Topic starter
02/08/2026 12:29 pm
TL;DR: Mixed managed and unmanaged devices need different access treatment, according to Island's customer story, because blanket trust breaks down once contractors and BYOD users enter sensitive workflows. Browser-scoped controls can narrow exposure without assuming every endpoint deserves the same access path.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “The Case of Securing Unmanaged Devices with the Enterprise Browser”.
Key questions
Q: Why do unmanaged endpoints create extra risk for contractor access?
A: Unmanaged endpoints make local storage, copy paths, and device hygiene hard to trust, so the risk shifts to where data can move after access is granted.
Q: What breaks when managed and unmanaged devices use the same access policy?
A: The policy stops reflecting real risk.
Q: How should IAM teams govern mobile application access in BYOD environments?
A: IAM teams should govern mobile app access as an entitlement problem, not just a device problem.
Practitioner guidance
- Define separate access paths for managed and unmanaged devices Create policy branches that send unmanaged endpoints into controlled browser-based access while preserving native app use on managed devices.
- Apply posture checks before sensitive application access Use device posture assessment at session start so access decisions reflect endpoint state, not just user identity or network location.
- Limit unmanaged device access to application-scoped workflows Constrain contractor and BYOD access to the minimum set of applications and actions required for the task, rather than extending broad network reach.
Bottom line: Mixed managed and unmanaged device fleets need different access treatment if organisations want contractor and BYOD access to stay governable.
Glossary terms: Unmanaged Device, Device Posture, Managed device, Browser-mediated access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
02/08/2026 1:27 pm
Unmanaged device governance is now an access-control problem, not a remote-work exception. The central issue is that contractors and BYOD users do not fit neatly into a managed-endpoint assumption. Once that assumption breaks, identity alone is no longer enough to justify access. Practitioners should treat endpoint posture as part of the trust decision, not as a separate operational concern.
A question worth separating out:
A: Security teams should use identity-aware, target-specific access that limits users to the exact application, host, or protocol they need. That approach reduces exposure compared with network-level VPN access because credentials are short-lived, access is scoped to approved roles, and sessions can be monitored. The goal is to preserve remote productivity while avoiding standing access and unnecessary lateral movement risk.
👉 Read our full editorial: Unmanaged device controls reduce risk in BYOD and contractor access