedOur MDM can already refuse devices at sign-in. Why add XFA?
An MDM can only judge the devices it manages, so a personal or contractor laptop that is not enrolled is usually refused at sign-in without being checked. XFA checks that laptop as it is, with nothing to enroll.
Can XFA stop a laptop that fails a check?
Yes, if you set a check to block. You choose per check: a warning lets the person sign in while they fix it, and a block keeps them out until the device is fixed. You also set how many days they get first.
Compare plansWhat does XFA check on a device?
Four checks from the start: the operating system version, disk encryption, screen lock, and antimalware. The paid plans add more.
Which identity providers does XFA work with?
Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. You add XFA to yours as an MFA method or as an external identity provider, whichever it uses. You can also add the check to a single app over SAML or OpenID Connect (OAuth 2.0).
See the integrationsWhat does XFA cost next to an MDM?
Nothing to start. XFA is free with no cap on people, with four checks at every sign-in, and the Fix button. There is nothing to enroll and no one to hire to run it. The pricing page shows what each paid plan adds.
Compare plansHow do people fix an issue XFA finds?
At sign-in, or from the XFA app on their own device. Where the check has a Fix button, XFA makes the change for them. Otherwise a step by step guide shows how.
Does XFA work with the MFA we already have?
Yes. XFA works with your identity provider and the MFA it already uses. If you want more, Built-in Passkey adds phishing-resistant MFA that the XFA app answers on the device, with no code to type.
No rollout. Just a setup.
Device security used to mean a project. With XFA it means connecting your identity provider and picking your checks.
Rolling out an MDM
- Choose and buy a device management tool
- Enroll every company device
- Ask people to hand over control of their laptop
- Personal and contractor devices only if their owners enroll them
- Push settings and keep them running
Starting with XFA
- Connect your identity provider
- Pick your device checks
- People install the app at sign-in, in about a minute
- Personal and contractor devices included
- Every device checked, none taken over