Insights · Field note · Security assurance and compliance
Device posture and conditional access
Valid credentials on an unmanaged, unpatched laptop should not open the finance system. Posture is the control that says no.
Device posture is the security state of a device at the moment it requests access: managed or not, encrypted, patched, running endpoint protection, free of known compromise. Conditional access is the policy that uses posture, identity and context to decide what each request may reach. Together they address the cases a password and a code cannot: the personal laptop, the contractor device, the phone with no passcode, the machine whose agent stopped reporting. The requirement is device management with a defined standard, an access layer that can read the state, and policies that degrade access gracefully rather than blocking everyone on day one.
In detail
What the evidence shows.
Define the standard
What a compliant device looks like: enrolled in management, disk encrypted, operating system within a defined patch window, endpoint protection present and healthy, screen lock enforced. The standard is written down, because it is what the policy enforces and what exceptions are measured against.
Connect posture to access
The identity platform reads device state from the management and endpoint tools. Policies then decide: compliant managed device reaches everything the identity permits; unmanaged device reaches web email only, or nothing; a device with a detection is blocked until cleared. The decision is per request, so a device that falls out of compliance loses access without anyone intervening.
Rolling it out without a revolt
Report-only mode first, to see who would be blocked and why. Then enforce for the most sensitive applications. Then expand. Give people a path to compliance that works the same day. Exceptions are time-limited and recorded. Most resistance comes from surprise, and report-only mode removes it.
What it addresses
Home working, personal devices, contractors, executives’ phones and the long tail of devices nobody enrolled. It is the control that makes identity-based access safe. See device posture and endpoint controls, endpoint protection oversight and the glossary entry for device posture.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days