Notifications
Clear all
Topic starter
10/07/2026 9:07 pm
TL;DR: Mosyle Business does not expose hard-drive encryption or antivirus status through API calls, which can leave devices flagged with missing telemetry even when the integration is functioning as designed, according to Secureframe. It also documents a limited-admin pattern for API token creation that reduces blast radius while preserving integration access.
NHIMG editorial — based on content published by Secureframe: Mosyle API access limits and limited-admin token setup
Questions worth separating out
Q: How should teams handle missing endpoint security data in an integration feed?
A: Treat missing data as an assurance problem, not a device health conclusion.
Q: Why do limited API admin roles matter for security governance?
A: Because the identity used to create and sign API tokens determines the token’s effective privilege.
Q: What do security teams get wrong about device posture reporting?
A: They often assume a visible dashboard means the underlying control is fully verified.
Practitioner guidance
- Map which endpoint fields are actually retrievable Inventory the exact telemetry your integration can return, including encryption, antivirus, and other posture attributes.
- Create purpose-built integration admin identities Use a dedicated admin user for API token generation and restrict its permissions to the minimum required for integration functions.
- Define fallback evidence for device trust decisions If encryption or antivirus status cannot be retrieved from the source system, specify an alternate control signal such as EDR telemetry, MDM posture, or manual attestation.
What's in the full article
Secureframe's full article covers the operational detail this post intentionally leaves for the source:
- The exact Mosyle integration settings and permissions path used to create a limited API admin account.
- The API token creation workflow and the permission boundaries the source recommends for integration users.
- The handling of missing encryption and antivirus fields in downstream records when Mosyle cannot retrieve them.
- The documentation references and implementation notes behind the limited admin role pattern.
👉 Read Secureframe's guidance on Mosyle API access and endpoint visibility limits →
Mosyle API access gaps: what it means for device security visibility?
Explore further
10/07/2026 9:30 pm
Telemetry gaps are governance gaps when security systems treat missing data as evidence. If an integration cannot surface encryption or antivirus state, the security programme must decide whether to trust the absence of a field, query another source, or mark the device as unverified. That is a governance decision, not just a connector limitation. In practice, the control failure is often in evidence handling rather than in endpoint protection itself. Teams should design for verified state, not assumed state.
A question worth separating out:
Q: How should organisations govern API tokens used for endpoint integrations?
A: Govern them like non-human identities. Assign a dedicated owner, use least privilege, rotate or revoke tokens on a defined schedule, and review whether the account’s permissions still match the integration’s real needs. That prevents integration access from drifting into standing privilege.
👉 Read our full editorial: Mosyle API access gaps and the limits of device security visibility
