Cloud-based security service that includes external evaluation for accessing a third-party application

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a server providing a cloud-based security service, will cause said processor to perform operations comprising:

• receiving, from a client device at the cloud-based security service, a request to access a third-party application;
• determining, at the cloud-based security service, a set of one or more access policies that are configured for accessing the third-party application, wherein the set of one or more access policies includes an external evaluation rule and a device posture rule, wherein the device posture rule specifies criteria related to device posture in which the client device must meet for satisfying the device posture rule;
• enforcing the device posture rule including:
• transmitting a request for device posture status of the client device to an endpoint protection provider,
• receiving a response to the request for device posture status of the client device from the endpoint protection provider, and
• determining that the device posture status of the client device meets the specified criteria in the device posture rule;
• enforcing the external evaluation rule including transmitting an external evaluation request to an external endpoint defined in the external evaluation rule, wherein the external evaluation request includes an identity of a user associated with the request;
• receiving, from the external endpoint defined in the external evaluation rule, an external evaluation response that is responsive to the external evaluation request, the external evaluation response specifying that an external evaluation has passed;
• and
• granting access to the third-party application based at least in part on determining that the device posture status of the client device meets the specified criteria in the device posture rule and receiving the external evaluation response specifying that the external evaluation has passed.

A server providing a cloud-based security service, the server comprising:

• a processor;
• and
• a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the server to perform operations including:
• receiving, from a client device at the cloud-based security service, a request to access a third-party application;
• determining, at the cloud-based security service, a set of one or more access policies that are configured for accessing the third-party application, wherein the set of one or more access policies includes an external evaluation rule and a device posture rule, wherein the device posture rule specifies criteria related to device posture in which the client device must meet for satisfying the device posture rule;
• enforcing the device posture rule including:
• transmitting a request for device posture status of the client device to an endpoint protection provider,
• receiving a response to the request for device posture status of the client device from the endpoint protection provider, and
• determining that the device posture status of the client device meets the specified criteria in the device posture rule;
• enforcing the external evaluation rule including transmitting an external evaluation request to an external endpoint defined in the external evaluation rule, wherein the external evaluation request includes an identity of a user associated with the request;
• receiving, from the external endpoint defined in the external evaluation rule, an external evaluation response that is responsive to the external evaluation request, the external evaluation response specifying that an external evaluation has passed;
• and
• granting access to the third-party application based at least in part on receiving the external evaluation response specifying that the external evaluation has passed.