XFA checks every device at sign-in without taking control of it. Personal and contractor laptops on any operating system get the same check, and nothing personal is collected.
Intune is Microsoft's cloud service for managing devices. A device is enrolled first. IT then pushes policies, apps, and updates to it, and can lock or wipe it remotely.
Intune compliance policies can feed Conditional Access in Microsoft Entra ID. A device that fails them is then blocked from Microsoft 365 and the other apps Entra ID protects.
| XFA | Microsoft Intune | Microsoft Intune with Conditional Access | |
|---|---|---|---|
| Security checks | |||
| Number of device security checks | Up to 34 | About 11 | About 11 |
| Self-serve setup, no IT rollout | Yes | No | No |
| Blocks non-compliant devices at sign-in | Yes | No | Only managed devices |
| People install it themselves | Yes | No | No |
| Devices and people | |||
| Works on contractor and personal devices | Yes | NoIntune takes full control of the device, so contractors and employees often refuse to enroll their own devices for privacy reasons | No |
| Never takes control of the device | Yes | NoEnrolling a device in Intune gives IT management rights over it, including remotely wiping company data or the whole device | No |
| Finds devices through SSO sign-ins, before anything is installed | Yes | NoIntune only sees enrolled devices, so personal devices used for work stay invisible | No |
| Ecosystem | |||
| Works with your identity provider (SSO) | Yes | Built for Entra ID | Built for Entra ID |
| No identity provider migration needed | Yes | NoConditional Access runs in Microsoft Entra ID, so checking compliance at sign-in depends on Entra ID being your identity provider | No |
Intune details from Microsoft's documentation, checked October 2026. Sources: Intune device compliance (opens in a new tab); Conditional Access overview (opens in a new tab).
XFA checks every device at sign-in without taking control of it. Personal and contractor laptops get the same check as company ones, with no enrollment and no remote wipe.
The XFA app runs on macOS, Windows, Linux, iOS, and Android. It connects to Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak, so you keep the identity provider you have.
See the integrationsPeople install the XFA app at their next sign-in, without admin rights. When a check fails, they fix it from the app.
How XFA works“We have contractors who work on personal devices, which means we cannot install full-blown device management and control their devices because it's a kind of privacy invasion. XFA is great for hybrid teams like ours.”
Alex UlyanovHead of Security, Gateway.fmRead the Gateway.fm story
Yes. Intune keeps managing the company devices it manages today. XFA checks every device at sign-in, including the personal and contractor laptops Intune does not reach.
No. The XFA app checks security settings and does not collect personal files, messages, or browsing history. Nothing changes without the person’s OK.
Only if you set it to. Each check in a policy warns or blocks, and you choose after how many days. With a warning, people see what to fix at sign-in and still get in.
Nothing. XFA is free to start, with no cap on people. Four checks run at every sign-in: the operating system version, disk encryption, screen lock, and antimalware protection.
Compare plansDevice security used to mean a project. With XFA it means connecting your identity provider and picking your checks.
Starting with XFA