Client application feature compatibility

Defguard consists of multiple server-side components (Core, Gateway, and Edge) and multiple client applications (Desktop and Mobile).

For the purposes of compatibility and feature availability, this documentation assumes that:

• all server-side components are deployed using the same version and are collectively referred to as the Server;

• the desktop user-facing software is referred to as the Desktop Client;

• the mobile user-facing software is referred to as the Mobile Client.

Newer versions of the Desktop and Mobile Clients are always compatible with older Server versions. Therefore, you can update the client applications on your users’ devices before updating the Server.

Use this page to verify which client version is required to use specific features with your Server version, and whether updating the client applications is necessary after a Server upgrade.

The feature list focuses on cross-component features, meaning features that require cooperation between the Server and a client application. Server-only features are not included.

Feature compatibility matrix

Feature	Introduced in	Min. Server version	Min. Desktop Client version	Min. Mobile Client version	Comment
Connecting to a location with Internal MFA (Email/TOTP codes)	1.4	1.4	1.4	1.5
Connecting to a location with External MFA (OIDC auth)	1.5	1.5	1.5	1.5
Connecting to a location with Biometric (using mobile client)	1.5	1.5	1.5	1.5
Service Locations	1.6	1.6	1.6	Desktop-only	Older client applications won't get service locations in their configuration updates.
Setting MTU	1.6	Client-only	1.6	Desktop-only
Desktop Client Auto Provisioning	1.6	1.6	1.6	Desktop-only
Client Traffic Policy Selection	1.6	1.6	1.6	1.6	Older client applications ignore new "Force all traffic" option, but respect "Disable all traffic" because it maps to a legacy toggle
Static IP assignment	2.0	2.0	1.4	1.5
Device Posture verification	2.1	2.1	2.1	1.7	Older client applications won't get posture-enabled locations in their configuration updates.
CLI client	2.1	1.6	2.1	Desktop-only	Bundled with the desktop client.
Service locations for Linux	2.1	1.6	2.1	Desktop-only	Older client applications won't get service locations in their configuration updates.
Multi Factor Auth Flows	2.2	2.2	2.2	2.2	Older client application will be able to connect to locations with compatible MFA flows: single-step flow with all internal factors or single-step flow with all external factors
FIDO2 hardware key as an MFA factor	2.2	2.2	2.2	Desktop-only	Older client application will be able to connect to locations with compatible MFA flows (described above). Older clients will not be able to use FIDO2 as a factor. There need to be other factors configured in the flow (TOTP, Email) for the client to pass MFA.