Require healthy devices (posture and device trust)

Overview

Cloudraw Connect checks the health of each Windows computer and sends a report to Cloudraw every 15 minutes. This report is called the device's posture. It says, for example, whether BitLocker is on and whether the antivirus is up to date.

You use the report in two places:

1. Device trust rules decide whether a device is trusted at all. Once your workspace has a trust rule, a device that matches none of your trust rules gets no access to any app.
2. Access rules can ask for a health check for one app. For example: the Finance group may open the finance server, but only from a computer with BitLocker on.

Registering a device with Cloudraw makes it known, not trusted. Trust always comes from a trust rule or from an admin.

You need

• The Owner or Security admin role in the Cloudraw admin console. Other roles can view trust and health, but not change them.
• Cloudraw Connect installed on the computers. See Install Cloudraw Connect.

What each health check means

Open a device under Devices to see its last report. Each check is met, not met or not reported. Here is what Cloudraw Connect looks at on Windows.

Rules can also use Computer type (domain computers, workgroup computers, or either) and, in trust rules only, the operating system.

Change the limits

Three checks use limits you can change in Settings→Device health:

The new limits apply to each device's next report.

Reports must be fresh

A report older than 60 minutes counts as not reported. Then every check is unmet, and rules that need a check do not match. A computer that is off or offline therefore loses health-based access until it reports again.

One exception protects you from a Cloudraw or network outage. If at least half of your reporting devices stop reporting at the same moment, Cloudraw keeps their last report for up to 2 more hours and shows an event about it.

What people see

The device page and Cloudraw Connect split the report into three parts:

• Required: the checks your rules ask for on this device, each met or not met.
• Recommended: good-practice checks that fail but that no rule requires. These never block anything.
• Facts: things like domain or workgroup, Entra and MDM. They are not good or bad on their own.

Device trust rules

A trust rule says which devices Cloudraw trusts. A device is trusted when it matches at least one enabled trust rule.

1. Open trust rulesGo to Devices→Trust rules and click Add trust rule.
2. Choose the conditionsTrust rules use the same conditions as access rules. Useful ones are a group of people, health checks, computer type and operating system. For example: Disk encrypted AND Antivirus on AND Firewall on.
3. Check the previewBefore you save, the preview lists the devices the rule would trust now, and who would gain or lose trust compared to today. Devices you trusted or blocked by hand, and quarantined devices, are not in this list.
4. SaveCloudraw checks every device again right away. Each device that changes state creates a trust event.

Trust or block one device by hand

On a device, the trust control has three choices:

Some things win over a manual Trust this device: a suspended person, and a required new sign-in. A quarantined device cannot be changed here. Release it from quarantine first.

Private networks and edge admission

• Private networks need a trusted device by default, even if you have no trust rules. Until you add a trust rule, trust devices by hand to reach a private network.
• Edge admission: Cloudraw can also hide untrusted devices from the Cloudraw network completely. The console shows if this is on for your workspace. Cloudraw support turns it on. Contact support@cloudraw.com.

Health checks in access rules

An access rule can ask for a health check for one app. Add the check under Require in the rule editor. For example:

Rules to know:

• A rule must always name who: a group, a person or a device. A rule with only health checks would let every healthy device in. Cloudraw saves it, but marks it as not enforced, and it grants nothing.
• Each check can be is on (true) or is off (false). Both are enforced. For example, Workgroup computer is on for an app only contractors' own laptops may use.
• A device that has not reported, or whose report is too old, matches neither on nor off. It is denied.
• The operating system condition works in trust rules only. In an access rule, use computer type or the health checks.
• Access follows the device's latest report at once. When a check fails, new connections to that app are refused.

Browser sessions cannot prove device health

When someone opens an app in the browser from the Cloudraw portal, there is no Cloudraw Connect on that computer. So Cloudraw cannot check its health.

If the only rule that gives a person an app also asks for a health check (or a trusted device), the app appears in the portal as a locked tile. The tile names what is needed, for example "disk encrypted". The person can still open the app from Cloudraw Connect on a computer that meets the rule.

Why can't this device open the app?

Use Test access on a device or an app. Cloudraw checks both gates in order and tells you where the device stops:

1. Trust: is the device trusted? If not, the reason, such as "Disk encryption (BitLocker) is off".
2. Access: does a rule give this device the app? If a rule names the person's group but a health check fails, it lists the failing checks.

Defender, CrowdStrike, SentinelOne and Intune

Cloudraw does not connect to the Microsoft Defender portal, CrowdStrike Falcon, SentinelOne or Intune. It does not read their risk scores or compliance results. It only uses what Windows itself reports on the computer:

Advanced: the Cloudraw API can set a device's health checks from your own tools (POST /v0/tenants/{workspace}/devices/{device}/posture). The device's own next report replaces these values, and they also expire after 60 minutes. See Automate Cloudraw with the API.

Troubleshooting