XFA Mobile App

The XFA mobile app checks a set of security settings on iOS and Android devices, and can act as a trusted device for multi-factor authentication (MFA). It sends device security information to XFA for evaluation against the policies of organizations you choose to connect to. It does not give any organization control of your phone.

How to Obtain the App

The XFA Mobile App runs on iPhone, iPad and Android devices. Download it here:

How to Register Mobile Devices

To connect your mobile device to an organization in XFA:

Install the XFA Mobile App.
Follow the prompts to enroll your device or open your email invitation to join an organization.
Set your device as trusted to enable MFA functionality.

In the app you can see which organizations receive your device security status. You can be connected to several organizations at once. When an organization invites you by email, you accept the invitation in the app. You can stop sharing with an organization at any time: this deletes the connection, so the organization no longer receives your device status.

How to Accept an Invitation

Open the email invitation sent by the organization.
Tap the link to launch the XFA Mobile App.
Review the details of the invitation under Organizations.
Tap Accept to start sharing your device security status with the organization, or tap Reject if you do not want to share your device status.

Once accepted, your device is associated with the organization. XFA can then share its security status and evaluate it against that organization's policy.

After accepting an invitation, you can return to Organizations at any time to review which organizations you share your device status with. To stop sharing with an organization, tap the trash icon next to it. The app asks Disconnect from [organization]?, and you tap Disconnect to confirm.

How to address issues

The XFA app explains device compliance issues and provides guidance for addressing them. Whether a sign-in can continue depends on the access rule your organization has configured.

When you sign in, the XFA app opens.
Review the issue.
Follow the steps shown.
Go back to your browser, refreshing the page if needed, to finish signing in.

You can also open the XFA app at any other time to review an issue and how to fix it.

Data Collected

The XFA Mobile App runs inside your phone's app sandbox, which limits what it can access. It checks a fixed set of device settings; your organization's policy decides which checks count. The app can collect:

The device name.
The device’s operating system and version.
The version of the XFA agent installed.
The make and model of the device (e.g., iPhone 15 Pro Max).
Whether the operating system is up to date.
Whether the device has a passcode (screen lock) set up.
Whether disk encryption is enabled.
Whether biometrics (Face ID, Touch ID, or fingerprint) is enabled.
Whether the device was recently restarted.
Whether the device is jailbroken (iOS).
Whether the device is rooted or has Developer Mode enabled (Android).

The app does not access your personal files, photos, messages, browsing history or what you do in other apps. It sends the collected device information and security settings to XFA to evaluate the policies of organizations you connected to, rather than sending only a pass or fail result.

The app checks your device when you open it and requests background checks about every 6 hours. Your operating system decides when background checks can run, so the interval can vary.

Using the XFA App for MFA

When the app asks Trust this device?, tap Trust to make your phone a second factor, or Don't trust to decline. Once trusted, your phone can approve sign-ins on your other devices.

When a sign-in needs approval, the app asks you to confirm it's you. Tap Yes, it's me to approve, or No, don't allow to refuse. For the other ways to verify a sign-in, see Verification methods.

Best Practices for Users

Fix issues when the app first flags them, before your organization's deadline turns a warning into a block. Keep the app up to date, open it now and then to check your device's status, and stop sharing with organizations you no longer work with.