We are using Workspace Service + DaaS. Curious if anyone is using Device Posture to check CWA versions with a mix of full and HTML5 clients. Those using HTML5 clients will fail a version check as no full client is installed and the HTML5 client is not running at the time of the check. All we are interested in is at this time is client version greater than the latest CVE. Additionally, if an older client is installed but the user executes the browser to launch an HTML5 session, DP would mark the endpoint as non-compliant. Any thoughts on mitigating this issue. On the surface there appears to be a gap, but perhaps I am missing something.

deviceTRUST can cover all of that :)

Thank you. I will look into that but was hoping to avoid adding another tool if possible.

It's already integrated into VDA2507 and it's using the virtualchannel for the detection. It's just a policy file you'll have to use.

I was looking at the documentation and it mentioned in the remote scenario installing the client extension at the endpoint. The majority of our users are 3rd party so we have no ability to do so. Are you saying that is not required and we only need the agent on the VDA?

For this usecase no client extension is required.

Update: I will continue to investigate deviceTrust for a more granular config, but I was able to find a way to reach my goal with Device Posture alone. Just needed to add another policy that would create the default true event. Thanks for the help