Skip to main content

Ask employees to share extra checks

Some device checks are extra checks: the employee decides whether your organization gets the result. You ask for them by setting Warn or Block on the check in a policy. The employee then agrees in the XFA app or on the sign-in page, and can stop sharing at any time.

When an employee uses the XFA app, all checks not listed below are always shared with your organization.

Before you start

Application checks and AI checks are turned on per organization. If you do not see them under Policies, contact XFA. Extra checks run on computers only, so employees are never asked on a phone. Some run only on macOS or Windows.

Extra checks

The extra checks are in three groups. On the sign-in page and in the XFA app, the employee sees each group as one row, named as in the first column of this table.

Group the employee seesPolicies in the groupWhat you see once shared
Protection for passwords and system changesSecrets in environment, Unguarded elevationYes or no for each check. Never the passwords or their values.
AI tools that work on their ownAutonomous agents present, Unsafe AI modeYes or no for each, never which tools.
Security of your appsInstall protection, the six Application safety policies, the ten Risky app categoriesWhether install protection is on and how strict it is. The number of apps per Application safety policy (for example apps with no signature) and per category. Never which apps.

Counts are per device. A count of one shows that the device has one app of that kind, but not which app.

Consent is per check and per organization. A device that works for two organizations can share a check with one and not with the other.

Ask for an extra check

  1. In the XFA dashboard, open Policies and click the policy your applications use.
  2. Find the extra check.
  3. Turn on Warn or Block for it, as for any other check.

The employee is only asked for the checks you set to warn or block. If you set only some policies of a group, the employee is asked only for those. A check with only a goal (no warn or block) is not asked for. A block counts only if your plan lets you block. If you later ask for more checks, the employee is asked again for the new ones.

What the employee sees

The employee is asked in two places:

  • On the sign-in page. When the device joins your organization, the line under Verify & Accept says how many extra checks it also shares, for example "Verify & Accept also shares 3 extra checks requested by Acme.", with See what's shared for the list. Later sign-ins list any check not shared yet, with a button that opens XFA.
  • In the XFA app. The checks appear under Needs attention, with Share for one check and Share all for every check. XFA asks the employee to confirm and lists what you will see.

The employee can stop sharing a check in the XFA app at any time. XFA keeps running the check on their device, but you stop receiving new results. Results sent before stay in your records. For the employee's steps, see What your organization sees.

Warn or block for a check that is not shared

Until the employee shares a check, XFA does not send its result to you. The policy then decides what happens at sign-in. In this example, your organization is called Acme:

  • Block. The sign-in page shows the check under To sign in, Acme needs to know about. The employee can only sign in after sharing it.
  • Warn. The sign-in page shows the check under Acme also wants to know about. The employee can share it, or click Sign in anyway.

In both cases, the device counts as not compliant for that check. It does not send an Awareness notification (the emails and chat messages XFA sends employees about device risks).

Notes

  • You cannot share a check for an employee. Only the employee's own XFA app can change what it shares.
  • Removing warn and block from an extra check stops new requests, but you cannot stop the data yourself: an employee who already shared the check keeps sending it until they stop sharing.
note

Before XFA 2.1.26, the app shared every check, including the extra checks. Once the employee updates XFA, the app asks them, and shares no extra check except the AI checks the device already ran.