Topic starter
12/06/2026 9:12 pm
TL;DR: Mixed personal and corporate device use has become the norm, with 35% of workers using their own devices and 66% using company-issued ones, according to JumpCloud. That shift pushes device management toward identity-centric controls, contextual policy, and Zero Trust assumptions that extend across endpoints, data, and access paths.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “How To Master User-Device Management In A Multi-Device World?”.
Key questions
A: Start by centering access decisions on user identity, role, and policy rather than on device trust alone.
Q: Why do shared devices create more access risk than personal devices?
A: Shared devices compress multiple users into one session boundary, so any failure to sign out, reset, or re-authenticate can expose patient data to the next user.
Q: What breaks when device trust is treated as static?
A: Static device trust breaks when the endpoint changes, the user roams, or the security posture drifts after access is granted.
Practitioner guidance
- Define an identity-first access policy Tie access decisions to authenticated identity, device posture, and session context instead of assuming corporate ownership equals trust.
- Separate device classes in governance Create distinct control expectations for BYOD, company-managed endpoints, shared devices, IoT, and third-party access paths so one baseline does not hide the weakest class.
- Enforce conditional access by risk signals Require stronger authentication or narrower permissions when device health, location, or network conditions indicate higher exposure.
Bottom line: Mixed-device work environments break the old one user, one device assumption and force access governance to move toward identity-centric policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:06 pm
Device identity, not device ownership, is now the practical trust boundary: The article shows why access decisions can no longer be built around a managed-corporate-device assumption. When people routinely move between personal and company-issued devices, the governance question becomes whether the identity and session are trustworthy enough for the requested access, not who owns the endpoint. That shifts IAM teams toward contextual enforcement and away from static endpoint trust.
A question worth separating out:
Q: Should organisations prioritise Zero Trust or UEM first for device sprawl?
A: They solve different problems, so the sequencing depends on the gap you are trying to close. UEM improves visibility and consistency across endpoints, while Zero Trust and conditional access govern whether those endpoints should be trusted at all. Most programmes need both, but access policy should not wait for perfect device management.
👉 Read our full editorial: Identity-centric device management is now the access control baseline