“It's user-friendly and straightforward for onboarding.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies storyDevice checks without enrolling in Okta Verify
XFA checks each device when someone signs in through Okta. Nothing is enrolled and no MDM is needed. People fix what it finds from the XFA app, and their device stays theirs.
What is Okta Device Assurance?
Device Assurance is part of Okta Identity Engine. An admin sets rules for a device, such as a minimum operating system version, disk encryption, or a screen lock, and adds them to Okta's app sign-in policies.
The device is checked through Okta Verify, Chrome Enterprise or both. Custom checks need devices enrolled in an MDM and an Okta Device Access subscription.
What XFA does
- XFA connects to Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, or Keycloak. It checks the device every time someone signs in.
- If something is off, the person fixes it from the XFA app.
- New people install the app themselves at their first sign-in, without admin rights.
XFA vs Okta, feature by feature
| XFA | Okta Device Assurance | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | Yes |
| Jailbreak and root detection | Yes | Yes |
| Browser kept up to date | Yes | No |
| Active antimalware verified | Yes | NoOkta can read antimalware status on Windows through an endpoint security integration, which you deploy and maintain separately |
| Last reboot check | Yes | No |
| BYOD | ||
| Works for company-owned devices | Yes | Yes |
| People install it themselves | Yes | NoThe device has to be enrolled in Okta Verify before Okta can check it |
| Finds devices through SSO sign-ins, before anything is installed | Yes | No |
| Setup and admin | ||
| Admin dashboard | Yes | Yes |
| Self-serve setup, no IT rollout | Yes | No |
| Known vulnerabilities (CVEs) per device, from OS and browser versions | Yes | No |
| Warns users before they are blocked at sign-in | Yes | No |
| Ecosystem | ||
| Works with your identity provider (SSO) | Yes | Only Okta |
| No identity provider migration needed | Yes | NoDevice Assurance is part of Okta, so it needs Okta as your identity provider |
Okta details from Okta's help centre and developer documentation, checked October 2026. Sources: Add a device assurance policy (opens in a new tab); Okta posture checks and remediation (opens in a new tab).
Why teams switch from Okta Device Assurance
People install it themselves
People install the XFA app at their next sign-in, without admin rights. From then on the device is checked at every sign-in, and nobody in IT rolls anything out.
How XFA worksNot tied to Okta
XFA connects to Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. If an acquisition brings a second directory, its people are checked too, with nothing to migrate.
See the integrationsPersonal laptops too
Personal and contractor laptops get the same check at sign-in as company ones. XFA takes no control of the device and does not collect personal files, messages, or browsing history.
XFA for personal and contractor devices
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies storyQuestions about XFA and Okta
Do we have to leave Okta to use XFA?
No. XFA connects to Okta and checks the device on the sign-ins that go through it. Your users, groups, and apps stay in Okta.
Can we keep Okta Device Assurance and add XFA?
Yes. Both work on Okta sign-ins and neither depends on the other. If you keep both, set each rule in one place only, so people are never asked to fix the same thing twice.
Does XFA block people from the first day?
Only if you set it to. Each check warns or blocks, and you choose after how many days. With a warning, people see what is wrong at sign-in and still get in while they fix it.
Which checks does XFA run?
Four to start with: the operating system version, disk encryption, screen lock, and antimalware protection. You can add more as you grow, up to 34.
Do people need admin rights to install the XFA app?
No. People install it themselves on macOS, Windows, Linux, iOS, or Android, and the app takes no control of the device.
What does it cost to start?
Nothing. XFA is free to start, with no cap on people. Connect Okta, and at their next sign-in people see what to fix and fix it from the XFA app. More checks and blocking come with the paid plans.
Compare plansTry it on your next Okta sign-in.
Start for free, connect Okta, and check your own laptop first.
