--- title: "Device Claim Scripts" slug: "device-claim-scripts-v6-7" description: "Learn about device claim scripts, their execution, and how to set access criteria effectively in your system for enhanced security and functionality." updated: 2026-04-17T13:47:50Z published: 2026-04-21T20:59:36Z canonical: "support.appgate.com/device-claim-scripts-v6-7" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Device Claim Scripts Device claim scripts create scripted (formerly on-demand) device claims and are selected in identity providers (IdPs). Device claim scripts are stored on the AppGate ZTNA system and execute on a user's device. Scripts are pushed to the client and run every five minutes, after which any changes to the claim are reported. The client downloads device claim scripts at authentication if they have not already been downloaded. Everything your device claims script returns will be treated as a string, including "Yes", "No", and "True". However, built-in Boolean claims, such as `isFirewallUp`, use Boolean true/false. So in this example, while setting access criteria in a policy or condition because the value returned is a Boolean, the "is true" operand works. However, for device claims, if you want to check the `myvalidCertificate` claim which has come from a device claim script and returned the value "True", then because this is a string, you cannot use the "is true" operand. So to set access criteria, use the "is" operand and "True" value. In AppGate ZTNA version 6.6 and beyond, device claim scripts are no longer enabled by default and the client will only execute scripts from profiles with verified DNS names. > [!CAUTION] > WARNING > > If you have not yet updated to version 6.6 and you intend to continue using device claim scripts after you upgrade, you must obtain an updated license file before upgrading your Collective to 6.6. ## Before you start Take the following into consideration before configuring device claim scripts: - Device claim scripts will not be executed until profile DNS names are verified by AppGate Support. - Device claim scripts will not be executed if the client is running in elevated/administrator mode. - Device claim scripts need to able to execute on the target platform and run without the user requiring admin rights. - Device claim scripts should return values through std out which will subsequently be evaluated for true/false. - The following platform-dependent script formats are supported: .exe, .sh, .bat, .vbs and .ps1. Others may run but are unsupported. Review the following background information before configuring device claim scripts: - Get a better understanding of [device claims](/v1/docs/device-claims-v6-7) including details relating to [device claim scripts](/v1/docs/device-claims-v6-7#device-claim-script). - Review the general background on the [use of scripts](/v1/docs/use-of-scripts-v6-7). - Refer to the [claims in detail](/v1/docs/claims-in-detail-v6-7) section for information about claims used in the system. - [Verify your profile DNS name(s)](/v1/docs/device-claims-v6-7). - Prepare your device claims script for uploading. - Check the [Client compatibility matrix](/v1/docs/compatibilty-matrix-v6-7) to make sure the device claim script can be used on your target platforms. Use the **Device Claim Scripts** page to: - Add a new device claim script. - Edit an existing device claim script. - Download a device claim script. When you are ready to add a device claim script, see the [Configure device claim scripts](/v1/docs/configure-device-claim-scripts-v6-7) section. ## Action Buttons Action buttons are accessed by clicking the three dots icon (![Three circular shapes stacked vertically on a dark background, selected to access a menu.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/three_dots.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A57%3A07Z&se=2026-10-27T00%3A57%3A07Z&sr=c&sp=r&sig=%2B1cz85moSTdngKR6Gtj3A%2BtCHt0DJn00Y0JrU4JHlW4%3D)) to the right of each line item in the page or from the button within the item. They are contextual, changing depending on the type of item and the state of the item. The Action button for device claim scripts displays the following option: - ***Download Script***. Downloads the script to your machine.