Policies

Policies define which device checks matter for your organization and how XFA should respond when a device fails them. Use policies to set goals, warn users, block access where needed, and keep device-security decisions consistent across applications without changing the user's device for them.

You have the flexibility to customize these rules and add Enforcement integrations to ensure that devices comply with your organization's security standards.

note

Available checks depend on your plan. Browser privacy (Chrome Do Not Track, DNS over HTTPS and the Firefox checks), DNS, operating system remote access checks (screen sharing, remote scripting, remote management and remote login), and device management checks (Intune and Vanta) each require a plan that includes them. Checks outside your plan appear grayed out with an upgrade prompt.

Compliance Goals

Each security check in a policy can be configured with a three-tier compliance system:

Set your compliance goal: define the time period in which devices should become compliant (e.g., 30, 60, or 90 days). This goal is only visible to administrators and serves as the baseline for warning and blocking timelines.
Warn users: configure when users are informed about a security risk on their device. For version-based checks (such as OS or browser versions), you can choose:
- Before compliance goal: warn users a set number of days before the compliance goal is reached.
- On the compliance due date: warn users when the compliance goal is reached.
Block a device: determine when a non-compliant device will be blocked from access. The same timing options are available:
- Before compliance goal: block the device a set number of days before the compliance goal.
- On the compliance due date: block the device when the compliance goal is reached.

For binary checks (such as disk encryption or screen lock), enabling warn or block will take effect immediately when the device is non-compliant.

✅ Available Security Checks

A policy can include the following checks:

Add devices to organization
- When enabled, devices will be added and reported to the organization.
Allow users to skip the device verification
- Users will be able to skip the device verification process and gain access to the application.
Allow unsupported devices to access the application
- Devices that aren't supported by XFA can still access the application.
Validate Operating System version
- XFA will verify the OS version of each device. Set a compliance goal to define how long the OS version can be out of date, and configure when to warn or block users.
- Additional options:
  - Allow or restrict specific beta versions.
  - Allow or restrict older major versions that are still supported.
Validate Operating System autoupdate setting
- XFA checks if devices have auto-updates enabled. You can warn or block users who have autoupdates disabled. On Linux, it applies to Debian, Ubuntu and NixOS.
Validate browser version
- XFA verifies the browser version of each device. Set a compliance goal to define how long the browser version can be out of date, and configure when to warn or block users.
- Additional options:
  - Allow or restrict specific beta versions.
  - Allow or restrict older major versions that are still supported.
- Browser privacy checks. When XFA has turned these on for your organization, the browser settings also let you require Chrome Safe Browsing, Chrome Enhanced Safe Browsing, Chrome Do Not Track, Chrome DNS over HTTPS, Firefox HTTPS-Only Mode, Firefox DNS over HTTPS, Firefox Enhanced Tracking Protection and Firefox Enhanced Tracking Protection (Strict). They are not shown by default.
- The Chrome and Firefox sections also require XFA to enable Safe Browsing for your organization. The privacy checks additionally require browser privacy in your plan.
Validate disk encryption
- Devices without disk encryption will trigger warnings or can be blocked based on your settings.
- XFA recognizes the supported full-disk encryption methods on each platform:
  - Windows: BitLocker (including the OS-managed BitLocker Device Encryption mode on supported hardware) and VeraCrypt system-drive encryption.
  - macOS: FileVault.
  - Linux: LUKS-encrypted root filesystems, and TCG OPAL self-encrypting drives when OS-side drive locking is enabled.
- Notes on what cannot always be confirmed:
  - OPAL / SED on Linux is detected via sedutil-cli, which queries the drive from the running OS. Drives that are unlocked entirely by the BIOS/UEFI before Linux boots (pre-boot unlock, no OS-side handoff) cannot be inspected from user space and may be reported as non-compliant. In that case, enable LUKS on top or exclude the device from the policy.
  - VeraCrypt on Windows is detected only when used to encrypt the Windows system (boot) drive. VeraCrypt-encrypted file containers and non-system partitions are not currently detected, because they leave the operating system drive unencrypted.
Validate screen lock
- XFA checks whether devices have screen lock enabled and allows for warnings or blocking users without it.
- You can also set how quickly a device must lock. Under Maximum screen lock timeout, choose 1, 5, 10, 15 or 30 minutes. A device that takes longer to lock fails the check.
- Left at Not configured yet, any timeout passes as long as a screen lock is set.
Validate antivirus
- The system verifies whether antivirus software is active on the device, with options to warn or block users without it.
- XFA does not require a specific vendor. It reads the antimalware status the operating system itself reports:
  - Windows: every product registered with the Windows Security Center, which covers third-party antivirus such as ESET, Norton, Bitdefender and Kaspersky, not only Microsoft Defender. XFA reports the product name shown in Windows Security, whether its real-time protection is on, and whether its signatures are current.
  - macOS: Apple's built-in XProtect, which ships with macOS and is active by default.
  - Linux: ClamAV and Microsoft Defender for Endpoint.
- What counts as passing differs per platform:
  - Windows: real-time protection must be on. Definition freshness is read and shown in the XFA app on the device, but does not fail the check on its own.
  - Linux: the antivirus must be running and its definitions current (ClamAV within 48 hours, Microsoft Defender for Endpoint within 7 days). Stale definitions fail the check.
  - macOS: XProtect must be active. macOS does not expose a separate signature age for XFA to measure.
- The device posture XFA reports to your organization is whether antimalware is active. The product name and definition freshness are shown to the user in the XFA app on their own device; they are not part of the posture in the dashboard.
- Notes on what cannot always be confirmed:
  - Windows running a third-party antivirus keeps Microsoft Defender registered next to it in passive mode. That is normal Windows behaviour, not a misconfiguration: XFA reports the product that is actually protecting the device.
  - A third-party antivirus that is installed but switched off is reported as inactive under its own product name, so the user can see which product to turn back on.
  - macOS reports XProtect only. A third-party antivirus on macOS is not listed as a separate product, because macOS has no equivalent of the Windows Security Center for XFA to read.
Validate password manager
- Ensures users have a password manager enabled. You can decide whether to warn or block users who don't comply.
Validate biometric authentication
- Enforce users to use biometric authentication on their device. You can decide whether to warn or block users who don't comply.
Validate device reboot
- Enforce users to regularly reboot their devices. Set a compliance goal to define how many days can pass since the last reboot, and configure when to warn or block users.
  
  A reboot applies pending updates and clears out malware running in memory. A device that never restarts can stay unpatched and exposed for weeks.
Validate Windows Recall
- XFA checks whether Windows Recall is disabled on Windows devices to protect sensitive data from being captured and stored. You can decide whether to warn or block users who have Windows Recall enabled.
Require the native application to be installed
- Require the native application to be installed (desktop-only for enhanced security insights). You can decide whether to warn or block users who don't comply.
Allow users to skip the token flow on mobile devices
- Users will be able to skip the token flow on mobile devices and gain access to the application.
Allow users to skip the token flow on desktop devices
- Users will be able to skip the token flow on desktop devices and gain access to the application.
Allow agentless sign-in
- Allow agentless sign-in (users can verify without installing the XFA agent when enough information is available). You can decide whether to warn or block users who don't comply.
- Allow agentless sign-in requires an XFA plan that includes Agentless.
Validate firewall status
- Ensure a firewall is enabled to block unauthorized network access. You can decide whether to warn or block users who don't comply.
Validate DNS
- Ensure secure DNS resolution by requiring compliant DNS servers to prevent DNS hijacking. You can decide whether to warn or block users who don't comply.
- Under DNS Servers, add up to four DNS server IP addresses, clicking Add after each one.
- Under Validation Mode, choose how the device's DNS servers are compared with your list:
  - Exact match (the default): the device's DNS servers match your list exactly.
  - Start with exact list with extra servers after: the device's list starts with yours and may add servers after it.
  - Contains: your list appears unchanged within the device's list, with other servers allowed before or after it.
- Windows and Linux put IPv6 servers before IPv4 servers. Keep that in mind when you order the list for the first two modes.
Validate screen sharing
- Ensure screen sharing is disabled to prevent unauthorized remote access. You can decide whether to warn or block users who have screen sharing enabled.
Validate remote scripting
- Ensure remote scripting is disabled to prevent execution of potentially harmful scripts. You can decide whether to warn or block users who have remote scripting enabled.
Validate remote management
- Ensure remote management is disabled to prevent unauthorized device control. You can decide whether to warn or block users who have remote management enabled.
Validate remote login
- Ensure remote login is disabled to reduce the risk of unauthorized access. You can decide whether to warn or block users who have remote login enabled.
Validate unattended remote access
- Detect third-party remote-control tools set up for unattended access, such as TeamViewer, AnyDesk and Chrome Remote Desktop. Unattended access lets someone connect to the device without the user approving it. XFA flags a device only when it confirms unattended access. When it cannot confirm it, the device shows that the check could not be verified, and the device does not count as compliant. You can decide whether to warn (the default) or block users who have it enabled. This check is separate from the built-in operating system checks above. It only appears when XFA has turned it on for your organization. See what this check reports.
Validate jailbroken
- Prevent security vulnerabilities by restricting jailbroken devices that bypass built-in protections. You can decide whether to warn or block users with jailbroken devices.
Validate rooted devices
- Prevent security vulnerabilities from rooted Android devices. You can decide whether to warn or block users with rooted devices.
Validate developer mode
- Enhance device security by preventing access from devices with developer mode enabled. You can decide whether to warn or block users who have developer mode enabled.
Validate Secure Boot
- Require Secure Boot to be enabled for enhanced security. You can decide whether to warn or block users who don't comply.
Validate Integrity Protection
- Require Integrity Protection to be enabled for enhanced security. You can decide whether to warn or block users who don't comply.
Validate secrets in environment
- Detect and prevent exposed secrets in environment variables or runtime context to reduce credential leakage risk. You can decide whether to warn or block users who have secrets detected. Learn more about what this check detects.
Validate autonomous agents
- Detect autonomous agents and require approved controls before allowing access. You can decide whether to warn or block users who have autonomous agents present.
Validate unguarded elevation
- Detect and prevent unguarded privilege elevation that can lead to unauthorized high-privilege actions. You can decide whether to warn or block users who have unguarded elevation detected.
Unsafe AI mode
- Detect AI tool configurations that put the device at risk. You can decide whether to warn or block users who have one. This check runs on desktop devices only.
- Checks 30 to 33 are in beta. They are grouped on the AI checks tab of the policy editor, which only appears when XFA has turned it on for your organization.
Validate Intune enrollment
- Require devices to be enrolled in Microsoft Intune. You can decide whether to warn or block users who don't comply.
- To accept only specific Intune tenants, add their IDs under Tenant IDs. Leave it empty to accept any tenant.
- Turn on Allow external enrollment to also accept devices enrolled in tenants you did not list.
Vanta Client
- Require the Vanta agent to be installed and running on the device. You can decide whether to warn or block users whose device is not running it. This check sits in the Device management section of the policy editor, next to Intune.
Validate Aikido Safe Chain
- Aikido Safe Chain checks packages installed with npm, pip, yarn, pnpm, bun and similar tools for malware before they run. This check only appears when your organization's policy includes it. It is never shown on a personal device.
- XFA verifies on macOS, Windows and Linux that Aikido Safe Chain is installed and active in the user's shell.
- If the policy requires it and it is missing, the XFA app offers Install. XFA downloads and runs Aikido's installer itself, without an administrator password. The user restarts the terminal to finish. The app can also Uninstall it.
- You can decide whether to warn or block users whose device does not have Aikido Safe Chain active.
Validate Aikido Device Protection
- Aikido Device Protection is Aikido's device agent that protects developer tooling traffic. This check only appears when your organization's policy includes it. It is never shown on a personal device.
- Enter your organization's Aikido registration token (it starts with AIK_) in the Aikido Device Protection setting of the policy. Without the token, the XFA app cannot install it.
- XFA verifies on macOS that Aikido's system extension is active, and on Windows and Linux that the Aikido package is installed and its service is running. The app shows one of three states: needs to be installed, needs to be activated (macOS only), or is active.
- If the policy requires it and it is missing, the XFA app offers Install. The operating system asks for an administrator password. On macOS the user also approves Aikido's system extension in the Aikido setup window that opens; XFA walks them through it and re-checks. If that window was closed, the row offers Reinstall to activate. Windows and Linux need no further steps. A fully silent macOS install is only possible through your MDM with Aikido's configuration profile.
- The app can also Uninstall it (administrator password). This also removes Aikido's trusted root certificate and the certificate settings Aikido adds for curl, pip, npm, gem and cargo. On macOS a restart finishes removing the extension.
- You can decide whether to warn or block users whose device does not have Aikido Device Protection active.
Validate application safety
- Check the code signature of installed apps. Six policies, one per kind of signature problem: apps with no signature, tampered apps, apps with a revoked certificate, apps from an unknown developer, apps whose developer skipped Apple's malware check, and self-signed apps. You can decide for each whether to warn or block users. See Application safety.
Validate install protection
- Verify that the operating system checks apps before they run: Gatekeeper on macOS, SmartScreen on Windows. You can decide whether to warn or block users who have it turned off. See Install protection.
Validate risky app categories
- Detect installed apps in risky app categories you turn on, such as crypto-mining apps, hacking and security-testing tools, or VPN apps. Each category is its own policy, and you can decide for each whether to warn or block users. See Risky app categories.

Device check pages

Some checks have their own page with the full detail: what XFA looks for on each operating system, what leaves the device, what the user sees, and what you can configure. More checks get a page over time, so this table grows.

Device check	What it verifies	Platforms
Application safety	The code signature of the apps installed on the device.	macOS, Windows
Install protection	That the operating system checks apps before they run.	macOS, Windows
Risky app categories	Whether installed apps fall into risky app categories you turned on.	macOS, Windows, Linux

Every other check in the list above works the same way: you pick a compliance goal, a moment to warn, and a moment to block.

Enforcement Integrations

You can use this policy with enforcement integrations such as Microsoft, Google, and Okta. At sign-in, XFA applies the configured policy decision. Depending on its warn, block, and skip settings, users can be warned or blocked when a device does not meet the policy.

To modify or enforce these rules, visit your dashboard and configure the enforcement settings to fit your organization's needs.

For more details on enforcement, refer to our enforcement documentation.