Companies will now be able to cryptographically validate the identity of Chrome OS devices connecting to their networks and verify that those devices conform to their security policies.

On Thursday, Google announced a new feature and administration API called Verified Access. The API relies on digital certificates stored in the hardware-based Trusted Platform Modules (TPMs) present in every Chrome OS device to certify that the security state of those devices has not been altered.

Many organizations have access controls in place to ensure that only authorized users are allowed to access sensitive resources and they do so from enterprise-managed devices conforming to their security policies.

Most of these checks are currently performed on devices using heuristic methods, but the results can be faked if the devices’ OSes are compromised. With Verified Access, Google plans to make it impossible to fake those results in Chromebooks.

Organizations will be able to integrate their WPA2 EAP-TLS networks, VPN servers, and intranet pages that use mutual TLS-based authentication with the Verified Access API through the cloud-based Google Admin console.

The cryptographic verification mechanism can be used to guarantee the identity of a Chrome OS device and user, but more importantly to ensure that they have the proper verified boot mode device policy or user policy as specified by the domain admin.

“When integrating with an enterprise CA, for instance, hardware-protected device certificates can be distributed only to managed, verified devices,” Saswat Panigrahi, senior product manager for Chrome for Work, said in a blog post.

However, before organizations can use the new feature, they need to install a special extension on their Chrome OS devices and to have network services that understand the Verified Access protocol. That’s why Google is inviting identity, network, and security providers to integrate their products with its new API.