Skip to main content

Introduction

XFA helps you show that your device is secure enough for work access without giving your organization control over it. This guide explains what XFA does, how device checks work, which apps you may use, and what happens during sign-in.

What is XFA?

XFA is a security tool that checks whether your computer meets your company’s security requirements before you sign in to your work web apps. Your IT team sets a policy for each check. Depending on that policy, XFA either warns you or stops you from signing in when a device check fails.

XFA checks your computer for things like:

  • Your operating system and internet browser are up-to-date
  • Your malware protection software is working properly
  • Your device encryption is on
  • ...

If one of these device checks fails, XFA warns you or stops you from signing in, depending on the policy. If it stops you, you cannot sign in until you have fixed the problem. You will not have to work it out on your own: XFA tells you which device check failed and shows you, step by step, how to fix it.

How Will I Use XFA?

There are a few ways you’ll interact with XFA: during your SSO sign-in, through our native app, or through our mobile app.

XFA during SSO authentication

When your computer is in good shape, XFA doesn’t get in the way. You may see a brief moment while it checks your device for issues during the SSO sign-in process, but that’s it.

When a device check fails, XFA shows you which check it was and how to fix it. If the policy for that check stops sign-in, you cannot sign in until you have fixed it. Here’s an example of what that looks like.

XFA SSO

After XFA is set up, you may need to fix a few things at first, but then you probably won’t hear from us again until it’s time to install a security update.

If you haven’t fixed a problem yet but you urgently need to sign in, you can also skip the device check.

However, your IT team may turn that option off for problems that are especially urgent.

Why Does My Company Use XFA?

Most organizations have legal and contractual obligations to protect sensitive data and practice good security. This obligation includes keeping employee devices secure.

Your company chose XFA because:

  • You get a warning when a device check fails, before it stops you from signing in
  • We give you clear instructions on how to fix most problems
  • We let you ask for an exception, or for extra time

In other words, your company chose XFA because they care about your experience, and they want a security program that works without getting in your way.

What does XFA check for?

XFA checks your device for security problems. Your company's IT administrator decides which checks are enabled, so not all of these may apply to you. Depending on what your company has configured, XFA can check for:

Software updates

  • Operating system version: Is your OS up-to-date with the latest security patches?
  • Browser version: Are your browsers (Chrome, Firefox, Safari, Edge) current?
  • Auto-update settings: Is automatic updating enabled on your device?

Device security

  • Disk encryption: Is the data on your device encrypted (FileVault, BitLocker, LUKS)?
  • Screen lock: Is a screen lock or password enabled?
  • Firewall: Is the system firewall active?
  • Antivirus/endpoint protection: Is security software installed and running?
  • Recent device reboot: Has your device been rebooted recently?
  • Secure Boot: Is Secure Boot enabled for enhanced startup security?
  • Integrity Protection: Is System Integrity Protection (macOS) enabled?
  • Windows Recall disabled: Is Windows Recall disabled to protect sensitive data?

Authentication & access

  • Biometric authentication: Is fingerprint or face recognition enabled?
  • Password manager: Is a secure password manager in use?
  • Native application installed: Is the XFA desktop app installed for enhanced security?

Network & remote access

  • DNS settings: Are secure DNS servers configured?
  • Remote login disabled: Is remote login disabled to prevent unauthorized access?
  • Remote management disabled: Is remote management turned off?
  • Remote scripting disabled: Is remote scripting disabled?
  • Screen sharing disabled: Is screen sharing turned off?

Mobile device checks

  • Device lock enabled: Is a PIN, pattern, or password set?
  • Jailbreak detection (iOS): Is the device in a secure, unmodified state?
  • Root detection (Android): Is the device unrooted?
  • Developer mode disabled: Is developer mode turned off?

Your administrator may enable different checks based on your company's security requirements. If you're unsure which checks apply to you, contact your IT department.

What About Privacy?

At XFA, user privacy is a top priority. Here’s how we ensure it:

  • Minimal Data Collection: We only collect the device information we need to check your device.
  • Transparency: You can see what data we collect and why.
  • Secure Storage: All data is encrypted and stored securely.
  • No Tracking: XFA does not monitor user activity or access personal files.

Your company’s security and your personal privacy can coexist with XFA.

Getting Started

To start using XFA:

  1. Sign in through your identity provider: use the login you already have for your company’s systems.
  2. Connect your device: follow the steps on screen so XFA can check your device.
  3. Stay secure: keep your device up to date so you keep meeting the requirements and don’t get interrupted.

By adding XFA to your sign-in, your company can protect its systems and still respect your trust and privacy.