DOCSEARCHbyAlgolia
Submit Docs

XFA Documentation

website·Indexed 34 days ago

https://docs.xfa.tech

Zero Trust device access without an MDM that verifies devices meet security policies at sign-in.

Tokens
919
Snippets
0
Records
12
Agent score
62%

What's inside XFA

  1. Overview of XFA Zero Trust Device Access

    XFA provides Zero Trust device access without requiring a Mobile Device Management (MDM) solution. It verifies that devices used for work meet specific security policies at sign-in without accessing personal data or installing intrusive management software. The system operates in three primary stages:

    1. Discovery: Identifies devices used for work via the organization's identity provider.
    2. Awareness: Notifies and guides users regarding device risks via email, Slack, or Microsoft Teams to improve posture before enforcement begins.
    3. Enforcement: Implements device security checks at sign-in, which can warn or block access based on defined policies.

  2. Perform agentless device verification during sign-in

    If permitted by the organization, users can verify their device security posture during the login process without installing the XFA application.

  3. Configure Device Security Policies in XFA

    Administrators can define device checks that XFA uses to determine if a device meets security requirements. Supported policy checks include:

    • Disk encryption
    • Screen lock
    • OS version
    • Antivirus status
    • Browser version
    • Remote access status

    These policies determine how access is affected (e.g., warning the user or blocking access) during the Enforcement stage.

  4. Use Agentless Device Verification

    XFA supports an agentless sign-in path that assesses device security without requiring the native XFA agent. This is achieved using:

    • Browser signals
    • Discovery data
    • Device-trust connectors
    • Chrome Enterprise Core: Managed Chrome profiles can send device-posture signals to XFA during agentless sign-in.

  6. Discover Work Devices via Identity Providers

    XFA can automatically build a device inventory by connecting to identity providers. Supported discovery sources include:

    • Google Workspace
    • Microsoft Entra ID
    • Okta

    Additionally, admins can manually invite specific users via email to connect and verify a device outside of the automated discovery flows.

  7. Connect a device to an organization via self-invite

    Users can connect their device to an organization using the XFA desktop or mobile app by verifying their work email with a one-time code, provided the organization has enabled self-invite permissions.

  9. Implement Device Enforcement at Sign-In

    XFA adds device security checks to the sign-in process. This can be achieved through several integration methods:

    Identity Provider (IdP) Integrations:

    • Okta (as an authenticator)
    • Microsoft Entra ID (as an External Authentication Method)
    • Keycloak (as a post-login verification factor)
    • OneLogin and Ping Identity (as authentication factors)

    Application-Level Integrations:

    • SAML Applications: Inserts verification between the app and IdP.
    • OAuth2 Applications: Proxies the user to the app after the device check.

    Specific Application Guides: XFA provides dedicated setup guides for securing Slack, GitHub, Google Workspace, Atlassian, AWS IAM Identity Center, HubSpot, Monday.com, and Notion.

  11. Integrate XFA with GRC Compliance Platforms

    XFA can share device posture data with Governance, Risk, and Compliance (GRC) platforms to provide audit evidence. These integrations are for reporting purposes and do not perform enforcement. Supported platforms include:

    • Vanta
    • Drata
    • Thoropass
    • TrustCloud