XFA checks every device used for work each time someone signs in. Nothing is enrolled and nobody takes control of it. That covers company, personal, and contractor devices on any operating system.
An MDM (mobile device management) lets an IT team manage devices from one place. Each device is enrolled first. From then on, IT pushes apps, settings, and updates to it, and can lock or wipe it remotely.
Intune, Jamf, JumpCloud, and Iru are common examples. An MDM suits laptops the company owns, with someone whose job it is to run it.
| XFA | MDM | |
|---|---|---|
| Security Checks | ||
| Set up in minutes (no IT rollout) | Yes | No |
| Blocks non-compliant devices at sign-in | Yes | NoOnly together with conditional access |
| Made for self-install | Yes | No |
| Device and User Support | ||
| Works for contractor devices and BYOD | Yes | NoAn MDM takes full control of the device, so contractors and employees often refuse to enroll their own devices for privacy reasons |
| Never takes control of the device | Yes | NoEnrolling a device in an MDM gives IT management rights over it, including remotely wiping company data or the whole device |
| Discovers every device through SSO, no app installed | Yes | NoAn MDM only sees enrolled devices, so personal devices used for work stay invisible |
| Ecosystem | ||
| Supports any operating system | Yes | NoMost MDMs focus on one platform family and often do not support Linux and mobile devices |
| No identity provider migration needed | Yes | NoBlocking devices at sign-in usually depends on the MDM vendor's own identity platform, such as Microsoft Entra ID for Intune |
The MDM column describes MDM as a category. Every product differs, so check the one you are weighing. Sources: Intune device compliance (opens in a new tab); Jamf platforms (opens in a new tab); Iru platforms (opens in a new tab).
People install the XFA app themselves at their next sign-in, without admin rights. When a check fails, they fix it from the app, and nobody from IT has to touch the laptop.
How XFA worksXFA checks personal and contractor devices at sign-in too, and never takes control of them. Nothing changes without their OK.
The XFA app runs on macOS, Windows, Linux, iOS, and Android. It works with Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak, so one tool checks every device.
See the integrations“We have contractors who work on personal devices, which means we cannot install full-blown device management and control their devices because it's a kind of privacy invasion. XFA is great for hybrid teams like ours.”
Alex UlyanovHead of Security, Gateway.fmRead the Gateway.fm story
Not to check them. XFA checks each device at sign-in, and people fix issues themselves from the XFA app. You need an MDM when you want to configure company laptops from one place, install software on them, or wipe them remotely. That is a different job.
Yes. Keep the MDM on your company laptops. XFA checks every device at sign-in, including the personal and contractor laptops your MDM does not reach.
Yes. Push the XFA app from Intune, Jamf Pro, or Configuration Manager with an enrollment token, and each device links itself to your organization. Ask us to turn this on first.
How to roll out XFA with an MDM (opens in a new tab)No. People install the XFA app themselves, without admin rights. It checks security settings. It does not collect private messages or emails, personal files, browsing history, or location data. Nothing changes without their OK.
Yes. In a policy, you choose per check whether a failing device gets a warning or is blocked. A blocked device cannot sign in until the person fixes it, and XFA shows them how.
XFA can require an encrypted disk and a screen lock before a laptop reaches work apps. Whoever finds a locked, encrypted laptop cannot read its disk without the password. Revoke the person's sessions in your identity provider, and access to company data ends there.
Neither names a tool. Auditors ask for evidence that devices are encrypted, locked, and up to date. XFA checks those at every sign-in, and you can send the results to Vanta, Drata, Thoropass, or TrustCloud.
See the integrationsNothing. XFA is free to start, with no cap on people. Every device gets four checks at each sign-in, for operating system version, disk encryption, screen lock, and antimalware.
Compare plansDevice security used to mean a project. With XFA it means connecting your identity provider and picking your checks.
Starting with XFA