About Device Posture⁠

Operating System

Determines whether a device running a specific operating system is allowed to connect.

Windows, macOS, Android, iOS, Linux

Used to restrict access by OS type.

Operating System Version

Allows or denies connection based on whether the OS version is:

• equal to

• greater than or equal to

• less than or equal to

a specified version number.

Windows, macOS, iOS, Android

Examples:

• Windows: 10.0.22631

• macOS: 14.5

• iOS: 17.5.1

• Android: 14

Antivirus

Requires at least one supported antivirus product to be running on the device before allowing connection.

On Windows, you can add a custom antivirus by entering its name in Or add a custom antivirus and selecting Add. Up to 5 custom names, 2-100 characters each (letters, digits, space, and _ - . + ' ( ) / :).

You can combine custom names with products from the list. A device passes if any selected antivirus is running.

Windows, macOS

Supported products: CrowdStrike Falcon, Norton, Bitdefender, McAfee, Avast, ESET, AVG, Avira, SentinelOne, Malwarebytes, Microsoft Defender (Windows only), Sophos

Custom antivirus (Windows only): Enter the product name exactly as it's registered in Windows Security Center. To find the registered name:

1. Open Windows Security (Start menu → Windows Security).

2. Select Settings → Manage providers.

3. Under Antivirus, note the name exactly as shown. Example: Microsoft Defender Antivirus.

Client Certificate

Requires the device to present a certificate that matches the one uploaded to the posture policy (in .pem format).

Matching succeeds if either:

• The device presents the exact same certificate as uploaded, or

• The uploaded certificate is a CA certificate (Root or Intermediate), and the device presents a Leaf certificate directly signed by it (one-level chain only; no additional Intermediate certificates allowed).

This applies to certificates issued by any certificate authority (public or private), provided the relationship is direct and unambiguous, including self-signed certificates and local CA certificate chains.

Windows, macOS

Uploaded certificate must be .pem. Device certificate must be .p12 or .pfx and located in the Current User/Personal folder for Windows or keychain/login for macOS. Supports RSA (≥2048) or ECDSA (≥256).

Disk Encryption

Requires disk encryption to be enabled before allowing connection.

Windows, macOS

macOS: FileVault

Windows: BitLocker (full disk or specific volume)

Process Check

Requires specified processes to be running on the device before allowing connection.

Enter the full or partial process path for up to five processes, then choose:

• AND: All specified processes must be running.

• OR: At least one specified process must be running.

Each process path must be 3-260 characters (letters, digits, space, and _ - . + ' ( ) / :).

macOS

You can use this check alongside the Antivirus check to cover security products that aren’t in the supported list.

Linux Distribution and Version

Allows connection only from the Linux distributions you select. Devices running any other distribution are blocked.

Each selected distribution can optionally include a version condition (equal to, greater than or equal to, or less than or equal to). Without a version condition, any version of that distribution is allowed.

Linux

Predefined distributions: Ubuntu, Debian, Fedora, and Red Hat Enterprise Linux.

You can add other distributions by their os-release ID (for example, linuxmint, rocky, or almalinux), up to 10 distributions in total.

Rocky Linux and AlmaLinux have their own IDs. Selecting Red Hat Enterprise Linux doesn't cover them.

Each distribution numbers its versions differently (for example, Ubuntu 24.04, Debian 12, Fedora 42, RHEL 9.6). Rolling-release distributions, such as Arch and Manjaro, don’t report a version, so don’t set a version condition for them.

Custom distribution IDs use lowercase a-z 0-9 . _ -, up to 64 characters. You can select each distribution only once. If a version condition is set and the device reports no version (rolling releases), the device is blocked.

Kernel Version

Allows or denies connection based on whether the Linux kernel version is:

• equal to

• greater than or equal to

• less than or equal to

a specified version.

Linux

Example: 6.8.0

The kernel version is independent of the distribution release. For example, Ubuntu 24.04 ships with kernel 6.8.