---
title: Zero Trust Devices
description: Define device trust posture, endpoint identity controls, and managed access guardrails to reduce endpoint-based risk in migration and steady-state operations.
sidebar:
  label: Zero Trust Devices
  order: 16
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/zero-trust-devices/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/zero-trust-devices.mdx"
---

## Purpose

Zero Trust Devices ensures that endpoint posture is continuously validated before users or operators can access workloads, control planes, or sensitive data.

## Control objectives

- **Verified endpoint identity**: Every managed device can be uniquely identified and tied to a responsible user or operator.
- **Posture-based access**: Access decisions include endpoint state such as patch level, disk encryption, and active security controls.
- **Session trust continuity**: Device trust is re-evaluated during sessions, not only at login.
- **Separation of unmanaged endpoints**: Sensitive operations are restricted to compliant and managed device classes.

## Design recommendations

- **Define device classes**: Separate privileged admin endpoints, standard workforce devices, and automation jump hosts.
- **Apply conditional access**: Enforce access conditions based on endpoint compliance and user risk.
- **Harden administration paths**: Use dedicated admin workstations for privileged operations and emergency access workflows.
- **Protect credentials on endpoints**: Minimize token persistence and enforce phishing-resistant authentication where possible.

## Implementation checkpoints

- **Device baseline policy**: Mandatory controls for patching, endpoint protection, encryption, and local admin rights.
- **Access policy matrix**: Explicit mapping of workload criticality to allowed device classes.
- **Exception governance**: Time-boxed and approved exceptions for unmanaged or non-compliant endpoints.
- **Evidence model**: Auditable records for endpoint posture checks and denied access decisions.

## STACKIT references

- **Access and Identity**: <LinkChip href="https://docs.stackit.cloud/platform/access-and-identity/">Documentation</LinkChip>
- **Security hardening guidance**: <LinkChip href="https://docs.stackit.cloud/products/security/security-hardening/">Documentation</LinkChip>

## Anti-patterns to avoid

- **Trust by VPN alone**: Network location is treated as proof of endpoint trust.
- **Permanent exceptions**: Non-compliant devices remain allowed without expiry or owner accountability.
- **Unsegmented admin endpoints**: Privileged operations happen from standard user devices.