Platform / Device trust & posture
Device trust & posture
Every device that touches your estate is enrolled, attested and continuously checked — not trusted on sight.
Case by case
An unmanaged laptop tries to open a sensitive app.
It has no device certificate and fails the posture check, so access is refused before the password even matters.
→ Unknown devices do not get a turn.
A managed machine falls out of compliance overnight — disk unencrypted, a patch missing.
The posture signal flips, its certificate is constrained and its access is stepped up or cut on the next check.
→ Health is continuous, not a one-time gate.
A phone enrols for the first time.
Hardware attestation on Apple or Android proves the device is genuine before it ever receives a credential.
→ Trust rooted in hardware, not a checkbox.
Under the hood
What you actually get
Device identity and health, issued and enforced from the same fabric that governs people.
Enrolment and identity
Token-based enrolment issues a per-device certificate and identity, so every endpoint is a first-class, nameable subject rather than an anonymous address.
Hardware attestation
Apple and Android platform attestation, plus TPM-backed keys, prove a device is genuine and its keys are hardware-protected before trust is granted.
Continuous posture
Compliance evaluated against versioned baselines — encryption, patch level, MDM state — with drift flipping the device state between checks, not once at login.
Certificate lifecycle
Device and service certificates issued over SCEP and ACME, auto-renewed before expiry and revoked through a CRL when a device is lost or blocked.
MDM and disk-encryption signals
Posture draws on MDM enrolment state and BitLocker-style disk-encryption status, so health reflects what the device actually is, not what it claimed once.
Bound to access
Device trust gates console sign-in, the application gateway and privileged access — a blocked device has its bound sessions torn down everywhere.
Felt first by: Endpoint, security operations and the IAM team. · Take this on its own — every edge speaks the standards your estate already speaks, so replacing it later stays cheap.