A method for authenticating a user by determining whether a client device is in compliance with compliance rules of an enterprise, using an identity provider configured to carry out federated authentication on behalf of the enterprise, the method comprising: obtaining, at the identity provider, an authentication request over a network connection from an authentication proxy, the authentication request originating from a tunnel client executed by the client device, and the tunnel client terminating a virtual private network, VPN, connection at the authentication proxy; querying, using the identity provider, the authentication proxy for at least one device identification parameter associated with the authentication request, wherein the at least one device identification parameter is embedded within a security layer applied to the authentication request, wherein the authentication request is secured with transport layer security, TLS, and the security layer comprises an additional TLS encryption layer applied to the authentication request, wherein the at least one device identification parameter is embedded into the additional TLS encryption layer, and wherein the additional TLS encryption layer is terminated at the authentication proxy; providing the at least one device identification parameter from the identity provider to a management service; obtaining, at the identity provider, an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules; and in an instance in which the indication indicates that the client device is compliant with the plurality of compliance rules, authenticating the client device using the identity provider. obtaining, at the identity provider, an authentication request over a network connection from an authentication proxy, the authentication request originating from a tunnel client executed by the client device, and the tunnel client terminating a virtual private network, VPN, connection at the authentication proxy; querying, using the identity provider, the authentication proxy for at least one device identification parameter associated with the authentication request, wherein the at least one device identification parameter is embedded within a security layer applied to the authentication request, wherein the authentication request is secured with transport layer security, TLS, and the security layer comprises an additional TLS encryption layer applied to the authentication request, wherein the at least one device identification parameter is embedded into the additional TLS encryption layer, and wherein the additional TLS encryption layer is terminated at the authentication proxy; providing the at least one device identification parameter from the identity provider to a management service; obtaining, at the identity provider, an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules; and in an instance in which the indication indicates that the client device is compliant with the plurality of compliance rules, authenticating the client device using the identity provider.