What SASE Controls Actually Work for Unmanaged and BYOD Devices?

Lifecycle controls matter just as much as the connection technology. Set contractor access to expire automatically, use project-based groups, and keep sessions short enough that access doesn’t remain open after the engagement ends. That reduces the chance of forgotten accounts and stale permissions.

The useful part of SASE here is access control, not magically securing the endpoint. Use device-independent controls such as MFA, application-level policies, session limits, and detailed logging. Don’t assume you can provide the same inspection or assurance as you would on an enrolled device.

A strict agent-required policy is also a valid option: if a user cannot install the security client, they don’t get access to protected resources. It’s simpler to operate and avoids pretending that an unmanaged laptop meets your security requirements, though it may be less convenient for contractors.

For higher-risk systems, route all BYOD access through a locked-down virtual desktop or hosted application session. That gives you a place to enforce restrictions, revoke access, retain audit logs, and prevent data from being stored locally. Some teams allow direct clientless access only to low-risk tools and require the hosted session for everything important.

Treat unmanaged devices as untrusted and limit what they can reach. Clientless or per-app ZTNA works well for lower-risk applications, with MFA and short-lived access. Anything sensitive should require a managed device or a hosted workspace so the data stays off the personal laptop. We use both access tiers under the same policy framework to keep the controls consistent.