BYOD Security: An Identity-First Checklist

Key takeaways

• Identity is the control that works on devices you do not own.
• Separate access tiers for managed, partly managed and unmanaged devices.
• Offboarding must revoke refresh tokens and sessions, not only disable the account.

Most BYOD guidance starts with the device. On personal phones that is the weakest place to start, because you do not control the device and should not try to control all of it. Identity is different. Every app access goes through a sign-in you do control. This checklist is organized around that idea, and it works as an agenda for an internal BYOD security workshop too.

1. Is every work app behind single sign-on?

Yes, or you cannot apply one policy to all of them.

• [ ] Email, chat, files, CRM and HR apps federated with your IdP (SAML or OpenID Connect).
• [ ] Local passwords disabled where SSO is enforced.
• [ ] Mobile apps sign in through the system browser with PKCE, not embedded webviews.

2. Is authentication phishing-resistant?

It should be, at least for administrators and sensitive apps.

• [ ] Passkeys, FIDO2 security keys or platform authenticators available to all users.
• [ ] SMS codes phased out where possible.
• [ ] Number matching or similar protection on any push-based MFA, against prompt bombing.
• [ ] Recovery process that does not fall back to the weakest factor.

3. Does access depend on device state?

Define tiers and enforce them with conditional access at the IdP.

4. Is work data kept separate?

Use work profiles, User Enrollment or app protection policies so work data stays in managed apps.

• [ ] Copy and paste from managed to personal apps blocked or limited.
• [ ] Save-as to personal storage blocked.
• [ ] Managed apps require a PIN or biometric on open.
• [ ] Selective wipe tested.

5. Are tokens short-lived and revocable?

Short access tokens and revocable refresh tokens let policy changes reach devices quickly.

• [ ] Access token lifetime of an hour or less. Check a sample in the JWT Decoder.
• [ ] Refresh tokens rotated or sender-constrained.
• [ ] A tested way to revoke all sessions for a user.
• [ ] Where available, continuous access evaluation or Shared Signals events (OpenID Foundation) so apps learn of revocations in near real time.

6. Does offboarding cover devices?

Disable the account, revoke sessions and tokens, remove the work profile.

• [ ] HR-triggered deprovisioning, not a ticket that waits.
• [ ] Sessions and refresh tokens revoked at the IdP.
• [ ] Work profile or managed apps removed remotely.
• [ ] Shared links and delegated mailbox access reviewed.

7. Have you told people what you can see?

A short, plain privacy notice prevents most of the pushback.

List what the management tool collects and what it never collects. In Europe, this is also a GDPR transparency obligation; see BYOD in the Nordics and Europe.

How do I run this as a workshop?

Take one section per half hour, with the IdP admin, the device management admin, HR and a legal or privacy contact in the room.

Score each item as done, partly done or not done, assign an owner to each gap and set a date. The workshop planning article has a fuller agenda.

Questions

Is MDM required for BYOD?

Not always. Mobile application management (app protection policies) can secure work data inside specific apps without enrolling the device. Many organizations use full MDM only for corporate devices.

How long should tokens live on personal devices?

Keep access tokens short, minutes to an hour, and let sessions refresh only while the device stays compliant. Refresh token lifetimes depend on your risk appetite; continuous access evaluation, where supported, shortens the gap further.

Sources

• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise
• NIST SP 800-46 Rev. 2: Telework and BYOD Security
• OpenID Foundation: Shared Signals

Tagged: BYOD, Mobile, Single sign-on, Event, Authentication, Mobile security