Topic starter
02/08/2026 12:29 pm
TL;DR: Enterprises with mixed managed and unmanaged devices need policy-based controls that adapt access by posture, because blanket assumptions break down when contractors and BYOD users enter sensitive workflows, according to Island's customer story. The real governance issue is not remote access itself, but how identity, device state, and application access are evaluated together.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “The Case of Securing Unmanaged Devices with the Enterprise Browser”.
Key questions
Q: How should IAM teams govern mobile application access in BYOD environments?
A: IAM teams should govern mobile app access as an entitlement problem, not just a device problem.
Q: Why do unmanaged endpoints create extra risk for contractor access?
A: Unmanaged endpoints make local storage, copy paths, and device hygiene hard to trust, so the risk shifts to where data can move after access is granted.
Q: What breaks when managed and unmanaged devices use the same access policy?
A: The policy stops reflecting real risk.
Practitioner guidance
- Define separate access paths for managed and unmanaged devices Create policy branches that send unmanaged endpoints into controlled browser-based access while preserving native app use on managed devices.
- Apply posture checks before sensitive application access Use device posture assessment at session start so access decisions reflect endpoint state, not just user identity or network location.
- Limit unmanaged device access to application-scoped workflows Constrain contractor and BYOD access to the minimum set of applications and actions required for the task, rather than extending broad network reach.
Bottom line: Mixed managed and unmanaged device fleets need different access treatment if organisations want contractor and BYOD access to stay governable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:27 pm
Unmanaged device governance is now an access-control problem, not a remote-work exception. The central issue is that contractors and BYOD users do not fit neatly into a managed-endpoint assumption. Once that assumption breaks, identity alone is no longer enough to justify access. Practitioners should treat endpoint posture as part of the trust decision, not as a separate operational concern.
A question worth separating out:
A: Security teams should use identity-aware, target-specific access that limits users to the exact application, host, or protocol they need. That approach reduces exposure compared with network-level VPN access because credentials are short-lived, access is scoped to approved roles, and sessions can be monitored. The goal is to preserve remote productivity while avoiding standing access and unnecessary lateral movement risk.
👉 Read our full editorial: Unmanaged device controls reduce risk in BYOD and contractor access