Check device posture

Device posture adds device security requirements to Firezone Policies. Firezone matches a Client to records synced from your mobile device management (MDM) and endpoint detection and response (EDR) providers, then evaluates checks such as disk encryption, firewall status, and operating system updates before allowing access to a Resource.

When to use device posture

Use device posture when a device must meet security requirements to connect to Resources, in addition to belonging to an authorized user. Common examples include:

• Requiring disk encryption before accessing production systems.
• Restricting sensitive Resources to devices with active endpoint protection.
• Requiring an MDM compliance check and a recent device check-in.
• Requiring current operating system and Firezone Client versions.

Device trust proves that the Client holds a trusted device identity. Device posture evaluates the security state associated with that device. The two checks work together. Attestation does not by itself prove that a disk is encrypted or an endpoint agent is healthy.

How it works

Before Firezone can evaluate a device's security state, it needs to know which provider records belong to that device. It syncs records from your connected posture providers and matches them to Clients using the strongest shared identifier available. It first uses a certificate-attested MDM device ID, then a certificate-attested hardware serial number, then a Client-reported hardware serial number.

This is why device trust matters. Even a healthy provider record offers little assurance if another device can claim its identity.

You choose what a device must satisfy in each Policy's Device posture section. The Simplified and JSON tabs offer two ways to define those requirements.

For example, a Policy for a production database might require both disk encryption and active endpoint protection. A device must pass both checks, as well as the Policy's other conditions, to gain access through that Policy.

Checks also account for the device's platform. A mobile jailbreak requirement does not block a Windows laptop, because fields that do not apply are skipped. If a check applies but no provider supplies the data needed to pass it, that check fails.

These requirements belong to the Policy, so it matters which other Policies grant access to the same Resource. As with other Policy conditions, another matching Policy can still allow access without posture checks. A stricter Policy for the production database will not restrict a user who already has access through a broader one.

Set up Device Posture

Follow Set up Device Posture to connect a provider, verify device records, and add checks to a Policy. Choose your provider for connection instructions, permissions, supported checks, and troubleshooting.

• Microsoft Intune
• Iru (Kandji)
• Microsoft Defender for Endpoint
• Santa (Workshop)
• SentinelOne

CrowdStrike Falcon, Sophos XDR, Jamf Pro, Workspace ONE, and Mosyle are upcoming. Register interest in the portal to tell us which integrations and checks you need.

Choose between Simplified and JSON

The Simplified tab provides ready-made checks you can turn on without writing rules. Each check defines what counts as a passing result and which providers can supply it. Firezone combines your selections so that every applicable check must pass. This is a good starting point for common requirements such as disk encryption or MDM compliance. A check becomes available when a supporting provider is connected; the Firezone Client version check needs no external provider.

Use JSON when you need more control over the evidence or the logic. You can target individual provider fields, set your own thresholds, and combine rules with and, or, and not. For example, the simple Recently seen check accepts activity within the last seven days from any supported provider. With JSON, you could require an Intune check-in within the last 24 hours instead, along with an Intune compliance result. You can also check fields that have no ready-made toggle.

Both tabs edit the same underlying rules, so you can start with simplified checks and open JSON to see or customize them. Once your rules go beyond what the toggles can represent, continue editing them in JSON. Switching back to Simplified preserves those custom rules but does not let you edit them with the toggles.

See the JSON reference for the complete attribute list, supported operators, and examples. The same rules can be managed through the REST API, so you can automate Policy changes using the format shown in the JSON editor.

Simple posture checks

These are all the checks available in the Simplified tab. Provider names identify the source of the synced data; the checks reflect what those providers report about the device.

Posture reflects the records Firezone has synced, so changes depend on the provider reporting them and Firezone retrieving the updated data. Recently seen checks the provider's device activity timestamp, not the time Firezone last fetched that record.

Need help? See all support options.