The Vanta integration sends your Factorial IT administrators and your macOS and Windows devices to Vanta once an hour. Use it when Vanta needs device evidence for your audits and you want to know exactly which fields leave Factorial IT.

Feature/Functionality

Overview

Data only travels one way: Factorial IT pushes to the Vanta API and Vanta returns nothing, so no Vanta data shows up in the console.

This article explains what is sent, how the sync works and how to connect or reconnect. Vanta's own documentation covers what it does with the data. Device compliance monitoring inside Factorial IT is a separate feature with no link to this integration; see Compliance overview.

Before you start

• An MDM plan. SaaS Management is not needed.
• A Vanta account with administrator rights. Only an administrator can approve the integration.
• The permission to manage SaaS in Factorial IT. Without it, the Connect button on the Vanta card is greyed out.

How to use

1. Go to MDM > Settings.
2. In the Integrations section, click Add integration, then Connect on the Vanta card.
3. Vanta opens. Approve the connection.
4. Vanta asks you to grant access. Confirm it.
5. You land back on MDM > Settings. A Vanta row now appears under Integrations.

What Factorial IT sends

Three kinds of records go to Vanta:

• Factorial IT admin accounts. Only administrators. Employees without admin rights are left out.
• macOS devices
• Windows devices

Fields sent for each admin account

• Display name and full name
• Email address
• Creation date
• Authentication method: SSO or password
• Multi-factor authentication (MFA): whether it is on, and which methods are used (OTP, SMS, or none)
• Permission level

Fields sent for each device

macOS and Windows devices share the same fields unless the Notes column says otherwise.

How the calculated fields work

Some values do not come from the device itself. They come from the MDM controls that target it. If a control does not target a device, it has no influence on what is sent for that device.

• MDM management state. Reported as managed when the device is enrolled and active through automatic enrolment, company-owned device enrolment or manual enrolment. Any other state (enrolment turned off, pending or unknown) is reported as unmanaged. Ownership of the device plays no part in this.
• Automatic updates. Reported as on when an OS update control with an update deadline targets the device. It is decided per device by the control, not by a company-wide setting. See Enforce OS updates.
• Screen lock policy. Built from the password policy controls on macOS and Windows. If the Password and screenlock control is not set up, nothing is sent.
• Minimum password length. Read from the password policy control that targets the device. If no such control targets it, the field is dropped from the push instead of being filled with a default value.

What stays in Factorial IT

Only admin accounts and devices are sent. Everything else stays put:

• Employees who are not Factorial IT administrators. No people directory travels, and no onboarding, mobility or offboarding events either.
• SaaS application accounts and access rights.
• Endpoint protection data. Factorial IT holds SentinelOne and ThreatDown data but does not send it. The device fields only say whether a malware protection control targets a Mac, not what those tools have found.
• Firewall status.
• Linux, iPhone, iPad and Android devices. The Vanta API only takes macOS and Windows.
• Devices missing from the agent inventory. A device without the agent is never sent.

How the sync runs

• A push goes out every hour.
• Each push carries the full current picture of your fleet, not just what changed since last time.
• Because every push is complete, gaps heal themselves. If Vanta stops taking data for a while, the next hourly push sends the whole fleet again and Vanta catches up. You do not need to reconnect or do anything.

There is no button to force a sync, and the console does not show when the last sync ran.

Disconnect or reconnect

In MDM > Settings, click the Vanta row to open its settings. You see one action, depending on the connection state:

• Disconnect: shown while the connection works. It stops the hourly push.
• Reconnect: shown after the connection has been interrupted. It takes you through the same two Vanta screens again and restores access.

Troubleshooting and FAQ

Troubleshooting

• Vanta has stopped receiving data, but your devices are still managed. Click the Vanta row in MDM > Settings. If the settings offer Reconnect, the authorisation broke. Disconnect, then connect again to restore it.
• A device does not appear in Vanta.
  1. Check the platform. Linux, iPhone, iPad and Android are never sent.
  2. Check that the agent is installed. Devices outside the agent inventory are not sent.
  3. Wait for the next hourly push before digging further.
• A device has no owner in Vanta. Assign an owner to it in Factorial IT. Without one, the owner email is not part of the push.

FAQ

1. How often does Factorial IT send data to Vanta?
   Every hour, and each push holds the full current state of the fleet.
    
2. Can I trigger a sync by hand?
   No. There is no manual sync, and the console does not show a last-sync date.
    
3. Are regular employees sent to Vanta?
   No. Only Factorial IT administrators are sent.
    
4. Does Vanta receive our SentinelOne or ThreatDown data?
   No. Endpoint protection data stays in Factorial IT.
    
5. Do I need SaaS Management for this?
   No. An MDM plan is enough, although you do need the permission to manage SaaS to click Connect.