I have fall into the scenario as below: I wanted users to remediate their system before they could log in successfully. Users use CCA is OK, but ... some users use Web agent to log in, then all checking AV rules are passed, so they can log in althoug...