# XFA Documentation

> XFA is Zero Trust device access without an MDM: it verifies that any device used for work meets your security policy at sign-in, without installing intrusive device management or seeing personal files or activity. This documentation covers setting up XFA as an administrator (Discovery, Awareness, and Enforcement) and using XFA as an end user.

XFA works in three stages: **Discovery** finds the devices actually used for work via your identity provider, **Awareness** notifies and guides users about device risks, and **Enforcement** adds device checks at sign-in, warning or blocking based on your policy. XFA integrates with your identity provider and applications, uses a lightweight agent with narrower agentless verification where supported, and respects end-user privacy by design.

This file indexes the documentation at docs.xfa.tech. Product, pricing, and comparison pages live on the marketing site at https://xfa.tech (see https://xfa.tech/llms.txt).

## Getting started (admins)

- [Admin documentation home](https://docs.xfa.tech/docs/admin/main): Where admins begin: create an organization, connect an identity provider, review devices, and add Awareness and Enforcement.
- [Create an organization](https://docs.xfa.tech/docs/admin/create-organization): Set up the XFA account that holds your users, devices, policies, integrations, and applications.
- [Devices overview](https://docs.xfa.tech/docs/admin/devices-overview): Review the devices XFA has discovered and assessed, including status, ownership, source, and policy results.
- [Policies](https://docs.xfa.tech/docs/admin/policies): Define the device checks XFA uses (encryption, screen lock, OS version, antivirus, browser version, remote access) and how they affect access.
- [Statistics](https://docs.xfa.tech/docs/admin/statistics): Review organization and device statistics.
- [Activity](https://docs.xfa.tech/docs/admin/activity): Review recent device-verification and access events.
- [Notifications and reports](https://docs.xfa.tech/docs/admin/notifications): Configure administrator alerts and reports.
- [Team and roles](https://docs.xfa.tech/docs/admin/team-and-roles): Invite administrators and manage dashboard access.
- [Change your plan](https://docs.xfa.tech/docs/admin/subscription): Upgrade, downgrade, switch billing cycle, or move to Free from Settings > Subscription; what applies immediately, what is scheduled for the next renewal, what is charged, and what goes through sales.
- [Referral program](https://docs.xfa.tech/docs/admin/referral): Share a personal referral link; the referred company gets 10% off their first year and the referrer gets a gift card once they qualify.

## Discovery: find the devices used for work

- [Discovery overview](https://docs.xfa.tech/docs/admin/discovery): Turn identity-provider data into a device inventory without intrusive device management.
- [Google Workspace discovery](https://docs.xfa.tech/docs/admin/discovery/google-discovery): Connect Google as a discovery source.
- [Microsoft discovery](https://docs.xfa.tech/docs/admin/discovery/microsoft-discovery): Connect Microsoft Entra ID as a discovery source.
- [Okta discovery](https://docs.xfa.tech/docs/admin/discovery/okta-discovery): Connect Okta as a discovery source.
- [Manually invite users](https://docs.xfa.tech/docs/admin/discovery/invite-user): Invite specific users by email to connect and verify a device outside the automated Discovery and Awareness flows.

## Awareness: notify and guide users

- [Awareness overview](https://docs.xfa.tech/docs/admin/awareness): Send onboarding, verification, and risk messages by email, Slack, or Microsoft Teams to improve device posture before enforcement.
- [Awareness scoping](https://docs.xfa.tech/docs/admin/awareness/awareness-scoping): Target which users and devices receive Awareness messages.
- [Slack integration](https://docs.xfa.tech/docs/admin/awareness/awareness-slack-integration): Deliver Awareness notifications through Slack.
- [Microsoft Teams integration](https://docs.xfa.tech/docs/admin/awareness/awareness-teams-integration): Deliver Awareness notifications through Microsoft Teams.
- [Device verification by email](https://docs.xfa.tech/docs/admin/awareness/awareness-device-verification): Ask users to confirm newly discovered devices so admins can tie device activity to the right person.
- [Device risk notifications](https://docs.xfa.tech/docs/admin/awareness/awareness-device-risk): Alert users by email when an onboarded device fails a policy check, with guidance to fix it.
- [Self invite](https://docs.xfa.tech/docs/admin/awareness/awareness-self-invite): Let eligible users connect their own device to your organization from the XFA app after verifying their work email with a one-time code, without sending each of them an invitation.

## Enforcement: device checks at sign-in

- [Enforcement overview](https://docs.xfa.tech/docs/admin/enforcement): Add device security to sign-in by checking a device against your XFA policy before access continues.
- [Application filters](https://docs.xfa.tech/docs/admin/enforcement/application-filters): Limit an application policy to selected users, device types, or operating systems.
- [Built-in passkey](https://docs.xfa.tech/docs/admin/enforcement/mfa-methods/silent-mfa): Add device-based multi-factor authentication without interrupting users when the device is already trusted.
- [Custom onboarding and sign-in messages](https://docs.xfa.tech/docs/admin/enforcement/custom-messages): Add your own message to XFA's onboarding and sign-in cards to reinforce policies or link to internal resources.
- [SAML application](https://docs.xfa.tech/docs/admin/enforcement/application/saml-application): Insert device verification between a protected application and your identity provider over SAML.
- [OpenID Connect (OAuth 2.0) application](https://docs.xfa.tech/docs/admin/enforcement/application/oauth2-application): Insert device verification into an OpenID Connect sign-in flow, proxying the user to the app after the device is checked.
- [Configure XFA on Okta](https://docs.xfa.tech/docs/admin/enforcement/idp/okta): Add XFA as an Okta authenticator so device checks run during sign-in.
- [Configure XFA on Microsoft Entra ID](https://docs.xfa.tech/docs/admin/enforcement/idp/microsoft): Add XFA as an Entra ID External Authentication Method.
- [Configure XFA on Keycloak](https://docs.xfa.tech/docs/admin/enforcement/idp/keycloak): Add XFA as a post-login device-verification factor on Keycloak.
- [Configure XFA on OneLogin](https://docs.xfa.tech/docs/admin/enforcement/idp/onelogin): Add XFA as an authentication factor on OneLogin to verify devices during sign-in.
- [Configure XFA on Ping Identity](https://docs.xfa.tech/docs/admin/enforcement/idp/pingidentity): Add XFA as an authentication factor on Ping Identity to verify devices at sign-in.
- [Secure Slack](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-slack): Route Slack SAML SSO through XFA to verify devices at login.
- [Secure GitHub](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-github): Verify devices when users sign in to GitHub.
- [Secure Google Workspace](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/google-workspace): Verify devices when users sign in to Google Workspace.
- [Secure Atlassian](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-atlassian): Verify devices when users sign in to Atlassian.
- [Secure AWS IAM Identity Center](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-aws-iam-identity-center): Route AWS IAM Identity Center SAML sign-in through XFA to verify devices before access.
- [Secure HubSpot](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-hubspot): Verify devices when users sign in to HubSpot over SAML SSO.
- [Secure Monday](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-monday): Verify devices when users sign in to Monday.com over SAML SSO.
- [Secure Notion](https://docs.xfa.tech/docs/admin/enforcement/application/specific-guides/how-to-secure-notion): Verify devices when users sign in to Notion over SAML SSO.

## Agentless verification

- [Agentless overview](https://docs.xfa.tech/docs/admin/agentless): Assess supported devices at sign-in without the native agent, using browser signals, discovery data, and device-trust connectors.
- [Enable Agentless sign-in](https://docs.xfa.tech/docs/admin/agentless/enable-agentless-sign-in): A lighter sign-in path that verifies device security without installing the XFA agent; enable it in an application policy.
- [Chrome device trust](https://docs.xfa.tech/docs/admin/agentless/chrome-device-trust): Let managed Chrome profiles send device-posture signals to XFA during agentless sign-in via Chrome Enterprise Core.
- [Agentless sign-in for users](https://docs.xfa.tech/docs/users/agentless): Verify a device during sign-in without installing the app, when your organization allows it.

## Compliance integrations (GRC)

- [Integrations overview](https://docs.xfa.tech/docs/admin/integrations): Share device posture data with compliance platforms for audit evidence; these connectors report, they do not enforce.
- [Vanta](https://docs.xfa.tech/docs/admin/integrations/vanta): Share XFA device data with Vanta for compliance monitoring.
- [Drata](https://docs.xfa.tech/docs/admin/integrations/drata): Share XFA device data with Drata for compliance monitoring.
- [Thoropass](https://docs.xfa.tech/docs/admin/integrations/thoropass): Share XFA device data with Thoropass.
- [TrustCloud](https://docs.xfa.tech/docs/admin/integrations/trustcloud): Share XFA device data with TrustCloud.
- [Noru](https://docs.xfa.tech/docs/admin/integrations/noru): Export device compliance data to Noru for audit evidence.

## For users

- [User documentation home](https://docs.xfa.tech/docs/users): How to prove your work device meets your organization's security requirements without giving up control of the device.
- [Installation instructions](https://docs.xfa.tech/docs/users/installation-instructions): Download the right app, complete setup, and finish device verification.
- [Supported Linux systems](https://docs.xfa.tech/docs/users/installation-instructions/supported-linux-systems): The Linux distributions, versions, architectures and desktop environments XFA supports.
- [Update XFA](https://docs.xfa.tech/docs/users/update-xfa): How XFA keeps itself up to date, how to update it right away, and updating XFA installed through a NixOS system configuration.
- [Desktop application](https://docs.xfa.tech/docs/users/desktop-application): Verify security settings on Windows, macOS, and Linux without admin rights.
- [Mobile app](https://docs.xfa.tech/docs/users/mobile-app): Verify security settings on iOS and Android, and use your phone as a trusted device for MFA.
- [Connect to an organization](https://docs.xfa.tech/docs/users/connect-to-organization): Connect your device to an organization yourself from the desktop or mobile app by verifying your work email with a one-time code, when your organization allows self invite.
- [Agentless sign-in](https://docs.xfa.tech/docs/users/agentless): Verify your device during login without installing the app, when your organization allows it.
- [Reconnect a device](https://docs.xfa.tech/docs/users/reconnect-device): What to do when your organization sees your device as "Lost connection".
- [Uninstall XFA](https://docs.xfa.tech/docs/users/uninstall-xfa): When to disconnect from an organization versus fully removing the app.
- [Accessing application logs](https://docs.xfa.tech/docs/users/accessing-logs): Find the XFA desktop app's log files and share them safely with support for diagnostics.

## Resources: how-to guides

- [Migrate from MDM to XFA](https://docs.xfa.tech/docs/admin/resources/how-to/migrate-from-mdm-to-xfa): Replace MDM-based device-access rules with XFA step by step: map devices, configure policy, onboard, switch enforcement, remove the MDM.
- [Roll out XFA to a team](https://docs.xfa.tech/docs/admin/resources/how-to/roll-out-xfa-to-a-team): Plan a team rollout through Discovery, policy, testing, communication, Awareness, and Enforcement.
- [Find MDM gaps with XFA](https://docs.xfa.tech/docs/admin/resources/how-to/run-xfa-next-to-an-mdm): Run XFA alongside an existing MDM to surface devices outside MDM coverage and move access decisions to XFA at sign-in.

## FAQ

- [Admin FAQ](https://docs.xfa.tech/docs/admin/faq): Common questions about what XFA is, why it is not an MDM, privacy, what data is shared, and supported apps and identity providers.
- [User FAQ](https://docs.xfa.tech/docs/users/faq): Common questions about the device checks XFA runs and what your organization can and cannot see.

## Changelog

- [Changelog](https://docs.xfa.tech/changelog): Product updates, newest first.