Manage Zero Trust Access Posture Profiles

Navigate to Secure > Profiles > Endpoint Posture Profiles.

For Zero Trust Connection, click Add Posture Profile and choose Client-based.

Give your posture profile a unique Name.

In the Operating System window, choose the operating systems for your profile. Click Save and Exit or Next to select endpoint security agents. See Supported Operating Systems for more information.

In the Operating System window, select the Grace Period for your device OS version. This value determines how long the operating system version is allowed to be out of date before the device itself is no longer supported. As an admin you can specify grace periods to provide users time to update their devices' OS to comply with latest updates and OS expiry. These grace periods indicate how long after expiry the OS may still be accepted as meeting posture requirements.

For the Firewall option, choose the firewall for your profile. Click Save and Exit or Next to select endpoint security agents. See Firewall Requirements.

For the Endpoint security agents option, choose an endpoint security agent from the drop-down menu for your preferred profile. Configure what the endpoint agent action requires for action with either Any or All; when applicable, use the additional drop-down menus to select the type and version of the agent. Click Save and Exit or Next to continue. See Endpoint Security Agents.

For the System password option, choose whether to enforce a system password for the endpoint. Click Save and Exit or Next to select disk encryption. See Endpoint Security Agents.

For the Disk encryption option, choose the disk encryption package(s) for your profile. Click Save and Exit or Next to enforce whether the device should join a Windows domain. See Disk Encryption.

For the Windows domain joined option, check the box to enforce verification that the device has joined a domain. Click Save and Exit or Next to return to the OS requirements. See Windows Domain Join for more information. Ensure you select the device type you have, either an on-premises Active Directory or Microsoft Entra domain and enter the appropriate information for Domain Security Identifiers (SID) or Tenant IDs respectively.

Note

To locate the SID value, we recommend opening Powershell and executing the following command:

get-ad-domain | select name, domainsid
(Get-ADDomain).DomainSID.Value

Note that the last six digits of this return is the relative identifier and is not supported as part of the SID value. SID values should be in this format: S-1-5-21-1292428093-839522115-1801674531.

Click Next. Alternatively, click Save and Exit to leave the profile temporarily incomplete.

Navigate to Secure > Profiles > Endpoint Posture Profiles.

For Zero Trust Connection, click Add posture profile, and choose Browser-based.

Give your posture profile descriptive Name.

Select the required operating systems from the drop-down list.

Under Grace period to install the latest version, from the Update is required drop down list, select the desired grace period based on your organization policy. You can choose from available day options, such as within 14 days. ClickSave and exit or Next to select supported browsers.

Add the required browsers from the drop-down list. Click Save and Exit or Next to select supported posture requirements.

Note

The browser type you select must have already been integrated with Secure Access. If you have not integrated any third-party service, then you cannot continue with this procedure. For more information see Manage Third-Party Integrations.

Under Browser version requirements, from the Update is required drop down list, select the desired period based on your organization policy.

• You can choose from the available day options, such as within 14 days.

Note

The Update required feature is applicable only when the "latest" clause is selected. When you choose the "latest" clause, if a user's browser is not on the latest version, access will be denied. This ensures that only browsers with the most current version are allowed to connect, enhancing security by enforcing up-to-date browser versions.

Under Supported browser version, select the check box for the browser versions you want to allow from the left pane. Click the right arrow button to move the selected versions to the right pane. Click Save and exit or Next to proceed to supported posture requirements.

• You can choose from any of the available version options (such as the latest version, current version, and previous versions).

Add the posture requirements for the browser you selected:

1. (Optional) Firewall: Specify the required platform-native firewall to run on the end-user device.
   
2. Disk encryption: Specify the required platform-native disk encryption to run on the end-user device.
   

Click Save and Exit to complete the posture profile. Optionally, click Next to modify the selected operating systems.

Navigate to Secure > Profiles > Endpoint Posture Profiles.

For Zero Trust Connection, click Add posture profile and choose Browser-based.

On the Browser tab, navigate to supported browsers.

Click View details.