Device certificates
Only trusted devices get in. For every client, not only those on Business Premium.
A stolen password and an approved MFA prompt still aren't enough. With device certificates, sign-ins to Microsoft 365, Google Workspace and SaaS apps only work from devices you've approved. No license upgrade, no Intune.
Attackers can steal a password and trick a user into approving an MFA prompt. They can't easily sign in from a laptop you issued a certificate to. A device certificate is a small digital ID installed on each approved device. At sign-in, HENNGE Identity checks for it before access is allowed. No certificate, no access.
MFA can be bypassed
Approved prompts don't prove the device is yours.
Upgrades are expensive
Business Premium for every user, just for device checks.
BYOD is everywhere
Contractors and remote staff use personal laptops you can't enroll in MDM.
Offboarding is messy
Former staff and contractors keep devices that can still sign in.
Issue certificates, install them on approved devices, enforce them at sign-in, and revoke access when a device or user should no longer be trusted.
Secure login portal
Multi-factor authentication
Password manager
App portal with SSO
User provisioning
Secure browser
VPN-free remote access
Logs
User group policies
User policies
We'll help you find clients with MFA but no device checks, and show what a device certificate rollout looks like for them.
What is a device certificate?
A device certificate is a digital ID installed on a specific laptop, phone or tablet. When a user signs in, HENNGE Identity checks for a valid certificate and only allows access from approved devices. HENNGE uses X.509 certificates, the same standard behind HTTPS.
How can an MSP block unmanaged devices from Microsoft 365 without Business Premium?
Add HENNGE Identity as the identity provider for the client's Microsoft 365 tenant and require a device certificate in the access policy. The client stays on Business Basic or Standard. Sign-ins from devices without a certificate are blocked.
Do my clients need Entra ID P1 or Intune?
No. In Microsoft, device-based conditional access requires Entra ID P1 and Intune compliance policies. HENNGE Identity checks the device itself at sign-in, so clients keep their current Microsoft 365 or Google Workspace plan.
How is this different from Intune device compliance?
Intune manages the whole device and reports whether it meets security rules. HENNGE device certificates prove that a sign-in comes from a device you approved, without enrolling it in MDM. HENNGE Identity is not an MDM; it works alongside one if the client already has it.
Which devices and operating systems are supported?
Windows, macOS, iOS, iPadOS, Android and ChromeOS. Certificates are issued in the HENNGE Access Control console and installed from an emailed link, or distributed through a supported MDM.
What certificate types are there?
Three: Personal (one user on one device, plus password), Shared (one device used by several people) and Passwordless (kiosks and business terminals). Policies can require any certificate or a specific type.
Can I combine device certificates with other conditions?
Yes. In Access Policy Groups you can combine a device certificate with IP ranges, day and time, Secure Browser, OTP and user groups, using AND, OR and NOT. For example: allow without OTP from a company laptop in the office, require OTP and Secure Browser on a personal device.
How do I secure BYOD and contractor access?
Issue a Personal device certificate to each approved personal device, require OTP and route access through HENNGE Secure Browser to limit downloads and copy/paste. When the engagement ends, revoke the certificate.
What happens when a device is lost or an employee leaves?
Revoke the device certificate in the admin console. That device can no longer sign in, even with the correct password.
Do device certificates work for Google Workspace?
Yes. HENNGE Identity can act as the identity provider for Google Workspace, so the same device certificate policy covers Microsoft 365, Google Workspace and 460+ SaaS apps from one console.
