Device compliance and posture
Evaluate freshness, apply device requirements, and distinguish unknown posture from compliant access.
Compliance policies evaluate reported device state against organization requirements. Access posture uses those results to decide whether a device can start or retain a permitted session.
Define requirements
You need Administrator authority over the target group. Each pilot endpoint must be enrolled and reporting; check Endpoints → Endpoint → Health before configuring posture-based admission.
- Open Policies → Compliance → Create policy. Select the required OS support, agent health, disk encryption, and screen-lock checks from the compliance schema.
- Assign the policy to a pilot group and inspect Policy → Preview for unsupported or missing checks.
- Publish the policy and confirm the pilot's applied revision under Policy → Adoption.
At Access → Posture policies → Create, select the published compliance policy and maximum observation age. max_age_seconds accepts integers from 60 through 86400 seconds and defaults to 900. Select that posture policy in the application's or VPN profile's access policy before testing admission.
Once an observation exceeds that age, its posture is unknown. A device with no current agent observation is also unknown. Policies requiring posture deny new sessions for unknown or noncompliant devices unless an approved access exception applies.
Interpret a result
At Endpoints → Endpoint → Compliance, inspect compliant, noncompliant, or unknown, the evaluated revision, check time, and per-check reasons. A check that cannot run on the platform reports unknown or unsupported rather than passing. A result describes the last observation, not continuous proof that the device remains unchanged.
Have the device administrator correct the failed check using the guidance in the endpoint's compliance result. Then select Endpoint → Compliance → Recheck. Wait for a new check timestamp and inspect its per-check results before retrying access; an accepted recheck request does not update posture until the device reports.
Active sessions and exceptions
At Access → Application → Session policy, configure posture re-evaluation and session expiry. A changed posture can revoke sessions when the gateway receives and applies that change. Existing traffic might persist until enforcement reaches the gateway or the session expires; policy publication is not an instantaneous network cutoff.
Use Access → Exceptions → Create for an individually approved, expiring access exception. Record the owner and alternative control. Verify revocation after expiry in Access → Sessions. An offline endpoint keeping its old local policy cannot establish current posture for new remote access. See ZTNA and VPN.