What are managed and unmanaged devices? How to protect them?

As modern work models shift between remote, hybrid, and in-office setups, the boundary between personal and corporate devices is no longer clear-cut. Employees toggle between laptops, smartphones, and tablets; some issued by IT, others personally owned and often in the same workflow.

This device diversity has created a dual challenge for IT teams: securing managed (corporate-owned) devices while also protecting the growing number of unmanaged (BYOD) devices. 

Let’s unpack managed vs. unmanaged devices, what they mean for your security posture, and how to secure both, without making life harder for users or your compliance team.

Managed vs. unmanaged (BYOD) devices: What’s the difference?

When building a modern device management strategy, it’s critical to understand how corporate-owned and employee-owned devices differ not just in terms of ownership but in how they’re configured, secured, and monitored.

What are managed devices?

Managed devices are endpoints that are owned by the organization and enrolled in a centralized device management solution such as a Unified Endpoint Management (UEM) software. These devices are completely under IT control, allowing administrators to enforce security policies, push OS and app updates, configure policy settings, monitor device and user activity, and remotely troubleshoot when needed.

Key characteristics of managed devices include: 

• Company-owned hardware
• Enrolled in the MDM/UEM platform
• Full visibility and control for IT teams
• Enforced security policies (encryption, application management, passcode policies etc.)
• Ideal for corporate use with little to no personal usage

Use case: A logistics company issues Android tablets to delivery personnel, pre-configured with only work-related apps, and locked down via kiosk mode to prevent misuse.

What are unmanaged (BYOD) devices?

Unmanaged devices, commonly referred to as BYOD (Bring Your Own Device), are personal smartphones, laptops, or tablets that employees use to access corporate resources. These devices are not fully enrolled in a UEM but may have lightweight security controls like containerization or app-based management to protect business data.

Key characteristics:

• Employee-owned hardware
• Limited or no device-level control by IT
• Data separation through containers or app-specific policies
• Potentially higher risk due to personal usage patterns
• Often used in hybrid or remote work environments

Use case:

An employee accesses their work email and business apps from their personal iPhone, which has a secure work container managed by the company’s UEM solution.

Is BYOD a security risk? Not, if managed right

BYOD often gets a bad reputation in IT circles, and not entirely without reason. Personal devices come with varied configurations, unknown threat surfaces, and limited IT visibility. 

But here’s the truth: BYOD isn’t inherently insecure. 

The real risk lies in how it’s managed or mismanaged. 

When set up with the right controls, BYOD can be both secure and flexible. Today’s management tools make it easy to protect data without getting in users’ way.

Modern tools that enable secure BYOD

• UEM solutions with BYOD enrollment: Leading UEMs now support BYOD with selective control, using containers and profiles instead of full device management.
• Containerization: Creates a secure, isolated workspace on personal devices. Work data stays encrypted, policy-driven, and wipeable without intervening with personal content.
• Conditional and zero-trust access: Applies access rules based on device health, OS, location, and compliance. Only verified devices get into business apps.

With these tools in play, BYOD stops being a risk vector and becomes a controlled, secure extension of your enterprise ecosystem.

Choosing the right device strategy: Managed, unmanaged, or both?

There’s no one-size-fits-all approach when it comes to endpoint strategy. The right mix, whether managed devices, BYOD, or both, depends on the organizational operations, compliance needs, and how your teams work. 

In practice, many organizations combine the two: managed devices for roles needing tight control, and secure BYOD for flexibility where risk is lower. To get this balance right, IT leaders must assess both organization-wide priorities and device-level requirements across control, cost, and user experience.

Business-wide factors to consider:

• Regulatory compliance: In healthcare, finance, and aviation, fully managed and encrypted devices are the default.
• Security posture: High-risk organizations (e.g., government contractors, critical infrastructure) need control that BYOD models can’t fully guarantee. 
• Work model: Remote workplaces use both managed and BYOD devices effectively since managed devices offer IT consistency; BYOD adds flexibility and speeds up onboarding.
• IT resources and overhead: Managing company-owned devices is resource-heavy, while BYOD cuts hardware costs but complicates policy enforcement.
• User experience and flexibility: BYOD works when access is seamless and personal data stays private. This increases user satisfaction and productivity. 

Device-specific factors to evaluate: 

How to secure managed devices

Securing managed devices is a foundational element of any enterprise IT strategy. Because IT teams they can secure the OS, apps, data, and network access without depending on users or third-party tools.

With a Unified Endpoint Management (UEM) solution in place, organizations can enforce these measures at scale, across Android, iOS, Windows, macOS, ChromeOS, and Linux.

Here’s how modern organizations can secure their managed devices effectively:

1. OS update and patch management

Keeping the operating system up to date is non-negotiable. UEM solutions allow IT teams to automate OS upgrades and deploy security patches without manual user intervention.

• For Android, this includes timely OS version upgrades to minimize the risk of known vulnerabilities.
• For Windows, ChromeOS, and macOS, UEMs can enforce both major updates and critical security patches across endpoints.
• This ensures all devices are consistently compliant with the latest security standards and feature sets.

2. Third-party application patching

Beyond the OS, most vulnerabilities lie within third-party applications. UEMs allow IT teams to:

• Monitor and patch commonly used apps like browsers, messaging tools, and productivity suites
• Automate updates for apps such as Zoom, Chrome, and Slack
• Reduce risks without depending on user action

3. Data encryption

Data must remain secure at rest. UEMs can enforce native encryption protocols across device platforms. For example: 

• BitLocker encryption for Windows endpoints.
• FileVault encryption for macOS devices.

This ensures that even if a device is lost or stolen, the data remains unreadable and protected from unauthorized access.

4. Kiosk mode

For corporate-owned frontline devices, kiosk mode restricts usage to a single app or a predefined set of apps and helps: 

• Using single app kiosk mode to lock devices to one specific app or a selected group of apps.
• In retail checkouts, field tools, and feedback kiosks
• Boosting focus and productivity by limiting distractions
• Minimizing security risks by blocking unnecessary system access

5. Device authentication (context-aware access controls)

Using contextual parameters, IT can:

• Define access rules based on context like time, location, and network
• Restrict access during non-business hours or from risky geographies
• Apply ‘keycard-style’ logic to allow only trusted access conditions
• Prevent unauthorized access without constant manual oversight

6. Just-in-Time (JIT) admin access

Permanent admin rights are a security liability. Just-in-time (JIT) access allows temporary elevation of privileges for specific tasks, then automatically revokes admin rights after a set period. This is particularly valuable for managed desktops and laptops — ensuring users only have elevated access when absolutely necessary and not a second longer.

7. VPN tunneling

A secure, encrypted tunnel is essential when devices connect to public or home networks. UEM-integrated endpoint security solutions can enforce always-on or conditional VPN usage, ensuring that all corporate traffic is routed through secure channels. This protects data in transit and hides enterprise activity from malicious actors.

8. Web content filtering

By restricting access to non-work-related or malicious websites, web filtering prevents accidental exposure to phishing, malware, or unnecessary content. Admins can directly block specific domain categories such as social media, adult content, or e-commerce, increasing productivity while improving endpoint hygiene.

9. Certificate-based Wi-Fi and VPN authentication

Rather than relying on shared credentials, UEMs can distribute digital certificates to endpoints for seamless, secure network authentication. This is particularly effective on enterprise Android and Windows devices, enabling zero-touch connectivity to approved networks and VPNs.

10. Passcode and authentication policies

Mandating strong, regularly rotated passcodes is fundamental. These measures reduce the risk of unauthorized device access. UEMs can enforce:

• Minimum passcode complexity
• Biometric authentication requirements
• Auto-lock after idle periods

11. Integration with Mobile Threat Defense (MTD)

 UEM and MTD integration extends protection against mobile-specific threats like:

• Rooted or jailbroken devices
• Malicious apps
• Unsecured Wi-Fi connections
  UEMs can trigger automated responses — such as isolating or wiping the device — when threats are detected.

12. Peripheral restrictions

To prevent unauthorized data transfer, UEMs can block peripheral usage such as USB ports, SD card slots and external storage devices like pendrives and hard disks. This is required in regulated industries and for protecting sensitive data.

13. Location tracking and geofencing

UEMs provide real-time location tracking for lost or stolen devices. Additionally, geofencing allows admins to create virtual boundaries and apply policies based on location. For example, disabling the camera or blocking certain apps when a device enters a secure facility.

14. Network configuration management

Admins can remotely configure Wi-Fi, VPN, and proxy settings across fleets of devices. Public Wi-Fi usage can be restricted, and secure enterprise networks can be auto-enforced, reducing the chances of man-in-the-middle (MitM) attacks.

15. User, device, and subgroup policies

UEMs support logical grouping of users and devices based on roles, location, or department. This allows for tailored policy enforcement, easier delegation of IT control, and scalable device lifecycle management

16. Communication settings control

IT can regulate device communication features like outgoing phone calls, SMS/MMS and bluetooth sharing. Restricting these capabilities helps prevent data exfiltration and enforces organizational policies.

17. Remote monitoring and management (RMM)

Admins can enforce commands like lock, reboot, wipe, or reset from a central console. Device health parameters including battery, memory, storage) can be monitored in real-time. Remote troubleshooting also minimizes downtime and reduces onsite support needs.

18. Automated compliance monitoring and remediation

With continuous automated monitoring, devices are proactively scanned for compliance issues, such as disabled encryption, outdated OS, or a device falling out of policy; automated remediation kicks in instantly. Actions like:

• Auto-locking the screen
• Displaying warning messages
• Wiping corporate data

help maintain security posture without manual intervention.

How to deal with unmanaged (BYOD) devices

Managing and securing unmanaged or BYOD (Bring Your Own Device) devices presents unique challenges. Since the organization doesn’t own or fully control these devices, it can be harder to enforce standard security measures. However, with the right tools and strategies, IT teams can ensure BYOD devices remain compliant with corporate security standards.

Here’s how organizations can secure unmanaged devices:

1. Containerization

Containerization is one of the most effective ways to separate work data and personal data on BYOD devices. A work container encapsulates corporate apps, data, and documents, keeping them isolated from the user’s personal apps and files. 

This ensures that sensitive corporate information is protected even if the personal part of the device is compromised. With UEM solutions, containerization also allows granular control over work apps, such as enforcing encryption, controlling data access, and even remotely wiping the work container without affecting personal data.

2. Application management

While BYOD devices might not be centrally managed, IT teams can still control the apps that are deployed in the work container on these devices.  Admins can block and allow applications or create a list of allowed applications that can be enforced to ensure that end-users have access only to trusted applications. 

Additionally, managed app configurations can be applied to configure apps according to corporate policies. For example, organizations can enforce settings such as restricting copy-paste functionality for sensitive documents.

3. Enforcing security policies

To ensure the security of work data on BYOD devices, organizations can enforce a range of security policies on the work container, such as:

• Data encryption for work-related data stored within the container (to ensure that data is protected even if the device is lost or stolen).
  
• Passcode policies for work containers, requiring users to enter a strong passcode before accessing corporate resources. This can include biometric authentication options such as fingerprint scanning or face recognition for added security.
• By enforcing these policies, organizations can mitigate the risk of unauthorized access to work data while allowing users to keep their personal data separate.

4. Conditional email access

Email is often a primary vector for data breaches, especially on BYOD devices where the device owner has the flexibility to install and use third-party apps. To secure email access, organizations can use conditional access policies to ensure that only devices that meet specific security requirements such as device encryption, OS version level, etc,. an access corporate email accounts. This ensures that even if the device is not fully compliant, access to corporate email can be restricted or controlled.

5. Data Loss Prevention (DLP) at the container Level

Data Loss Prevention (DLP) capabilities can be enforced at the container level to ensure that corporate data within the work container is not shared inappropriately. This can include:

• Restricting copy-paste functionality from work apps to personal apps or other unauthorized areas.
• Disabling screenshots to prevent confidential data from being captured and shared.
• Restricting file sharing between work and personal apps to prevent unauthorized data transfers.
  DLP tools at the container level ensure that even if a device is compromised or lost, sensitive information remains protected.

6. Content management

Managing the content on BYOD devices, particularly documents and files that are part of the work container, is crucial to maintaining data security. IT teams can enforce policies around what content is accessible and how it can be used. 

For example, documents may only be viewable within specific apps, and downloading or printing documents may be restricted to prevent unauthorized data exfiltration. Content management systems ensure that employees can still access necessary work documents without compromising security.

7. Remote support

In the event of a security incident or a user needing assistance, remote support tools allow IT admins to troubleshoot issues or provide solutions directly on BYOD devices. For instance, if a BYOD device is compromised or the employee encounters a problem that might lead to a security breach, IT can remotely access the device, monitor its status, and apply necessary security fixes or policies. This ensures quick resolution of issues while maintaining the security of the device.

With Scalefusion, securing both managed and unmanaged devices becomes seamless

As hybrid work and BYOD adoption grow, securing both managed and unmanaged devices is now a core IT responsibility. Scalefusion helps IT teams manage and protect devices across platforms like Windows, Android, iOS, macOS, Linux, and ChromeOS.

IT can centrally enforce security policies using device profiles, ensuring both company-owned and personal devices stay compliant. With automated controls and consistent enforcement, Scalefusion reduces risk without relying on user intervention.

It also protects sensitive data while keeping devices user-friendly, enabling flexibility without compromising security. Whether devices are corporate or employee-owned, Scalefusion simplifies compliance and risk management without the usual complexity.

FAQs

 1. What is security device management?

Security device management involves using tools like UEM or MDM to monitor, configure, and enforce security policies across both corporate and personal devices. It ensures that sensitive data is protected, compliance requirements are met, and devices are kept secure by controlling access, applying patches, and enforcing encryption.

2. Can BYOD devices be compliant with industry regulations like HIPAA or GDPR?

Yes, BYOD devices can comply with regulations like HIPAA or GDPR if the right security measures are applied. With UEM, containerization, and data loss prevention (DLP), companies can protect sensitive data on personal devices through encryption, remote wipe, and conditional access, ensuring compliance while preventing unauthorized access.

5. Why are unmanaged devices dangerous?

Unmanaged devices are risky because they lack centralized security controls, leaving sensitive corporate data exposed to threats like malware, data leakage, and unauthorized access. Without proper monitoring or encryption, these devices can easily become entry points for cyberattacks. The lack of consistent security measures makes it difficult to enforce policies and ensure that personal devices meet the organization’s security standards.

3. What are the main risks of unmanaged devices in the workplace?

Unmanaged BYOD devices pose risks such as data leakage, malware, and lack of consistent security measures. Without centralized management, it’s harder to enforce security protocols, and if a device is lost or stolen, corporate data could be compromised. These risks can be minimized with tools like containerization and remote wipe.

4. How does containerization protect corporate data on personal devices?

Containerization isolates corporate data within a secure environment on personal devices, ensuring it’s separate from personal apps. This prevents unauthorized access and allows IT to encrypt data, enforce access controls, and remotely wipe the corporate container if needed, without affecting personal data.