Get a specific device by ID

Coarse administrator MFA approval badge visible only to Administrators.

ID of the device

Timestamp when the device was submitted (max of verified and discovery)

Timestamp when the device was last submitted by the XFA agent (verified device)

Timestamp when the device was last submitted by a discovery provider (Microsoft, Google, Okta, etc.)

Name of the operating system

Version of the operating system

Build number of the operating system (e.g. for iOS)

Flavour of the operating system

Whether the operating system is a long-term-support release (Ubuntu LTS / ESM)

Whether the operating system is up to date

Days OS is outdated

Timestamp of the last full system update on a rolling-release distro (e.g. pacman -Syu on Arch Linux). Rolling releases are evaluated on update recency + local CVE audit rather than a version number, so os_version is not meaningful (it is typically "rolling").

Whether a local security audit tool (e.g. arch-audit) detected known package vulnerabilities on a rolling-release distro. Basis for the OS up-to-date decision on rolling releases.

Whether the operating system is evaluated by policy

Whether the operating system auto-updates

Whether the operating system auto-update is evaluated by policy

Android security level

Manufacturer of the device

Model of the device

Identifier of the device model

Name of the browser last used

Whether the browser is up to date

Whether the browser is evaluated by policy

Version of Chrome browser

Whether Chrome is up to date

Days Chrome is outdated

Whether Chrome Safe Browsing is enabled

Whether Chrome Safe Browsing is evaluated by policy

Whether Chrome Safe Browsing Enhanced is enabled

Whether Chrome Safe Browsing Enhanced is evaluated by policy

Whether Chrome Do Not Track is enabled

Whether Chrome Do Not Track is evaluated by policy

Whether Chrome DNS over HTTPS is enabled

Whether Chrome DNS over HTTPS is evaluated by policy

Version of Firefox browser

Whether Firefox is up to date

Days Firefox is outdated

Whether Firefox HTTPS Only mode is enabled

Whether Firefox HTTPS Only mode is evaluated by policy

Whether Firefox DNS over HTTPS is enabled

Whether Firefox DNS over HTTPS is evaluated by policy

Whether Firefox Enhanced Tracking Protection is enabled

Whether Firefox Enhanced Tracking Protection is evaluated by policy

Whether Firefox Enhanced Tracking Protection Strict mode is enabled

Whether Firefox Enhanced Tracking Protection Strict mode is evaluated by policy

Version of Edge browser

Whether Edge is up to date

Days Edge is outdated

Version of Safari browser

Whether Safari is up to date

Days Safari is outdated

Version of Brave browser

Whether Brave is up to date

Days Brave is outdated

Version of Arc browser

Whether Arc is up to date

Days Arc is outdated

Version of Opera browser

Whether Opera is up to date

Days Opera is outdated

Version of Vivaldi browser

Whether Vivaldi is up to date

Days Vivaldi is outdated

Whether disk encryption is supported

Whether disk encryption is active

Whether disk encryption is evaluated by policy

Whether antivirus is enabled

Name of the detected antivirus product

Whether the antivirus product is installed

Whether the antivirus product is running

Whether the antivirus definitions are up to date

Completeness of the latest native antivirus measurement.

Server timestamp of the antivirus measurement; unrelated device updates do not refresh it.

Server-assigned source of the antivirus measurement.

Whether antivirus is evaluated by policy

Whether firewall is enabled

Whether firewall is evaluated by policy

Whether Find My Device is enabled

Whether Find My Device is evaluated by policy

Whether Vanta client is running

Whether Vanta client running is evaluated by policy

Whether Aikido Safe Chain is supported on this device's OS (cross-platform: mac/linux/windows)

Whether Aikido Safe Chain is installed on the device

Whether Aikido Safe Chain shell-profile integration is active (the wrapper is on PATH and intercepts package-manager calls)

Installed version of Aikido Safe Chain (from safe-chain --version)

Latest known Aikido Safe Chain version (from xfa-versions-service)

Whether the installed Aikido Safe Chain version matches the latest known version

Whether Aikido Safe Chain is evaluated by policy

Whether Aikido Endpoint is supported on this device's OS (macOS only today)

Whether the Aikido Endpoint agent is installed on the device

Whether the Aikido Endpoint system extension is active

Installed version of Aikido Endpoint (from the bundle's Info.plist)

Latest known Aikido Endpoint version (from xfa-versions-service)

Whether the installed Aikido Endpoint version matches the latest known version

Whether Aikido Endpoint is evaluated by policy

Whether the device is enrolled in Intune

Whether Intune enrollment is evaluated by policy

Whether the SentinelOne EDR agent is installed on the device

URL of the SentinelOne management console

Site name in the SentinelOne management console

Whether SentinelOne installation is evaluated by policy

Time since the device was last booted, in days

Version of Microsoft Word

Whether Microsoft Word is up to date

Whether Microsoft Word is evaluated by policy

Version of Microsoft Excel

Whether Microsoft Excel is up to date

Whether Microsoft Excel is evaluated by policy

Version of Microsoft PowerPoint

Whether Microsoft PowerPoint is up to date

Whether Microsoft PowerPoint is evaluated by policy

Version of Microsoft Outlook

Whether Microsoft Outlook is up to date

Whether Microsoft Outlook is evaluated by policy

Version of Microsoft Teams

Whether Microsoft Teams is up to date

Whether Microsoft Teams is evaluated by policy

Version of Slack

Whether Slack is up to date

Whether Slack is evaluated by policy

Version of Zoom

Whether Zoom is up to date

Whether Zoom is evaluated by policy

Version of Skype

Whether Skype is up to date

Whether Skype is evaluated by policy

Version of Adobe Acrobat Reader

Whether Adobe Acrobat Reader is up to date

Whether Adobe Acrobat Reader is evaluated by policy

Version of Adobe Acrobat Standard or Pro

Whether Adobe Acrobat Standard or Pro is up to date

Whether Adobe Acrobat Standard or Pro is evaluated by policy

Version of Foxit Reader

Whether Foxit Reader is up to date

Whether Foxit Reader is evaluated by policy

Version of Sumatra PDF

Whether Sumatra PDF is up to date

Whether Sumatra PDF is evaluated by policy

Version of Nitro PDF Reader

Whether Nitro PDF Reader is up to date

Whether Nitro PDF Reader is evaluated by policy

Whether the device is jailbroken

Whether the device being jailbroken is evaluated by policy

Whether the device is rooted

Whether the device being rooted is evaluated by policy

Whether developer mode is enabled

Whether developer mode is evaluated by policy

Whether secure boot is enabled

Whether secure boot is evaluated by policy

Security status indicating compliance level

Whether remote login is enabled

Whether remote login is evaluated by policy

Whether remote management is enabled

Whether remote management is evaluated by policy

Whether screen sharing is enabled

Whether screen sharing is evaluated by policy

Whether remote scripting is enabled

Whether remote scripting is evaluated by policy

Whether unattended remote access is enabled

Whether unattended remote access is evaluated by policy

Whether integrity protection is enabled

Whether integrity protection is evaluated by policy

Integrity protection status

Whether DNS servers are evaluated by policy

Whether DNS servers are compliant

DNS validation mode

Security status indicating compliance level

Whether device has recently rebooted

Whether recent reboot is evaluated by policy

Whether Windows Recall is evaluated by policy

Whether XFA version is evaluated by policy

Whether XFA is up to date

Days XFA is outdated

Whether password manager is evaluated by policy

Whether native client is installed

Whether native client installation is evaluated by policy

Whether authentication is active

Whether authentication is evaluated by policy

Biometrics information

Whether biometrics is evaluated by policy

Whether unsigned applications are evaluated by policy

Whether install protection is evaluated by policy

Whether blocklisted applications are evaluated by policy

Whether the device is managed

XFA version

Whether the device is connected

ID of the device into which this device is merged

Whether the device is skipped

Whether the device is unsupported

Whether the device is discovered

Whether the device is discovered by Okta

Set on a discovered device whose details the organization's plan does not include (hide_discovered_device_details). The record carries identity only (no check results, decisions or CVEs), plus issues_count and risk. Opening the device returns 403 discovered_device_details_not_in_plan.

Number of policy checks failing on the device (warn or block). Only set when details_hidden is true.

Overall risk of the device against the policy. Only set when details_hidden is true.

Whether the device has unknown checks required by policy

Whether the device has unsafe checks evaluated by policy

Whether the person does not share a check the policy warns or blocks on (XFA-3686). Such a device is not compliant. Absent when false or not yet evaluated.

Timestamp when the device was last notified

User agent of the browser

Email associated with the device

ID of the organization

Timestamp when the device was discovered

UUID of the device

Note added to the device/shadow

Absolute timestamp when the device stops being snoozed

Timestamp when snoozing started

Email address of the admin who snoozed the device

Optional reason for the snooze

Whether MFA prompts are also snoozed