Trust every device that reaches your company's apps. Nobody changes how they sign in.
XFA sits inside the sign-in you already have: as an extra factor on your identity provider, or in front of a single app. How people log in stays the same.
Add XFA once, and every app behind it gets the check.
Connect a single app over SAML or OAuth 2.0. There are guides for Atlassian, GitHub, HubSpot, Notion, Slack, and more.
Limit the check to the groups you choose. Per connection, you can let people skip it, or sign in from a device XFA does not support. Every skip shows in your dashboard.
Nobody rolls anything out. People get the XFA app at their first sign-in.
Pick it in the dashboard and copy a few values across, as its guide shows.
Start with your own account, then add the groups you choose.
The default is ready: the core checks, a warning after 7 days, no blocking.
A device that passes goes straight in. One that doesn't is told what to fix, and how long it has. Nobody needs IT to install anything.
People see what to fix and how many days they have. Until then, Sign in anyway takes them in.
Most days the check passes before they notice. Nothing on their laptop changes.
The first sign-in offers the download. About a minute, no admin rights.
If you allow it, the browser checks the device instead. It sees less than the app.
For each check, you decide what a failing device gets: a warning, a block, or both. You also decide how many days it has first.
See the device checksClick around and play with the settings
Default policy
Device Checks
Operating System version
Set your compliance goal
Warn users
Block a device
Timeline
A warning names the problem and lets people keep working. By default it starts after 7 days.
Turn blocking on per policy. A device still failing after the deadline, 14 days by default, waits until it is fixed.
Set a compliance goal per check, 30 days by default. Devices that miss it show up in your dashboard. People never see it.
The dashboard shows how each device did at sign-in, so you never have to ask around.
Your identity provider and the apps you connected, each with its policies and who may skip the check.
Whether each person verified their device at sign-in, or skipped it.
See which devices are past their deadline and still allowed in.
On the apps you connect directly, XFA can also verify the person. Switch on the methods you want per app; people pick one the first time and the browser remembers. On your identity provider, its own second factor stays.
The XFA app on a trusted device is the second factor. Nothing to type or approve. A new laptop is approved from one they already trust.
Fingerprint, face, screen lock, or a security key, through the browser's own prompt. No XFA app needed.
A six-digit code from the authenticator app they already use. No XFA app needed.
“I prefer conversations about concrete behavior over abstract policies. XFA gives us data to have those conversations.”
Stephane JansCTO & CPO, DnergyRead the Dnergy storyYes. XFA checks every device from the first sign-in and warns people about anything they need to fix. Nobody is blocked unless you turn blocking on.
Yes. Every plan checks each device at sign-in, the free one included, for as many people as you have. The pricing page shows what each plan adds.
Admin rights in your identity provider and, for Microsoft Entra ID, a P1 license. The guide for each provider is in the docs.
Read the setup guides (opens in a new tab)On apps you connect directly, the sign-in opens the XFA mobile app for the check and comes back. For identity provider sign-ins, the device check runs on computers today.
For the full set of checks, yes. If you allow it, people can also sign in without it through Google Chrome with a managed profile, on fewer checks.
No. XFA verifies the device at sign-in and never manages it. It does not collect private messages or emails, personal files, browsing history, passwords, or location data.
Connect your identity provider. From then on, every sign-in comes with a device check.
