Trustaige · Device management (MDM)
Trustaige MDM enrols and manages Windows, macOS, iOS and Android through each platform’s own management, from one console. Then, at every sign-in, device trust asks two questions most products skip: is this a device you manage, proved by a certificate bound to it, and is it compliant right now? Where your policy requires it, a device that fails either never gets a session.
The wrong question
A user who enrolled their laptop on Monday can sign in from a stranger's desktop on Tuesday — and most device-trust checks pass. The user has a managed device, after all. The actual machine making the request was never inspected.
The right question
Trustaige binds every sign-in to a specific device through a cryptographic handshake. The device presents a certificate your tenant signed; the server verifies it against your tenant's trust anchor; only then does the session get issued. Possession is proven, not assumed.
How the bond is made
On enrolment, the device generates a private key in tamper- resistant hardware and exchanges it for a certificate signed by your Trustaige tenant. The key never leaves the hardware. The certificate is presented on every sign-in. If the certificate is invalid, missing, or revoked, the sign-in stops — before any session token is issued, before any application is reached.
For your security team this means a phished passkey alone is not enough to gain access. The attacker would also need to be running on a device your tenant signed a certificate for. They aren't, and they can't easily become.
Four platforms, one console
Each platform enrols through the management Microsoft, Apple or Google built into it, with no third-party MDM bolted on. Where sign-in needs a device certificate the OS can’t present on its own, the lightweight Trustaige Envoy app carries it.
01
Windows
Windows ships with management built into the OS. Trustaige enrols devices over it, so there’s no MDM agent to install. Envoy presents the device certificate at every sign-in.
Native MDM · Envoy
02
macOS
Macs enrol through Apple’s own device management, so policy, lock and wipe run on the surface Apple built. Envoy sits in the menu bar, presents the certificate and reports posture.
Apple MDM · Envoy
03
iOS & iPadOS
iPhones and iPads enrol through Apple’s device management and receive their device certificate the same way, attested by the device’s own hardware. There’s nothing extra to install.
Apple MDM
04
Android
Scan a QR code and the phone enrols through Android Enterprise, with a separate work profile. Envoy arrives from Managed Google Play and keeps the certificate in secure hardware.
QR enrolment · Envoy
Setup guides Apple devices Windows devices Local admin rights
What happens after enrolment
01
Posture
Disk encryption, OS version, screen lock and domain membership are reported continuously. A device that drifts out of policy is refused at its next sign-in, and every app subscribed over Shared Signals is told at once.
02
Compliance
A device out of compliance can’t reach sensitive applications. The check happens at the identity layer, not inside each app, so no application has to learn about device posture on its own.
03
Remote wipe
Wipe a lost or stolen device remotely. Erasing a Mac, iPhone or iPad takes two superadmins, one to request and another to approve, and a Windows reset needs a second approval too.
Start a conversation
We'll walk through a working deployment, map it to your stack, and tell you honestly where Trustaige fits — and where it doesn't.