[MacOS Client] Biometric posture check fails when Twingate starts in clamshell mode

Last updated: October 14, 2026

Applicable to:

  • Twingate Component: Client | Device Security

  • Platform: macOS

Overview

When biometric configuration is required in a Device Security policy, a MacBook used in clamshell mode (lid closed, connected to an external display) can fail the posture check. macOS doesn’t make Touch ID available while the lid is closed, so the Client can’t confirm that biometrics are configured.

Symptoms

  • Signing in to Twingate, or accessing a Resource, fails with “Device security not met” or “Device requirements not met”, even though Touch ID is set up on the Mac.

  • It typically happens after the Mac is restarted, or Twingate is quit and reopened, while the lid is closed.

  • The Client logs show biometrics couldn’t be evaluated:
    Unable to evaluate DeviceOwnerAuthenticationWithBiometrics policy, error - systemCancel, will return cached value

Cause

MacOS disables Touch ID while a MacBook is in clamshell mode, unless a keyboard with Touch ID is connected.

To reduce failures, the Twingate Client remembers the last successful biometric check while it’s running. If the Client has confirmed biometrics with the lid open, closing the lid afterwards doesn’t cause the check to fail.

However, this remembered result is cleared when Twingate is quit or the Mac restarts. If Twingate then starts while the Mac is already in clamshell mode, there’s no previous result to use, and biometric configuration is reported as not available.

Resolution

Use one of the following:

  1. Open the lid when starting Twingate. After a restart, or after reopening Twingate, open the lid and connect. Once connected, you can close the lid and continue in clamshell mode.

  2. Use a keyboard with Touch ID. An Apple Magic Keyboard with Touch ID, paired with the Mac, keeps biometrics available while the lid is closed.

If the check still fails with the lid open, contact Support with your Client logs.