Mobile Device Management

Overview

Formal’s Mobile Device Management (MDM) integration allows you to enforce device-based security policies on user connections. By integrating with your organization’s MDM solution, you can ensure that only compliant, managed devices can access protected resources through Formal.

MDM-based policies require users to connect through the Formal Endpoint, which collects and reports device information.

How It Works

When users connect through the Formal Endpoint:

The app collects device information (hardware, software, security settings)
This information is sent to the Connector along with the connection request
Policies evaluate device attributes via input.device

Device Information Available

Formal collects comprehensive device metadata that can be used in policies. When MDM integration is enabled, additional compliance data is available through input.device.mdm:

Hardware Information

Field	Description
`model_name`	Device model name (e.g., “MacBook Pro”)
`model_identifier`	Model identifier (e.g., “MacBookPro18,1”)
`serial_number`	Hardware serial number
`hardware_uuid`	Unique hardware identifier
`activation_lock_status`	Activation lock status (macOS)

Software Information

Field	Description
`system_version`	OS version (e.g., “14.2”)
`kernel_version`	Kernel version
`computer_name`	Computer/hostname
`user_name`	Local user account name
`system_integrity_protection`	SIP status (macOS)
`secure_virtual_memory`	Encrypted virtual memory status
`boot_mode`	Secure boot status

MDM Information (When Integration Enabled)

Field	Description
`enrolled`	Device enrollment status
`compliant`	Overall compliance status
`compliance_status`	Detailed compliance state
`installed_profiles`	List of installed profiles
`configuration_profiles`	MDM configuration profiles
`last_checkin`	Last MDM check-in timestamp
`management_status`	Device management status

Supported MDM Providers

Formal supports Kandji, Fleet, Jamf Pro, and Mosyle for both endpoint rollout and MDM integrations.

Endpoint Rollout

Go to MDM and click Set Up Endpoint Rollout. The dialog walks you through selecting your provider, downloading deployment files, and following setup instructions in your MDM console.

Connect Your MDM

Create an MDM integration to sync enrolled devices and their assigned users from your MDM into Formal. Formal uses this list to identify the user behind a device by its serial number, for example when the device attests its identity or signs in without a user login. Option 1: Control Plane

Go to MDM
Click Create Integration
Select Kandji, Fleet, Jamf Pro, or Mosyle
Enter your MDM API credentials
Click Save

Option 2: Terraform Use the formal_integration_mdm resource with the block for your provider:

resource "formal_integration_mdm" "example" {
  name = "Fleet MDM Integration"

  fleet {
    api_key = var.fleet_api_key
    api_url = "https://your-fleet.example.com"
  }
}

Mosyle signs in on every API call, so it needs an access token plus the credentials of a Mosyle user with API access:

resource "formal_integration_mdm" "mosyle" {
  name = "Mosyle MDM Integration"

  mosyle {
    access_token = var.mosyle_access_token
    email        = var.mosyle_email
    password     = var.mosyle_password
    api_url      = "https://businessapi.mosyle.com"
  }
}

See the Terraform provider for Kandji and Jamf Pro examples.

Mosyle credentials

Mosyle requires three values:

Value	Where to find it
`access_token`	Mosyle console, Organization > API Integration. Create a new integration and copy the Access Token.
`email`	Email of a Mosyle user with API access. Mosyle authenticates as this user on every request.
`password`	That user’s Mosyle password.

api_url defaults to https://businessapi.mosyle.com. Use https://managerapi.mosyle.com for Mosyle Manager.

Formal reads the assigned user’s email from each Mac’s Mosyle record. A Mac with no assigned user cannot be mapped to a Formal user, so assign devices to users in Mosyle before relying on device-based policies or automatic device login.

Verify: After saving, open the integration detail page and confirm devices appear under Devices.

Example Policies

Require Secure Boot

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device must have secure boot enabled",
  "reason": "Device security policy violation"
} if {
  not input.device.software.boot_mode == "secure"
}

Block Jailbroken/Modified Devices

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "System Integrity Protection must be enabled",
  "reason": "Device tampering detected"
} if {
  not input.device.software.system_integrity_protection == "enabled"
}

Enforce Activation Lock (macOS)

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Activation Lock must be enabled",
  "reason": "Device theft protection required"
} if {
  input.device.hardware.activation_lock_status == "disabled"
}

Require Encrypted Virtual Memory

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Encrypted virtual memory required",
  "reason": "Data protection policy"
} if {
  not input.device.software.secure_virtual_memory == "enabled"
}

Conditional Access Based on Device

package formal.v2

import future.keywords.if

# Require MFA if device is not fully compliant
session := {
  "action": "mfa",
  "reason": "MFA required for non-compliant devices"
} if {
  # Check multiple compliance factors
  version_parts := split(input.device.software.system_version, ".")
  major_version := to_number(version_parts[0])

  # Device is "marginally compliant" - allow with MFA
  major_version >= 13
  major_version < 14
  input.device.software.system_integrity_protection == "enabled"
}

# Block if device is completely non-compliant
session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device does not meet minimum security requirements",
  "reason": "Critical compliance violations"
} if {
  # OS too old OR SIP disabled
  version_parts := split(input.device.software.system_version, ".")
  major_version := to_number(version_parts[0])

  major_version < 13
}

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device does not meet minimum security requirements",
  "reason": "Critical compliance violations"
} if {
  not input.device.software.system_integrity_protection == "enabled"
}

Monitoring Device Compliance

View device information in session logs:

Navigate to Sessions
Click on any session
Review device information in session details
Filter sessions by device attributes

This allows you to:

Audit which devices are accessing resources
Identify non-compliant devices attempting connections
Track OS versions and security settings across your fleet

Best Practices

Require Formal Endpoint

Enforce use of the Formal Endpoint for connections that require device compliance checks. Block direct connections that bypass device verification.

Layer Security

Combine device-based policies with user-based and resource-based policies for defense in depth.

Grace Periods

When implementing new device requirements, use dry-run mode first and give users time to update their devices.

Connect your MDM

Connect Kandji, Fleet, Jamf Pro, or Mosyle to sync device compliance data into Formal. Use endpoint rollout to deploy the Formal Endpoint across your fleet.

Audit Regularly

Review session logs to identify devices that frequently fail compliance checks.

Next Steps

Formal Endpoint

Install the Formal Endpoint

Write Policies

Create device-based policies

Terraform Provider

Configure MDM integrations with Terraform

MDM Integrations

Set up endpoint rollout and MDM integrations

Getting Started

Example Use Cases

AI Governance

Configuring Formal

Integrations

Configuration

Overview

How It Works

Device Information Available

Hardware Information

Software Information

MDM Information (When Integration Enabled)

Supported MDM Providers

Endpoint Rollout

Connect Your MDM

Mosyle credentials

Example Policies

Require Secure Boot

Block Jailbroken/Modified Devices

Enforce Activation Lock (macOS)

Require Encrypted Virtual Memory

Conditional Access Based on Device

Monitoring Device Compliance

Best Practices

Next Steps

Formal Endpoint

Write Policies

Terraform Provider

MDM Integrations

​Overview

​How It Works

​Device Information Available

​Hardware Information

​Software Information

​MDM Information (When Integration Enabled)

​Supported MDM Providers

​Endpoint Rollout

​Connect Your MDM

​Mosyle credentials

​Example Policies

​Require Secure Boot

​Block Jailbroken/Modified Devices

​Enforce Activation Lock (macOS)

​Require Encrypted Virtual Memory

​Conditional Access Based on Device

​Monitoring Device Compliance

​Best Practices

​Next Steps

Formal Endpoint

Write Policies

Terraform Provider

MDM Integrations

Overview

How It Works

Device Information Available

Hardware Information

Software Information

MDM Information (When Integration Enabled)

Supported MDM Providers

Endpoint Rollout

Connect Your MDM

Mosyle credentials

Example Policies

Require Secure Boot

Block Jailbroken/Modified Devices

Enforce Activation Lock (macOS)

Require Encrypted Virtual Memory

Conditional Access Based on Device

Monitoring Device Compliance

Best Practices

Next Steps