Teams
Microsoft 365
“With XFA, we don’t need extra people or external people to manage [device security].”
Andreas CretenFounder & CEO, madewithloveRead the madewithlove storyYour rules, checked at every sign-in.
You decide what every device needs. If one doesn't meet them at sign-in, its owner sees what to fix and fixes it, often in one click. No ticket for IT.
Set the rules for device access.
Decide what a device needs before it can reach your apps. You set it once, and XFA applies it at every sign-in.
Default policy
Device Checks
Operating System version
Set your compliance goal
Warn users
Block a device
Timeline
- The point an update becomes available.
- Users are warned 7 days after an update becomes available.
- Devices are blocked 14 days after an update becomes available.
- Devices must be compliant 30 days after an update becomes available.
A policy holds the checks.
Pick the device checks you need, such as operating system updates, disk encryption and screen lock.
Warn or block, per check.
For each check, choose to warn people, block the device, or both, and after how many days.
A goal for your reports.
Set a compliance goal per check. Devices that miss it show as not compliant in your dashboard. On its own, it does not warn or block anyone.
At sign-in: safe, warned or blocked.
Each time someone signs in to an app you protect, XFA checks the device first. What happens next depends on your rules.
New people install XFA at their first sign-in.
Nobody from IT has to visit. The first time someone signs in, XFA asks them to install the app, and about a minute later they are in.
A new colleague’s first day
People fix it themselves.
Many fixes take one click on the Fix button, at sign-in or in the XFA app. Nothing changes without their OK.
XFA warns the owner early with risk alerts.
When a device fails your policy, XFA tells its owner what to fix.
What sends an alert.
XFA keeps checking every verified device against your default policy. If one fails a check, its owner gets an alert that names the device and what to fix.
Where it arrives.
Always by email to their work address. If you choose, also as a direct message in Slack or Microsoft Teams.
What happens next.
If the device still fails, the same alert goes out again every week, month or three months, whichever you pick. Once it is fixed, the alerts stop.
Every device on one page.
Your dashboard lists each device, its owner and whether it meets your rules.
A
People7Devices9
Last synced: 09:41
Search by device, OS, email, ...
Hardware & Software
Device Name
Issues
Last Seen
Verified
Managed by
Owner
ThinkPad X1
2
12 minutes agojust now
Verified
User
sales@yourcompany.com
MacBook Pro
2 hours ago
Verified
Organization
design@yourcompany.com
iPhone 16
1 day ago
Verified
User
support@yourcompany.com
Surface Laptop
3 days ago
Discovered
User
contractor@yourcompany.com
MacBook Air
2CVE
5 hours ago
Verified
User
marketing@yourcompany.com
Pixel 9
6 hours ago
Verified
User
sales@yourcompany.com
XPS 13
1
8 days ago
Verified
User
engineering@yourcompany.com
EliteBook 840
2 days ago
Unverified
User
finance@yourcompany.com
iPad Air
4 days ago
Verified
Organization
design@yourcompany.com
Devices
More that comes with XFA.
Five more things XFA does, beyond the check at sign-in.
On every computer and phone.
The XFA app runs on macOS, Windows, Linux, iOS, and Android. On a phone, people follow the steps in the app.
Download the XFA appNo app? A managed browser checks.
Without the app, XFA checks the device in Google Chrome, signed in with a Google account your organization manages. Your admin turns on Google’s free Chrome management.
Built-in Passkey.
Phishing-resistant MFA that checks the device in the same step.
Discover devices and invite them.
XFA reads 30 days of sign-in logs from Google, Microsoft, or Okta, then keeps looking for new devices. With auto-invite on, anyone who has not set up XFA yet gets an invitation.
Their device stays theirs.
XFA checks device settings. It does not collect messages, files, or browsing history.
Andreas CretenFounder & CEO, madewithloveRead the madewithlove storyBefore you get started.
Compare plans
Can we run XFA without an IT team?
Yes. You set the rules once. People fix their own devices at sign-in or from the XFA app, and XFA sends the invites and risk alerts.
What is the difference between a warning and a block?
A warning tells people what to fix and still lets them sign in. A block stops the sign-in until the device is fixed. You choose per check whether it warns, blocks or both, and after how many days. Sign in anyway only shows when nothing on the device blocks.
Will XFA block anyone on the first day?
Only if you set a check to block immediately. You can warn first and give people a set number of days before the block starts.
How does the Fix button work?
At sign-in, the Fix button hands the change to the XFA app on that computer. Nothing changes without the person’s OK. Checks without a Fix button come with a step by step guide, and on phones people follow the steps in the XFA app.
Do people need admin rights or an MDM?
Neither. People install the XFA app themselves, without admin rights, on macOS, Windows, Linux, iOS and Android.
Which identity providers does XFA work with?
Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. You add XFA to yours as an MFA method or as an external identity provider, whichever it uses. You can also add the check to a single app over SAML or OpenID Connect (OAuth 2.0).
Can XFA reach people on Slack or Microsoft Teams?
Yes. XFA sends invites, reminders, and risk alerts by email, Slack or Microsoft Teams. You choose the channels in the dashboard.
What does XFA never collect?
Private messages or emails, personal files, browsing history, screen recordings or screenshots, passwords and location data. You see check results and basic device details, linked to each person’s work email.
What does it cost to start?
Nothing. Start for free, with device checks at sign-in from day one.
Set the rules once. Let XFA run the rest.
You have better things to do than IT security.
