IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Device trust, conditional access and ZTNA
Priya has three screens: her company laptop, her own tablet on the sofa, and a shared PC in a hotel. Should all three get the same access to payroll? Until now we asked who is signing in. This lesson adds a second question: from what device? Your goal: write access rules that let the device help decide, and know what they cannot see.
- A device has its own identity and a health check.
- Conditional access joins user, device and risk into one decision.
- ZTNA connects a user to one app at a time. A VPN gives a whole network.
- A stolen session cookie can skip all sign-in rules.
A goods lorry at a factory gate. The guard checks two papers: the driver's licence shows who is driving, and the fitness certificate shows the lorry is safe to run. A licensed driver in an unfit lorry is turned back. The user is the driver, and the device is the lorry.
A device needs an identity too
A password or passkey proves who the person is. It says nothing about the machine. NIST's zero trust guide (SP 800-207) gives no trust for network location alone. So the device gets its own identity too. A laptop that joins the company directory (Active Directory or Microsoft Entra ID; Samba AD and FreeIPA are open equivalents) gets its own credentials, usually a key pair and a certificate.
Is the device healthy?
Knowing which device asks is half the story. The other half is its health. MDM (mobile device management) lets the company push settings to an enrolled device and read its state. Unified endpoint management (UEM) does this for laptops, phones and tablets from one console.
The management system checks each enrolled device and reports its device compliance, compliant or not, to the identity provider. Only enrolled devices have a compliance state. An unenrolled tablet cannot be compliant.
Conditional access: if this, then that
Conditional access joins these signals into one decision at sign-in. Think of if-then rules: if a user wants a resource, then they must meet certain conditions. Microsoft's Entra ID Conditional Access is the well-known example. Every rule that matches applies, and every requirement it sets must be met.
Typical rules read like this:
- Admins must use phishing-resistant sign-in from a managed device (privileged access workstations).
- The finance app needs a compliant device.
- Sign-ins flagged as high risk are blocked.
- Old mail protocols that cannot show an MFA prompt are blocked outright. Otherwise a password alone still works through them.
ZTNA vs VPN: one door per app
A VPN checks you once and places your device on the company network. From there it can reach anything not separately locked. That is the castle model that zero trust rejects.
ZTNA (zero-trust network access) works differently. A broker acts as the policy enforcement point. It checks the user and the device for each app session, then connects the user to that one app only. The apps are usually not exposed to the internet. So malware on a compliant laptop has no network to scan.
Conditional access decides at sign-in, so it has blind spots. A session cookie or refresh token stolen from a compliant laptop and replayed elsewhere skips sign-in completely. See session hijacking, sender-constrained tokens and continuous evaluation.
Look for gaps: exclusions that pile up, apps no rule covers (including new ones), old protocols, and new device types. Test new rules first in report-only mode. Keep your break-glass accounts excluded, with an alert on every use.
Priya's work laptop is stolen from a café. Zara marks it lost in device management. It becomes non-compliant, and every rule that needs a compliant device says no. On Wednesday Priya signs in from a new laptop, enrolled in minutes.
Go deeper: Where the device key lives: TPM
Where the private key lives matters. A TPM (Trusted Platform Module) is a small security chip in most modern PCs. Some are a protected part of the main processor. Phones have a similar secure area. A key made inside the TPM can be made unusable anywhere else, so it cannot be copied off the machine. A stolen password cannot make an attacker's laptop look like Priya's. The TPM can also record how the machine started. Later, the device can prove it booted with the expected firmware and operating system. That proof is called attestation.
Go deeper: What a healthy device looks like
- The operating system is a supported version, with recent security updates.
- Disk encryption is on, and a screen lock with a PIN or biometric is set.
- Endpoint protection is running and reports no active threat.
- The device is not jailbroken or rooted.
The identity provider can use the compliance report at sign-in. On the open-source side, osquery shows a machine's state as tables. You can query them with SQL. Fleet builds device management and health checks on top of it.
Go deeper: More on conditional access
Open-source identity providers do the same differently. Keycloak's authentication flows, for example, can branch on conditions such as a user's role or attributes. A general policy engine can also decide at a proxy. It uses the enforcement and decision points from zero trust & context.
In Microsoft Entra ID, policies are enforced after the first factor succeeds. They decide what a correct password gets, but they do not stop password guessing. Microsoft even suggests targeting privileged access workstations with device filters.
Go deeper: Managed, personal and not-mine-at-all devices
💼 Managed laptop
Enrolled, compliant, with an identity backed by the TPM. It gets the widest access. It is still checked at every sign-in, because compliance can change overnight.
📱 Personal device (BYOD)
BYOD means "bring your own device." Many people will not give an employer control of their whole phone. So companies often manage just the work app and its data. They block copying into personal apps, and wipe only work data if the device is lost. Or they allow browser-only access. See BYOD.
🖥️ Unknown or shared device
The hotel PC. It has no identity and no health signal, and it may have a keylogger. At most it gets a limited browser session for low-risk apps, with no downloads and no admin portals. Often it gets no access.
Go deeper: VPN compared with ZTNA
| VPN | ZTNA | |
|---|---|---|
| What you get | A place on the network | A connection to one application |
| When trust is checked | Mostly once, when the tunnel opens | For every app session, and again when conditions change |
| Device signals | Often none | Device identity and compliance feed each decision |
| If a device is compromised | The attacker can explore and move sideways | The attacker reaches only what that user and device were allowed |
| What faces the internet | The VPN gateway itself, a repeat target | The broker. The apps stay hidden behind it |
The last row is not just theory. In January 2024, CISA issued emergency directive ED 24-01. It ordered US federal agencies to deal with actively exploited flaws in one widely used VPN product line.
Go deeper: ZTNA shapes and open-source examples
NIST SP 800-207 describes common ZTNA shapes. In the agent and gateway style, software on a company-managed device works with a gateway in front of each resource. You get strong device signals, but only for devices you manage. In the portal style, users reach apps through a portal with no agent. That suits personal devices, but the company learns much less about the device.
Open-source projects show the pattern. OpenZiti makes services reachable only through authenticated, policy-checked connections. Pomerium is an identity-aware reverse proxy. CISA's Zero Trust Maturity Model (version 2.0, April 2023) makes devices one of its five pillars.
🧪 Interactive lab — enable JavaScript to play with this one.
Install osquery (open source). Start osqueryi and run SELECT name, version, platform FROM os_version;. Then browse the other tables for disk encryption and running software. That is the raw material a compliance policy judges. For the ZTNA side, try the OpenZiti introduction.