A computer-implemented method of providing access to one or more resources to a user computing device, the computer-implemented method being performed by one or more processors executing computer executable instructions for the computer-implemented method, and the computer-implemented method comprising: at a user computing device, registering with an identity service to obtain an identity credential; trying to connect a service endpoint; after authenticating to the identity management system, receiving a token from the identity management system and passing it to the service endpoint; after the token is inspected by the service endpoint for a claim that the client device is managed, failing to authenticate because the claim is not present; after being redirected by the service endpoint to the policy management system; at the user computing device, registering with a policy management service by presenting the identity credential; after the policy management system has deployed any targeted compliance policy, wherein the targeted compliance policy has deployed policy to the device so that the device will comply with the policy for accessing the service endpoint or wherein the policy management system has indicated what the user needs to change about the device state to comply with the policy for using the endpoint or wherein the compliance policy has requested various pieces of state; interpreting and processing the policy; at the user computing device, providing an indication of current state of the user computing device to the policy management service; and the user computing device receiving a token from the identity service based on the policy management level of the user computing device as compared to a policy set, as the policy management service has provided an indication of compliance with the policy set to the identity service, the method further comprising the user computing device presenting the token to a service endpoint to attempt to access a resource at the service endpoint. at a user computing device, registering with an identity service to obtain an identity credential; trying to connect a service endpoint; after authenticating to the identity management system, receiving a token from the identity management system and passing it to the service endpoint; after the token is inspected by the service endpoint for a claim that the client device is managed, failing to authenticate because the claim is not present; after being redirected by the service endpoint to the policy management system; at the user computing device, registering with a policy management service by presenting the identity credential; after the policy management system has deployed any targeted compliance policy, wherein the targeted compliance policy has deployed policy to the device so that the device will comply with the policy for accessing the service endpoint or wherein the policy management system has indicated what the user needs to change about the device state to comply with the policy for using the endpoint or wherein the compliance policy has requested various pieces of state; interpreting and processing the policy; at the user computing device, providing an indication of current state of the user computing device to the policy management service; and the user computing device receiving a token from the identity service based on the policy management level of the user computing device as compared to a policy set, as the policy management service has provided an indication of compliance with the policy set to the identity service, the method further comprising the user computing device presenting the token to a service endpoint to attempt to access a resource at the service endpoint.