Give contractors Microsoft 365 access. No MDM. No VDI.
Employees go through Intune. Contractors can't. PosturePass checks the device at sign-in and feeds the result to Conditional Access.
OUTCOME COMPARISON
Migration stalls and VDI stays running for contractors.
Contractors move to M365 and VDI can be decommissioned.
Illustrative outcomes based on typical deployments.
Key facts
- PosturePass verifies the device at sign-in and sends a compliance signal to Microsoft Entra Conditional Access. Existing Conditional Access policies then grant or block access.
- No MDM, Intune, or management profile is installed on the contractor's device.
- Posture checks cover disk encryption, antivirus, firewall, OS version, and screen lock on Windows and macOS.
- Works for B2B guest users, contractors from organizations without Entra, and independent operators.
- Required licensing: Microsoft Entra ID P1 (included with Microsoft 365 E3). Intune licenses are not required for external users.
- Failed checks show the user guided remediation steps; most issues are resolved without a help-desk ticket.
How verification fits inside your Entra access flow
Sign-in stays the same. PosturePass adds a device check before access is granted.
Device Verification Flow
Broker Device
Personal laptop
PosturePass Check
Posture verified
Identity Provider
Okta / Entra ID
Protected App
Access granted
Broker Device
Personal laptop
PosturePass Check
Posture verified
Identity Provider
Okta / Entra ID
Protected App
Access granted
Contractor signs in to Microsoft 365
Sign-in, MFA, and identity stay the same.
PosturePass checks the device
A light agent checks encryption, antivirus, firewall, OS version, and screen lock.
Entra Conditional Access reads the result
PosturePass sends the compliance signal. Your policies grant or block.
Failed devices get guided fix steps
Users resolve most issues themselves in minutes. No ticket.
Every check is logged
Timestamped record of result, controls, and remediation.
BYOD endpoint security without full MDM enrollment
Full MDM is the wrong tool for personal and contractor devices. PosturePass verifies the controls that matter without taking over the device.
No management profile
No MDM enrollment on the user's BYOD laptop. No company ownership of a personal device.
No remote wipe, no remote control
PosturePass reads posture and reports a result. It does not push apps, change settings, or wipe data.
Controls still verified
Encryption, antivirus, firewall, OS version, and screen lock are checked at every sign-in.
Why Intune does not cover external users
Cross-tenant enrollment is usually blocked
The contractor's org has to allow MDM from your tenant. Most don't.
Privacy and legal stall rollout
Enrollment puts a management profile on personal devices. HR and legal push back.
PosturePass verifies without enrolling
The agent checks controls. No MDM profile, no remote management, no remote wipe.
If a device fails, the user sees fix steps
Most issues are resolved by the user without a help-desk ticket.
CUSTOMER RESULTS
One regulated enterprise moved 2,000+ contractors off VDI into Microsoft 365 in eight weeks.
Read the case studyEvery check writes a record you can hand to an auditor
Exportable for ISO 27001, NYDFS, and similar frameworks. See the compliance evidence page →
Sample audit log
Frequently Asked Questions
Still have questions?
Talk to our team about your specific compliance or distribution requirements.
Book a demoWeighing the cost of keeping VDI for contractors?
Compare to Citrix VDI