Skip to main content

Application filters

Every application you create under Enforcement checks devices against your policy at sign-in. Filters narrow which sign-ins XFA checks, for example to leave out a group of users or a platform you do not cover.

Before you start

You need the Administrator role. Filters are set per application, so each application can have its own.

Where to find the filters

  1. In the XFA Dashboard, go to Enforcement.
  2. Open an existing application, or click New to create one.
  3. Scroll to Filtering options.

Discovery applications do not have this section. Filters only apply to applications where XFA checks the device at sign-in.

With every filter left at its default, XFA checks every user on every platform.

Email allowlist

Only the following email addresses and domains are subject to XFA check limits the device check to the users you list. Everyone else signs in without a device check. Leave the field empty to check all users.

  • Enter a full email address, such as jane@example.com, or a domain, such as example.com.
  • Press Enter or Space to add an entry. You can also paste a comma-separated list.
  • Entries are stored in lowercase, and duplicates are ignored.

The allowlist is not available for OAuth2 applications.

Device type

  • Don't verify device security of mobile devices lets mobile sign-ins through without a device check. Desktop devices are still checked.
  • Don't verify device security of desktop devices lets desktop sign-ins through without a device check. Mobile devices are still checked.
  • Skip managed devices lets devices your organization already manages through without a device check. It is in Beta. See Skip managed devices for how XFA decides that a device is managed.

Operating systems

Target specific operating systems limits the device check to the platforms you select: Windows, macOS, Linux, Android, iOS and iPadOS. Platforms you leave unchecked are not checked.

By default every platform is selected and the field shows All operating systems selected. Clear the platforms you want to leave out. At least one operating system must stay selected.

Read-only administrators

Administrators with the Read only role can see the filters but cannot change them.