the first option does work, tried doing that checking for 3 certs but then saw a few users with way more. Don't know how it would affect posture assessment times to do 20, 30 or 50 cert checks. I don't want this to be very noticeable for users. I'll ...

I saw the presentation and I am having problems making this work..I am using Mac, windows and linux so the endpoint.certificate.user is actually captured by hostscan and I see it in the debug dap trace. However, my problem is with policy matching, en...