# Device Profiles

Define device trust criteria and operating system requirements for your Twingate network.

Device Profiles define what qualifies a device to access your Twingate network. Configuration is split into two sections on the **Device Profiles** tab of the **Policies** page: **Trusted Profiles** and **Approved Operating Systems**.

Think of these as wristbands: a device can earn multiple wristbands depending on which profiles it satisfies. When a user signs in to Twingate, any device with at least one wristband is allowed. When a user accesses a Resource, only devices with the specific wristbands required by that Resource’s policy are granted access.

The Device Profiles tab showing Trusted Device Profiles and Approved Operating Systems

## Trusted Device Profiles

Trusted Device Profiles identify devices that have been verified through a specific method, either manual verification by an admin or an automated check via an MDM/EDR integration. Each Trusted Device Profile targets a single platform and can optionally include device posture checks in addition to the verification method.

### Trusted Device Profile Requirements are Additive

All requirements enabled in a Trusted Device Profile are evaluated together. A device must satisfy every verification method and posture check in the profile to be considered trusted.

To create a Trusted Device Profile, click **Create** on the Device Profiles tab, select a platform, choose a verification method, and configure any additional posture requirements.

Creating a new Trusted Device Profile with a verification method and posture checks

### Verification Methods

Each Trusted Device Profile requires at least one verification method:

- **Manual verification**: Admins and Helpdesk admins verify devices by serial number or by individual device instance. Serial numbers can be bulk-uploaded before or after devices sign in to Twingate. Devices can also be trusted programmatically via the Twingate API. → [Manually Verified Devices](/content/docs/manually-verified-devices/index.html)
- **CrowdStrike**: Verifies devices via the CrowdStrike Falcon API and ZTA score. → [CrowdStrike Configuration](/content/docs/crowdstrike-configuration/index.html)
- **Intune**: Verifies device compliance status via the Microsoft Intune API. → [Intune Configuration](/content/docs/intune-configuration/index.html)
- **Jamf**: Verifies macOS devices via the Jamf API. → [Jamf Configuration](/content/docs/jamf-configuration/index.html)
- **Iru (previously Kandji)**: Verifies macOS devices via the Iru API. → [Iru Configuration](/content/docs/iru-configuration/index.html)
- **SentinelOne**: Verifies devices via the SentinelOne API. → [SentinelOne Configuration](/content/docs/sentinelone-configuration/index.html)
- **1Password**: Verifies devices via 1Password Extended Access Management. → [1Password Configuration](/content/docs/1password-configuration/index.html)

### Using Trusted Device Profiles in Policies

Once created, Trusted Device Profiles are automatically available in both the Sign In Policy and Resource Policies:

- **Sign In Policy**: Any device that meets any Trusted Device Profile (or Approved Operating System requirement) can sign in to Twingate.
- **Resource Policies**: You can require specific Trusted Device Profiles for individual Resources. Set the Device Security requirement to **Only Trusted Devices** to restrict access to verified devices, or use **Custom** to select specific profiles.

## Approved Operating Systems

Approved Operating Systems set the baseline device requirements for each platform. You can enable or disable platforms individually. Disabling a platform blocks all devices on that platform from signing in to Twingate, unless they meet a Trusted Device Profile.

For each enabled platform, you can configure native device posture checks. These checks are performed by the Twingate Client and vary by platform:

| Platform | Available posture checks |
| --- | --- |
| Windows | HD encryption, screen lock, firewall, antivirus, minimum OS version |
| macOS | Screen lock, biometric configuration, firewall, HD encryption, minimum OS version |
| Linux | HD encryption, firewall |
| iOS | Screen lock, biometric configuration, minimum OS version |
| Android | HD encryption, screen lock, biometric configuration |

### macOS firewall and HD encryption

Firewall and HD encryption posture checks on macOS are only available with the [macOS standalone Client](/content/docs/macos-standalone-client/index.html).

For detailed information about how each posture check is evaluated on each platform, see the [Device Posture Checks](/content/docs/device-posture-checks/index.html) reference.

### Blocking a Platform

When a platform is disabled in Approved Operating Systems, devices on that platform cannot sign in to Twingate unless they satisfy a Trusted Device Profile for that platform. This is useful for organizations that want to block unmanaged devices on a platform while still allowing managed, verified devices through.

## Common Configurations

The following examples illustrate how to combine Trusted Device Profiles, Approved Operating Systems, and Resource Policies for common scenarios.

| Scenario | Device Profiles configuration | Resource Policies configuration |
| --- | --- | --- |
| Only allow macOS and iOS with basic posture checks | Disable Windows, Linux, and Android in Approved Operating Systems. Configure posture checks for macOS and iOS. | Set Device Security to **Any Device** or use **Custom** to select only the macOS and iOS profiles. |
| Employees on trusted devices, contractors on baseline | Configure Approved Operating Systems with the posture checks needed for contractor devices. Create Trusted Profiles for employee platforms using manual verification. | Assign Trusted Profiles to Resources that employees access. |
| Block all Android except verified test devices | Disable Android in Approved Operating Systems. Create a Trusted Device Profile for Android using manual verification and mark test devices as trusted. | Add the Android Trusted Device Profile as an allowed device on the relevant Resource Policies. |
| Require MDM/EDR verification for macOS | Disable macOS in Approved Operating Systems. Set up the applicable MDM/EDR integration. Create a Trusted Device Profile for macOS with the MDM/EDR integration as the verification method. | Add the macOS Trusted Device Profile to Resource Policies for Resources that macOS devices should access. |

## Blocked Devices

If a device does not meet the Device Profile requirements (either for sign-in or for a specific Resource), the user sees a block message in the Twingate Client explaining that the device does not meet the security requirements.

A blocked device message shown when the device does not meet policy requirements