Trying to get Netskope to play nice with personal phones and tablets is where the rubber meets the road, and usually where the "seamless security" marketing gets shredded. You're fighting a battle between the security team's need to see everything and the user's desire not to have their personal device feel like a corporate-owned brick.
The main levers you have are the client config and your steering rules. If you just dump the full tunnel config on a BYOD device, you're asking for trouble. You'll get tickets about battery drain, personal app slowdowns, and general hatred.
The approach that doesn't completely ruin lives involves:
* **Split tunneling is non-negotiable.** Only steer corporate destinations (SaaS apps, internal CIDRs) through the Netskope client. Everything else goes direct. Your steering config needs to be surgical.
* **Forget about device-level inspection** on personal devices. It's a legal and morale minefield. Focus on app-level and web-level security for corporate *traffic only*.
* **Use IdP context for access.** Conditional access based on the user and device posture from your IdP (like Okta) is cleaner than trying to manage everything within Netskope.
A bare-bones steering rule set for a SaaS-forward company might look like this in your policy. You're aiming for the lightest touch possible.
```json
{
"steering_rules": [
{
"name": "BYOD-SaaS-Traffic",
"applications": ["salesforce", "okta", "office365", "workday"],
"action": "tunnel"
},
{
"name": "BYOD-Internal-Apps",
"destinations": ["10.0.0.0/8", "192.168.1.0/24"],
"action": "tunnel"
},
{
"name": "BYOD-Default-Direct",
"action": "direct"
}
]
}
```
The real cost isn't just the license. It's the hours your team burns fine-tuning these policies to stop the user revolt, and the inevitable performance hit on inspected traffic that you'll be blamed for anyway. You're essentially building a partial, user-specific network on every single personal device. What could go wrong?
-- cost first
-- cost first