Review available enrollment options for your device or OS user. This affects how and when traffic interception starts based on the login status of the designated user.

Zero Trust Access enrollment modes define how the client enrolls and provides resource access for supported device and user scenarios. Modes use SSO or certificate authentication as part of the enrollment process.

Table 1. ZTA Enrollment Mode Deployment Matrix
Enrollment Mode	Enrollment Configuration Required?	Identity Certificate
Default (SSO: Post-Login)	N/A	N/A
Certificate: Post-Login	Required	Required (User Store)
SSO: Pre-login & Post-login (single-user device)	Required	N/A
Certificate: Pre-login & Post-login (single-user device)	Required	Required (User Store)

Enrollment Authentication Types

There are two general enrollment authentication types you can select from. See the relevant limitations per enrollment mode in the Enrollment Mode section below.

SSO authentication: Authenticates users through the identity provider configured for the organization. For more information see Enroll Devices in Zero Trust Access Using SSO Authentication Overview.
Certificate authentication: Uses a user identity certificate installed on the device. For more information see Enroll Devices in Zero Trust Access Using Certificates.

Enrollment Modes

Configuring a ZTA enrollment mode for your users allows an end-user device to securely access private an internet resources. Review the following enrollment modes and determine the one that is ideal for your environment.

Note
While you can have multiple users in your organization, the pre-login enrollment mode only supports one active user. If a different OS user logs into the OS than the one responsible for the original ZTA enrollment, ZTA deactivates a for the device and the new user does not have any option to enroll.

Default

The default mode ships with the client. In the default commercial environment, it supports SSO and cert-based authentication. It is designed for devices without concurrent OS user sessions and does not provide access before OS login.

Note

In certain non-commercial environments, SSO enrollment requires an organization- and environment-specific enrollment configuration file.

Pre-login & Post-login (single-user device)

This mode is intended for single-user devices and supports access before OS login. Enabling this mode requires an enrollment configuration file on the device. After the user logs in to the OS and enrolls in ZTA, access remains available when that user logs out. All access from the device is associated with the enrolled user. Both authentication methods (SSO and cert) are supported authentication options for this mode.

Limitations

Windows OS support only.
The user must have already logged in and enrolled at least once before access is enabled for Pre-login sessions.
Sessions that occur during pre-login does not support step-up authentication.
For sessions that occur during pre-login, posture is limited to OS version checks. Once the user logs in, the full set of ZTA client posture attributes are available.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.