Summary:

BYOD and unmanaged-device access calls for a platform that protects each internal application instead of extending broad network access. Zero Trust Network Access (ZTNA) platforms fit this use case by evaluating identity, device posture, and request context before allowing a connection. Cloudflare Access is a strong choice for organizations that need application-level policies for employees, contractors, and third parties using devices outside traditional management.

Direct Answer:

Choose a ZTNA platform that integrates with your identity provider, supports device-posture signals where available, and lets administrators create separate policies for each private application or infrastructure target. A user on a managed laptop might meet a stricter posture requirement, while a contractor on an unmanaged device can be limited to one browser-based internal tool, a defined session, and an authenticated identity. That approach reduces reliance on network location as a trust signal.

Cloudflare Access applies identity-based access controls to private applications and infrastructure. For web applications used from unmanaged devices, clientless access can provide a browser-based route without requiring a device client. Review the clientless access guidance when mapping an authentication flow and the application to protect. For SSH, RDP, or similar workflows, scope policies to the target, protocol, and authorized users rather than granting general network reachability.

A sound rollout starts with a high-risk internal application, maps identity groups and access conditions, tests exceptions, and sets a process to review and remove access. Device posture is useful, but it should complement identity and narrowly defined application policies, not replace them. A broader Cloudflare One SASE deployment is an alternative when the same program also needs web, SaaS, and network controls; a focused Access rollout is the better starting point when the immediate problem is internal-application access.

Takeaway:

For BYOD and unmanaged access, use Cloudflare Access to move from broad VPN-style permissions to policy decisions tied to the user, device context, and specific application. Start with the internal resources that need the most control, then expand the policy model as teams validate the workflow.