Mobile Device Management

Overview

Formal’s Mobile Device Management (MDM) integration allows you to enforce device-based security policies on user connections. By integrating with your organization’s MDM solution, you can ensure that only compliant, managed devices can access protected resources through Formal.

MDM-based policies require users to connect through the Formal Desktop App, which collects and reports device information.

How It Works

When users connect through the Formal Desktop App:

The app collects device information (hardware, software, security settings)
This information is sent to the Connector along with the connection request
Policies evaluate device attributes via input.device

Device Information Available

Formal collects comprehensive device metadata that can be used in policies. When MDM integration is enabled, additional compliance data is available through input.device.mdm:

Hardware Information

Field	Description
`model_name`	Device model name (e.g., “MacBook Pro”)
`model_identifier`	Model identifier (e.g., “MacBookPro18,1”)
`serial_number`	Hardware serial number
`hardware_uuid`	Unique hardware identifier
`activation_lock_status`	Activation lock status (macOS)

Software Information

Field	Description
`system_version`	OS version (e.g., “14.2”)
`kernel_version`	Kernel version
`computer_name`	Computer/hostname
`user_name`	Local user account name
`system_integrity_protection`	SIP status (macOS)
`secure_virtual_memory`	Encrypted virtual memory status
`boot_mode`	Secure boot status

MDM Information (When Integration Enabled)

Field	Description
`enrolled`	Device enrollment status
`compliant`	Overall compliance status
`compliance_status`	Detailed compliance state
`installed_profiles`	List of installed profiles
`configuration_profiles`	MDM configuration profiles
`last_checkin`	Last MDM check-in timestamp
`management_status`	Device management status

Supported MDM Providers

Formal supports Kandji, Fleet, Jamf Pro, and Mosyle for endpoint rollout. For MDM integrations, Formal supports Kandji, Fleet, and Jamf Pro.

Endpoint Rollout

Go to MDM and click Set Up Endpoint Rollout. The dialog walks you through selecting your provider, downloading deployment files, and following setup instructions in your MDM console.

Connect Your MDM

To surface data.mdm_devices in policies, create an MDM integration. This syncs enrolled device data from your MDM into Formal. Option 1: Formal console

Go to MDM
Click Create Integration
Select Kandji, Fleet, or Jamf Pro
Enter your MDM API credentials
Click Save

Option 2: Terraform Use the formal_integration_mdm resource with the block for your provider:

resource "formal_integration_mdm" "example" {
  name = "Fleet MDM Integration"

  fleet {
    api_key = var.fleet_api_key
    api_url = "https://your-fleet.example.com"
  }
}

See the Terraform provider for Kandji and Jamf Pro examples. Verify: After saving, open the integration detail page and confirm devices appear under Devices.

Example Policies

Require Secure Boot

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device must have secure boot enabled",
  "reason": "Device security policy violation"
} if {
  not input.device.software.boot_mode == "secure"
}

Block Jailbroken/Modified Devices

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "System Integrity Protection must be enabled",
  "reason": "Device tampering detected"
} if {
  not input.device.software.system_integrity_protection == "enabled"
}

Enforce Activation Lock (macOS)

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Activation Lock must be enabled",
  "reason": "Device theft protection required"
} if {
  input.device.hardware.activation_lock_status == "disabled"
}

Require Encrypted Virtual Memory

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Encrypted virtual memory required",
  "reason": "Data protection policy"
} if {
  not input.device.software.secure_virtual_memory == "enabled"
}

Allow Only Corporate Devices

package formal.v2

import future.keywords.if

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Only corporate-issued devices allowed",
  "reason": "Device not in approved list"
} if {
  # Check against list of approved serial numbers (Policy Data Loader)
  approved_serials := data.mdm_devices

  not input.device.hardware.serial_number in approved_serials
}

Conditional Access Based on Device

package formal.v2

import future.keywords.if

# Require MFA if device is not fully compliant
session := {
  "action": "mfa",
  "reason": "MFA required for non-compliant devices"
} if {
  # Check multiple compliance factors
  version_parts := split(input.device.software.system_version, ".")
  major_version := to_number(version_parts[0])

  # Device is "marginally compliant" - allow with MFA
  major_version >= 13
  major_version < 14
  input.device.software.system_integrity_protection == "enabled"
}

# Block if device is completely non-compliant
session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device does not meet minimum security requirements",
  "reason": "Critical compliance violations"
} if {
  # OS too old OR SIP disabled
  version_parts := split(input.device.software.system_version, ".")
  major_version := to_number(version_parts[0])

  major_version < 13
}

session := {
  "action": "block",
  "type": "block_with_formal_message",
  "message": "Device does not meet minimum security requirements",
  "reason": "Critical compliance violations"
} if {
  not input.device.software.system_integrity_protection == "enabled"
}

Monitoring Device Compliance

View device information in session logs:

Navigate to Sessions
Click on any session
Review device information in session details
Filter sessions by device attributes

This allows you to:

Audit which devices are accessing resources
Identify non-compliant devices attempting connections
Track OS versions and security settings across your fleet

Best Practices

Require Desktop App

Enforce use of the Formal Desktop App for connections that require device compliance checks. Block direct connections that bypass device verification.

Layer Security

Combine device-based policies with user-based and resource-based policies for defense in depth.

Grace Periods

When implementing new device requirements, use dry-run mode first and give users time to update their devices.

Connect your MDM

Connect Kandji, Fleet, or Jamf Pro to sync device compliance data into Formal. Use endpoint rollout to deploy the Formal Endpoint across your fleet.

Audit Regularly

Review session logs to identify devices that frequently fail compliance checks.

Next Steps

Desktop App

Install the Formal Desktop App

Write Policies

Create device-based policies

Terraform Provider

Configure MDM integrations with Terraform

MDM Integrations

Set up endpoint rollout and MDM integrations

Getting Started

Configuring Formal

Leveraging Formal

Integrations

Configuration

Client Apps

Example Use Cases

Overview

How It Works

Device Information Available

Hardware Information

Software Information

MDM Information (When Integration Enabled)

Supported MDM Providers

Endpoint Rollout

Connect Your MDM

Example Policies

Require Secure Boot

Block Jailbroken/Modified Devices

Enforce Activation Lock (macOS)

Require Encrypted Virtual Memory

Allow Only Corporate Devices

Conditional Access Based on Device

Monitoring Device Compliance

Best Practices

Next Steps

Desktop App

Write Policies

Terraform Provider

MDM Integrations

​Overview

​How It Works

​Device Information Available

​Hardware Information

​Software Information

​MDM Information (When Integration Enabled)

​Supported MDM Providers

​Endpoint Rollout

​Connect Your MDM

​Example Policies

​Require Secure Boot

​Block Jailbroken/Modified Devices

​Enforce Activation Lock (macOS)

​Require Encrypted Virtual Memory

​Allow Only Corporate Devices

​Conditional Access Based on Device

​Monitoring Device Compliance

​Best Practices

​Next Steps

Desktop App

Write Policies

Terraform Provider

MDM Integrations

Overview

How It Works

Device Information Available

Hardware Information

Software Information

MDM Information (When Integration Enabled)

Supported MDM Providers

Endpoint Rollout

Connect Your MDM

Example Policies

Require Secure Boot

Block Jailbroken/Modified Devices

Enforce Activation Lock (macOS)

Require Encrypted Virtual Memory

Allow Only Corporate Devices

Conditional Access Based on Device

Monitoring Device Compliance

Best Practices

Next Steps