Skip to main content

How to set up Aikido Device Protection in XFA Max plan

Use this guide to deploy Aikido Device Protection to every device your team uses for work, including personal (BYOD) and contractor devices that are not enrolled in an MDM. XFA checks for it along with the rest of the device policy whenever users log in to an app protected by XFA. Users without it are warned or blocked until they install it, which they can do from the XFA app.

Before you start

You need:

  • XFA verification at sign-in set up for your identity provider.
  • An XFA admin role.
  • An Aikido plan that includes Aikido Device Protection.
  • XFA app 2.1.0 or later on the devices. Users who do not have it yet are prompted to install it at their first sign-in.

The check covers macOS, Windows and Linux. Phones and tablets are skipped.

1. Copy your Aikido token

  1. In Aikido, go to Device Protection and open the Devices tab.
  2. Click Connect Device and choose Manual install.
  3. Select the user group the devices should join.
  4. Copy the install command. The token is the part after --token and starts with AIK_.

2. Turn on the check in a policy

  1. In XFA, go to Policies and open the policy that applies to these devices.
  2. On the Other Tools tab, under Antimalware protection, turn on Aikido Device Protection.
  3. Click Configure and paste the token in Device Protection token.
  4. Choose what happens when a device does not have it. Enable compliance goal marks the device as non-compliant in the dashboard. Warn users shows a warning at sign-in. Block a device stops the sign-in until it is active. Any combination works.
  5. Click Confirm.

Start with Warn users for a few days so people can install Aikido at a convenient moment, then switch to Block a device. You can also apply the policy to a small group first.

If you also use Aikido Safe Chain, turn on Aikido Safe Chain in the same policy.

When users log in to an app protected by XFA

When someone logs in via the organization's identity provider or an app protected by XFA, XFA checks their device first. If Aikido Device Protection is not active, they see a warning. With Block a device, they cannot sign in until it is.

On macOS and Windows they can click Fix next to the check, and the XFA app opens. They can also open the app themselves.

  1. Click the XFA icon in the menu bar (macOS, Linux) or system tray (Windows) and choose All device checks.
  2. On the organization's tab, click Install next to Aikido Device Protection.

The app then asks them to confirm and installs Aikido Device Protection with your token. XFA asks for administrator rights only for this installation: they approve the prompt with the computer's password, or click Yes on Windows. On a Mac, they also allow the system extension and network content filter in Aikido's setup window and restart.

XFA then rechecks the device, and keeps checking that Aikido stays installed and running.

To remove it, they click Uninstall on the same row. XFA also removes Aikido's certificates, and a Mac needs a restart to finish.

Check that it works

Sign in to an app protected by XFA on a test computer and install Aikido Device Protection with Fix or Install as above. Then confirm:

  1. The XFA app shows Aikido Device Protection is active on the organization's tab, and the check passes for the device under Devices in the XFA dashboard.
  2. Aikido lists the computer as Active under Devices.
  3. Opening device-protection.aikido.help on the computer shows that Device Protection is active.

Troubleshooting

  • If users see "Organization is missing onboarding token" in the XFA app, the policy has no Aikido token. Add it in step 2.
  • If the XFA app says "Aikido Device Protection needs to be activated" on a Mac, the system extension was not allowed. The user clicks Reinstall to activate in All device checks and allows the extension in Aikido's setup window. They can also allow the Aikido entries in System Settings > General > Login Items & Extensions, then sign in again.
  • If Aikido is installed but the device is not in your Aikido dashboard, check that the token in the policy matches your Aikido workspace and has not been revoked.
  • If the check still fails after installation, restart the device so the agent fully activates, then sign in again.

For questions about XFA, contact support@xfa.tech.