Queen's Device Compliance Check and Browser Requirements (Windows)

For non-Queen's-owned computing devices (most of your personal laptops), you may have limited access to Queen's resources. For employees, restricted resources include MyHR and PeopleSoft Finance.

For some resources, all that's needed is downloading and configuring browser settings correctly; Queen's IT provides a self-guided walkthrough: "Self-Guided Support - Intune Company Portal - Device Compliance Check and Browser Requirements" (service-now.com).

In other cases, e.g. if you are a manager, your device access privileges may need to be elevated through Queen's ITS. The following is drawn from "Self-Guided Support - Endpoint Protection Health Standards and Conditional Access Policies" (service-now.com).

Endpoint Protection Health Standards and Conditional Access Policies

The intent of Endpoint Protection (EP) is to ensure that only healthy devices connect to Queen's systems, avoiding vulnerabilities or data compromises, through a "health check" of devices enrolled in the EP program.

If you use a device to access Queen's resources (such as Queen's email and/or any application requiring login with your NetID and password), and the device was purchased using Queen's funds (not paid for out of pocket), you are required to enroll the device in the EP program. You are not required to enroll a personal device, though you're welcome to do so.

If you are required to use a personal device to access PeopleSoft Human Resources (PS HR) or PeopleSoft Finance (PS Finance), you must request that the device be uplifted to the Silver policy using the Request a Change to a Managed Device form.

Conditional Access Policies

Through the Endpoint Protection program, controls are being introduced to ensure devices connecting to specific applications are compliant with device health standards (applying conditional access policies). If your device does not meet these standards, it will notify you of how to remediate it. Conditional access policies began applying in early 2022, first to the PeopleSoft Finance and PeopleSoft HR administrative applications.

Note: users can access MyHR self-service without enrolling in EP if they do not have privileged access to the PeopleSoft HR administrative system (privileged access includes holding an HR role or having direct reports). Most employees will be able to download their pay stubs and T4 slips from a personal device without EP enrollment.

Three Device Health Standards for Queen's

Three health standards "right fit" the level of device management to the sensitivity of the data being accessed:

Level	Applies to	Security Standard Requirements
Bronze	Personally-owned devices of faculty, staff, and student-staff used to access Queen's digital resources.	Minimum OS includes the current version and previous 2 versions. Requires any antispyware/antivirus solution registered with Windows Security Center to be on and monitoring (e.g., Symantec, Microsoft Defender). Jailbroken devices are prevented from accessing protected resources (iPhone-specific). Rooted devices are prevented from accessing protected resources (Android-specific).
Silver	All Queen's-owned devices, or any personally-owned device (by exception process) used to access PS Finance or PS HR (Administrative).	Same as Bronze, plus: requires the device to be encrypted, and requires firewall to be on and monitoring.
Gold	Not yet specified; for future use, for applications with the highest security requirements and most sensitive data.	Not yet specified.