Authentication Is Necessary but Not Sufficient
Knowing who is logging in is important. But consider this scenario: a legitimate employee authenticates successfully with their Passkey, but they are doing so from a personal laptop that has not received a security patch in 18 months, has no endpoint detection software running, and has been compromised by malware that is silently exfiltrating data in the background.
The authentication succeeded. The access should still be denied.
Device Posture (also called Health Attestation or Device Compliance) extends the authentication decision to include the state of the device making the request. It answers the question: "Even if I trust who you are, do I trust the device you're using?"
How Posture Checks Work
Device posture is typically enforced through a combination of:
- An endpoint agent: A lightweight software agent installed on managed devices (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or a dedicated MDM agent from Jamf or Intune). This agent continuously monitors device state and can report it to the identity provider.
- The SSO/Identity Provider: Platforms like Okta, Azure AD (Entra ID), or Google BeyondCorp receive posture signals from the endpoint agent and incorporate them into access decisions.
- Policy enforcement: The identity provider evaluates the posture signals against a policy before issuing an access token.
Common posture signals checked:
| Signal | What It Checks |
|---|---|
| OS Version | Is the operating system at or above the minimum required patch level? |
| Disk Encryption | Is BitLocker (Windows) or FileVault (macOS) enabled? |
| Screen Lock | Is an automatic screen lock configured? |
| Jailbreak/Root | Has the OS security model been bypassed? |
| EDR Agent | Is an approved endpoint detection and response agent running and healthy? |
| Certificate | Does the device have a valid corporate certificate (proving it is managed)? |
| Firewall | Is the host-based firewall enabled? |
The Access Decision Flow
When a user authenticates, the identity provider does not just check the credential — it queries the posture state and applies a policy:
A user on a non-compliant device might see: "Your device does not meet security requirements. Please update your OS to macOS 14.x or later and ensure FileVault is enabled." This is far more actionable than a generic "Access Denied."
Posture in Zero Trust Architecture
Device posture is a foundational component of Zero Trust — the security model that assumes no network location or device is inherently trusted. In a Zero Trust architecture, every access request is evaluated against multiple signals: user identity, device posture, network location, resource sensitivity, and behavioral anomalies. Posture checks are what make "never trust, always verify" operationally meaningful rather than just a slogan.