Skip to main content

Agentless verification

Agentless verification lets XFA check a device at sign-in without the user installing the XFA agent first. Which checks XFA can run depends on the browser, the data sources you connect and your policy.

Your XFA plan must include Agentless verification. If it does not, the dashboard locks the setting and shows an upgrade prompt.

The agent still gives XFA the most complete view of a device, so use it when a policy needs deeper checks. Agentless and agent-based verification work side by side, and XFA uses whatever signals each device provides.

When to use it

Agentless verification suits people who cannot or will not install an app on the device they use for work, such as employees on personal devices and contractors who need short-term access. It also makes a first rollout lighter, because users can sign in before they install anything.

How it works

During sign-in, XFA can combine three data sources:

  • Browser signals. The user agent and client hints tell XFA the operating system and browser version.
  • Discovery data. When Discovery is connected to your identity provider, XFA matches the browser with the devices it already knows for that user.
  • Device trust connectors. A managed browser can send selected security signals, such as disk encryption, firewall and antivirus status.

XFA evaluates these signals against the application's policy. Depending on the policy, the user continues, sees a warning, or is blocked.

Browser and device support

Agentless uses available browser signals, which vary by browser and device. Chrome Device Trust adds security signals for managed Google Chrome profiles on Windows and macOS; it is a separate connector, not a requirement for all Agentless sign-ins.

Without a device trust connector, browser and Discovery signals can still be used. On mobile devices, what XFA can check depends on the data sources you enable and the device itself. The dashboard's Agentless page lists the checks available per platform.

For Chrome requirements and setup, see Configure Chrome Device Trust.

Set up Agentless verification

  1. In the XFA Dashboard, open Agentless and turn on the data sources you want to use.
  2. For signals from managed Chrome profiles, follow Configure Chrome Device Trust.
  3. Turn on Allow Agentless sign in in every policy where you need it. See Enable Agentless sign-in in a policy.