How should security teams enforce access controls when employees use managed and unmanaged devices for web apps?

Security teams should apply conditional access that verifies user identity, device posture, and session context before allowing access to sensitive web applications. The goal is to reduce blind spots without creating unnecessary friction. A secure browser layer can help isolate activity, enforce policy consistently, and preserve visibility across SaaS and web use cases.

Why This Matters for Security Teams

Managed and unmanaged devices create two different trust problems, but web apps often expose them through one shared login flow. If access is granted only on user identity, teams miss device risk, session hijacking, and data exfiltration paths. If access is blocked too aggressively, employees bypass controls or move work into unsanctioned channels. The practical objective is to make access decisions on identity, posture, and session context at the moment the request is made.

That is why current guidance increasingly combines conditional access with browser-based controls and stronger identity governance. NIST’s NIST Cybersecurity Framework 2.0 and OWASP’s OWASP Non-Human Identity Top 10 both reinforce the same operational theme: trust should be evaluated continuously, not assumed after sign-in. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks notes that 90% of IT leaders say properly managing NHIs is essential for successful zero trust implementation, which matters here because unmanaged device access often intersects with tokens, sessions, and downstream API use. In practice, many security teams encounter risky shadow access only after a session has already been established and data has already moved.

How It Works in Practice

Effective enforcement usually starts with identity provider policy, then extends into the browser or access gateway. At sign-in, the policy engine checks user identity, device posture, location, application sensitivity, and risk signals. For managed endpoints, teams can allow broader access if the device is compliant and encrypted. For unmanaged endpoints, access can be restricted to a secure browser, limited to read-only workflows, or conditioned on stronger authentication and shorter session lifetimes.

The control point matters. If the policy is enforced only at login, a user can authenticate once and then continue on an untrusted session for hours. If it is enforced at the browser layer, teams can isolate copy and paste, block downloads, watermark content, and revoke access when risk changes. This aligns with the direction of least privilege in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where session controls, access enforcement, and auditability are required.

Operationally, teams should distinguish between three cases:

• Managed device with healthy posture: allow normal access, but keep adaptive session monitoring.
• Unmanaged device with low-risk app: allow controlled access through browser isolation or step-up authentication.
• Unmanaged device with sensitive app: deny direct access and require a managed endpoint or VDI-style control.

NHIMG’s Ultimate Guide to NHIs shows that 97% of NHIs carry excessive privileges and 96% of organisations store secrets outside secrets managers, which is relevant because browser-based access can still expose session tokens, embedded API calls, and downstream tool access if controls are weak. These controls tend to break down in BYOD-heavy environments with legacy SaaS apps that cannot consume device signals consistently because policy enforcement becomes fragmented across browsers, IdPs, and app-specific settings.

Common Variations and Edge Cases

Tighter device-based control often increases user friction and support overhead, requiring organisations to balance stronger containment against faster access for frontline work. The hard part is not the policy language, but the exceptions: contractors on personal laptops, executives needing travel access, and legacy web apps that do not expose granular session controls. Current guidance suggests handling these cases with explicit risk tiers rather than one universal rule.

For example, some teams treat unmanaged devices as acceptable only for low-sensitivity tasks such as knowledge base lookup or ticket triage. Others permit limited access if the browser runs in an isolated environment and the session is continuously re-evaluated. This is where NHIMG’s Top 10 NHI Issues is a useful reminder that identity risk is often amplified by weak lifecycle discipline, not just login policy. The same applies to user sessions and delegated tokens.

There is no universal standard for every unmanaged-device scenario yet. Best practice is evolving toward policy that is:

• context-aware rather than location-only
• session-based rather than login-only
• app-sensitive rather than one-size-fits-all
• revocable in real time when posture or risk changes

For organisations handling regulated data, that approach should be paired with audit logging and periodic policy review under NIST CSF 2.0. The guidance becomes less reliable when apps lack modern identity hooks, because then the control depends on proxying or browser enforcement that may not capture all data paths.

Related resources from NHI Mgmt Group

• How should security teams manage SaaS access when employees use both managed and unmanaged apps?
• What should organisations do when employees use unmanaged devices for web access?
• How should K-12 teams enforce CIPA controls across managed and unmanaged devices?
• How should security teams enforce zero trust across managed and unmanaged devices?