About Device Posture⁠

Operating System

Determines whether a device running a specific operating system is allowed to connect.

Windows, macOS, Android, iOS, Linux

Used to restrict access by OS type.

Operating System Version

Allows or denies connection based on whether the OS version is:

• equal to

• greater than or equal to

• less than or equal to

a specified version string (major.minor.patch).

Windows, macOS

Example: 3.5.124

Antivirus

Requires at least one supported antivirus product to be running on the device before allowing connection.

Windows, macOS

Supported products: CrowdStrike, Falcon, Norton, Bitdefender, McAfee, Avast, ESET, AVG, Avira, SentinelOne, Malwarebytes, Microsoft Defender (Windows only), Sophos

Client Certificate

Requires the device to present a certificate that matches the one uploaded to the posture policy (in .pem format).

Matching succeeds if either:

• The device presents the exact same certificate as uploaded, or

• The uploaded certificate is a CA certificate (Root or Intermediate), and the device presents a Leaf certificate directly signed by it (one-level chain only; no additional Intermediate certificates allowed).

This applies to certificates issued by any certificate authority (public or private), provided the relationship is direct and unambiguous, including self-signed certificates and local CA certificate chains.

Windows. macOS

Uploaded certificate must be .pem. Device certificate must be .p12 or .pfx and located in the Current User/Personal folder for Windows or keychain/login for macOS. Supports RSA (≥2048) or ECDSA (≥256).

Disk Encryption

Requires disk encryption to be enabled before allowing connection.

Windows, macOS

macOS: FileVault

Windows: BitLocker (full disk or specific volume)