topic Identity awareness deployment for Non-AD Member in General Topics

Identity awareness deployment for Non-AD Member

snowball14 — Mon, 20 Sep 2021 07:39:58 GMT

Here's the scenario - the customer management would like to restrict the corporate users on using non-domain laptops when connecting to the corporate network. Only domain managed devices can be allowed, non-domain laptop should be restricted even the corporate user entered the correct corporate domain credentials to the captive portal, their access should be denied because the device is unmanaged by the AD.

Can we implement this kind of use case? are there any option on Identity Awareness that can we install like an agent and check the user endpoint if part of AD or not?

Re: Identity awareness deployment for Non-AD Member

G_W_Albrecht — Mon, 20 Sep 2021 08:13:41 GMT

Yes, e.g. by SSO: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_IdentityAwareness_AdminGuide/62838.htm

Re: Identity awareness deployment for Non-AD Member

PhoneBoy — Mon, 20 Sep 2021 16:00:54 GMT

Access Roles can include machine identity, which will only exist for machines in AD.
This should allow you to create more restrictive rules for users on machines not on AD.