Check disk encryption, operating system patch levels, hardware keys, and EDR agent status during authentication. When a device requires updates, users resolve the issue directly through guided instructions.
| Endpoint & Owner | OS & Patch State | Hardware Key & Disk | EDR Sensor | Auth Status |
|---|---|---|---|---|
| mchen-mbp16.corp Mia Chen · Staff Platform Eng | macOS 15.3.1 (24D70) | FileVault 2 · Secure Enclave | CrowdStrike 7.20 | ● Verified |
| mvance-x1c12 Marcus Vance · Product Design | Windows 11 24H2 | BitLocker XTS-256 · TPM 2.0 | Defender ATP | ● Grace (18h left) |
| elena-ws-ubuntu Elena Rostova · Applied ML | Ubuntu 24.04.2 LTS | LUKS2 · TPM 2.0 AK | Falcon Linux 7.18 | ● Verified |
| ext-audit-laptop09 D. Patel · Contractor BYOD | Windows 11 23H2 | Unencrypted NTFS | No sensor | ● Blocked |
| jross-iphone16pro Jordan Ross · Enterprise Sales | iOS 18.3.1 | SEP Attested · Biometric | Managed MDM | ● Verified |
| kcho-mba-m3 Kevin Cho · Revenue Operations | macOS 15.1.0 (Pending) | FileVault 2 · Secure Enclave | SentinelOne 24.1 | ● Slack Notified |
Trusted by security engineering and IT teams securing modern cloud infrastructure
When a device fails a policy check, users see the exact requirement and clear instructions to resolve it. This maintains access security without generating helpdesk tickets.
Set warning periods for pending updates so employees have time to install patches before access is blocked.
Users receive exact steps for their operating system to enable disk encryption, update browsers, or enable system firewalls.
After applying a fix, users click Re-check device to evaluate posture immediately and complete sign-in.
Okta SSO → GitHub Enterprise
Your MacBook Pro is currently running macOS 15.1.0. Northstar FinTech requires critical kernel updates within 7 days of release before accessing source code repositories.
DeviceTrust connects to your identity provider as a standard SAML 2.0 or OIDC authentication factor. It does not require network proxies, VPN tunnels, or SSL inspection certificates.
User authenticates to Okta, Microsoft Entra ID, Google Workspace, or PingFederate. Your IdP delegates device verification via OIDC / EAM.
The local agent signs a cryptographic nonce using a non-exportable private key stored in Apple Secure Enclave or Windows/Linux TPM 2.0.
The agent verifies OS patch level, disk encryption, screen timeout, host firewall, and EDR sensor health.
Compliant devices receive an instant signed claim back to the IdP. Drifted endpoints see guided self-service remediation instructions.
Use built-in templates or write custom osquery SQL queries to audit workstation configuration, browser extensions, developer tools, and running services.
-- Fails sign-in if root filesystem volume is not encrypted SELECT d.name AS volume_name, d.type AS cipher_mode, d.encrypted FROM disk_encryption d JOIN mounts m ON m.device_alias = d.name WHERE m.path = '/' AND d.encrypted = 0;
Close visibility gaps across corporate laptops, Linux engineering workstations, and contractor devices without heavy management profiles.
Binds device certificates directly to TPM 2.0 and Apple Secure Enclave silicon so session tokens and posture claims cannot be cloned or replayed.
Enrich existing Jamf Pro and Microsoft Intune deployments, or verify unmanaged contractor and Linux developer machines where MDM doesn't reach.
Re-assess endpoint posture automatically when privilege levels elevate, such as accessing production cloud roles, bastion hosts, or sensitive internal consoles.
Continuously push verified device inventory and encryption posture into Vanta and Drata, eliminating manual quarterly screenshot collection.
Ship structured JSON authentication decisions and fleet differential telemetry directly to Amazon S3, Splunk, Snowflake, or CrowdStrike LogScale.
Employees can inspect every data point the agent collects directly from their desktop application menu, backed by strict policy boundaries.
"We had 180 Linux engineers and 60 external contractors sitting completely outside Jamf and Intune. DeviceTrust closed that Okta sign-in gap in a single afternoon. Because users remediate their own missing updates, our IT ticket volume actually dropped."
Deploy a dedicated sandbox connected to your test Okta, Entra ID, or Google Workspace tenant in 15 minutes.
DeviceTrust uses passwordless Single Sign-On federated through your organization's identity provider. Launch from your corporate app chiclet or select a provider: