anyone know if it's possible to block any connections from a Win10 device (client has asked)? been looking at various options but can't seem to figure out how to do it without needing to install something on the endpoint as some may be byod devices hmm

DeviceTrust is a good option, or does device posture service not do this? Pretty much going to need an agent on endpoints I would think

Firewall rules, you can make it an island.. get some proper UEM solution, WS1, and you control the device.. a bit more context will help to understand this, any conn, all the time, in what case, what is any?, to where?... maybe byod makes it a whole different ballgame

I completely agree with @James Kindon answer. With deviceTRUST, this is pretty easy to implement. Provided you have UHMC licenses

thanks guys, was ending up at the same conclusion that we would need something on the endpoints. Cheers

For OS check you don't need devicetrust on the endpoint, only on the VDA.

For Citrix, deviceTRUST either way is just part of the CWA anymore with the client extension for most of the major endpoints, so yeah, its separate extension, but you already need CWA and just have to look for making sure they are relatively updated