--- title: "SSE: BYOD for SaaS with Identitiy Proxy" description: "Secure SaaS access from BYOD devices: Enabling access from private devices to SaaS with Identity Proxy and Browser Isolation from Zscaler and Cloudflare." image: https://rheintec.io/hubfs/Zscaler%20%26%20Cloudflare%202.png --- [Skip to content](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#main-content) [![Rheintec logo](https://rheintec.io/hubfs/website_assets/logo/logo-white.svg "Rheintec logo")](https://rheintec.io/home?hsLang=en) - [ KMU ](https://kmu.rheintec.io/de-ch/it-fuer-kmus) - [Enterprise](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Enterprise - [Consulting](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Consulting - [ IT Security Consulting ](https://rheintec.io/en/consulting/security/it-security-consulting) - [ Cyber Security Review ](https://rheintec.io/en/consulting/cybersecurity-review) - [ Governance, Risk & Compliance Consulting ](https://rheintec.io/en/consulting/compliance-and-governance) - [Zscaler](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Zscaler - [ Zscaler Architecture Consulting ](https://rheintec.io/en/consulting/zscaler/architecture-consulting) - [ Zscaler Health Checks ](https://rheintec.io/en/consulting/zscaler/healthchecks) - [ Zscaler Automation ](https://rheintec.io/en/consulting/zscaler/automation) - [ Zscaler Proof of Concepts ](https://rheintec.io/en/consulting/zscaler/proof-of-concept) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [ Solutions ](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#services) Show submenu for Solutions - [ Bring Your Own Device (BYOD) ](https://rheintec.io/en/solutions/zscaler-remote-browser-access) - [ CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Secure Access Service Edge (SASE) ](https://rheintec.io/en/solutions/secure-access-service-edge) - [ Secure Service Edge ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler Data Security ](https://rheintec.io/en/solutions/zscaler-data-security) - [ SD-WAN & WAN-Edge ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [Managed Services](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Managed Services - [ Managed Security Services ](https://rheintec.io/en/managed-security-services) - [ Small & Medium Companies (5-250) ](https://rheintec.io/managed-services/small-medium-companies-smb) Show submenu for Small & Medium Companies (5-250) - [ Zscaler 4 Small Businesses ](https://rheintec.io/en/managed-services/small-companies/zscaler-sse-4-small-businesses) - [ CrowdStrike XDR 4 Small Businesses ](https://rheintec.io/en/en/managed-services/small-companies/crowdstrike-xdr-4-small-businesses) - [ Mimecast 4 Small Businesses ](https://rheintec.io/de/mimecast-for-kmu) - [ Proofpoint 4 Small Businesses ](https://rheintec.io/en/rheintec-proofpoint-mail-sicherheit-f%C3%BCr-kmu-kleinunternehmen) - [ Small Business Secure ](https://rheintec.io/en/managed-services/small-companies/small-business-secure) - [ Small Business Complete ](https://rheintec.io/en/managed-services/small-companies/small-business-complete) - [ Medium Business Complete
 ](https://rheintec.io/en/managed-services/medium-companies/medium-business-complete) - [ Enterprises (250+) ](https://rheintec.io/managed-services/enterprise) Show submenu for Enterprises (250+) - [ Wiz CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Zscaler SSE ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler PSE as a Service ](https://rheintec.io/en/managed-services/enterprises/zscaler-pse) - [ CrowdStrike XDR ](https://rheintec.io/en/managed-services/enterprises/crowdstrike-xdr) - [ Mimecast Email Security ](https://rheintec.io/en/mimecast-for-enterprise) - [ Mimecast DMARC Monitoring ](https://rheintec.io/en/managed-services/enterprises/mimecast-dmarc) - [ Proofpoint Email Security ](https://rheintec.io/en/managed-services/enterprises/proofpoint-emailsecurity) - [ Cloudflare WAF ](https://rheintec.io/en/managed-services/enterprises/cloudflare-waf) - [ Cloudflare Zero Trust ](https://rheintec.io/en/cloudflare-sse-zero-trust-cloud-proxy) - [ Cloudflare DNS ](https://rheintec.io/en/managed-services/enterprises/cloudflare-dns) - [ Check Point Datacenter and Cloud Firewall ](https://rheintec.io/en/managed-services/enterprises/checkpointdatacenter) - [ Keeper PAM ](https://rheintec.io/en/managed-services/enterprises/keeper-pam) - [ Keeper Password Manager ](https://rheintec.io/en/managed-services/enterprises/password-manager) - [ Rubrik Backup & Data Protection ](https://rheintec.io/en/managed-services/enterprises/rubrik-backup) - [ Ubiquitiy WAN-Edge & SD-WAN ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Case Studies ](https://rheintec.io/case-studies-rheintec) - [ Blog ](https://rheintec.io/en/it-security-blog) - [About](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for About - [ Partner ](https://rheintec.io/de/partners) - [ About us ](https://rheintec.io/de/about) - [ Karriere ](https://rheintec.io/de/karriere) - [ KMU ](https://kmu.rheintec.io/de-ch/it-fuer-kmus) - [Enterprise](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Enterprise - [Consulting](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Consulting - [ IT Security Consulting ](https://rheintec.io/en/consulting/security/it-security-consulting) - [ Cyber Security Review ](https://rheintec.io/en/consulting/cybersecurity-review) - [ Governance, Risk & Compliance Consulting ](https://rheintec.io/en/consulting/compliance-and-governance) - [Zscaler](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Zscaler - [ Zscaler Architecture Consulting ](https://rheintec.io/en/consulting/zscaler/architecture-consulting) - [ Zscaler Health Checks ](https://rheintec.io/en/consulting/zscaler/healthchecks) - [ Zscaler Automation ](https://rheintec.io/en/consulting/zscaler/automation) - [ Zscaler Proof of Concepts ](https://rheintec.io/en/consulting/zscaler/proof-of-concept) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [ Solutions ](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#services) Show submenu for Solutions - [ Bring Your Own Device (BYOD) ](https://rheintec.io/en/solutions/zscaler-remote-browser-access) - [ CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Secure Access Service Edge (SASE) ](https://rheintec.io/en/solutions/secure-access-service-edge) - [ Secure Service Edge ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler Data Security ](https://rheintec.io/en/solutions/zscaler-data-security) - [ SD-WAN & WAN-Edge ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [Managed Services](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for Managed Services - [ Managed Security Services ](https://rheintec.io/en/managed-security-services) - [ Small & Medium Companies (5-250) ](https://rheintec.io/managed-services/small-medium-companies-smb) Show submenu for Small & Medium Companies (5-250) - [ Zscaler 4 Small Businesses ](https://rheintec.io/en/managed-services/small-companies/zscaler-sse-4-small-businesses) - [ CrowdStrike XDR 4 Small Businesses ](https://rheintec.io/en/en/managed-services/small-companies/crowdstrike-xdr-4-small-businesses) - [ Mimecast 4 Small Businesses ](https://rheintec.io/de/mimecast-for-kmu) - [ Proofpoint 4 Small Businesses ](https://rheintec.io/en/rheintec-proofpoint-mail-sicherheit-f%C3%BCr-kmu-kleinunternehmen) - [ Small Business Secure ](https://rheintec.io/en/managed-services/small-companies/small-business-secure) - [ Small Business Complete ](https://rheintec.io/en/managed-services/small-companies/small-business-complete) - [ Medium Business Complete
 ](https://rheintec.io/en/managed-services/medium-companies/medium-business-complete) - [ Enterprises (250+) ](https://rheintec.io/managed-services/enterprise) Show submenu for Enterprises (250+) - [ Wiz CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Zscaler SSE ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler PSE as a Service ](https://rheintec.io/en/managed-services/enterprises/zscaler-pse) - [ CrowdStrike XDR ](https://rheintec.io/en/managed-services/enterprises/crowdstrike-xdr) - [ Mimecast Email Security ](https://rheintec.io/en/mimecast-for-enterprise) - [ Mimecast DMARC Monitoring ](https://rheintec.io/en/managed-services/enterprises/mimecast-dmarc) - [ Proofpoint Email Security ](https://rheintec.io/en/managed-services/enterprises/proofpoint-emailsecurity) - [ Cloudflare WAF ](https://rheintec.io/en/managed-services/enterprises/cloudflare-waf) - [ Cloudflare Zero Trust ](https://rheintec.io/en/cloudflare-sse-zero-trust-cloud-proxy) - [ Cloudflare DNS ](https://rheintec.io/en/managed-services/enterprises/cloudflare-dns) - [ Check Point Datacenter and Cloud Firewall ](https://rheintec.io/en/managed-services/enterprises/checkpointdatacenter) - [ Keeper PAM ](https://rheintec.io/en/managed-services/enterprises/keeper-pam) - [ Keeper Password Manager ](https://rheintec.io/en/managed-services/enterprises/password-manager) - [ Rubrik Backup & Data Protection ](https://rheintec.io/en/managed-services/enterprises/rubrik-backup) - [ Ubiquitiy WAN-Edge & SD-WAN ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Case Studies ](https://rheintec.io/case-studies-rheintec) - [ Blog ](https://rheintec.io/en/it-security-blog) - [About](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy#) Show submenu for About - [ Partner ](https://rheintec.io/de/partners) - [ About us ](https://rheintec.io/de/about) - [ Karriere ](https://rheintec.io/de/karriere) [ Kostenlose Beratung anfordern ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLJhOjx3NEjl3dTzs3alex%2B2Sz%2BrhHiNeNPr3qhM%2Bmnd1xhH0hZc85R016Zfr4tNiAXpoJQutSl0RRl7l33WGIvDzQIOIR%2FMvZZ4ouwxGAFoXaQFdiHiPwDtXR0sbIfzA1ujA5%2BwzxqPoZeWO7EECpw3hpDCs%2BgvNAkrhioMf3iQWFSgkHyl51blL5ZZHc6r9v50UNaVzw%3D%3D&portalId=48452581) English - [Deutsch](https://rheintec.io/de/it-security-blog/sse-byod-f%C3%BCr-saas-mit-identitiy-proxy) - [English](https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy) # SSE: BYOD for SaaS with Identitiy Proxy [ Linus Espach ](https://rheintec.io/en/it-security-blog/author/linus-espach) - Oct 28, 2025 8:46:11 PM With identity proxies, companies can implement the use case "secure SaaS access from BYOD devices". This means that instead of simply "bluntly blocking" access to SaaS applications using IdP functions such as Microsoft's Conditional Access if the user is coming from an unmanaged device, the session can be dynamically redirected to browser isolation or released for native access based on the device status. This enables secure access to SaaS applications from private devices without compromising the user experience. ![Identity Proxies Zscaler & Cloudflare](https://rheintec.io/hs-fs/hubfs/Identity%20Proxies%20Zscaler%20%26%20Cloudflare.png?width=960&height=481&name=Identity%20Proxies%20Zscaler%20%26%20Cloudflare.png) ## How does access work in the traditional way? Traditionally, companies simply block access to SaaS applications (e.g. Salesforce) if the user is not accessing them from a managed device. To do this, rules are defined in Entra Conditional Access, for example, which check the compliance status of the device (e.g. "is domain joined"). Access is only permitted if the device is "compliant", i.e. "domain joined", otherwise it is blocked. The user therefore logs in to the SaaS application. The SSO-configured SaaS recognizes that it needs to authenticate the user at the IdP and forwards the request to the IdP. The IdP then responds to the SaaS as to whether the user is allowed access or not. Accordingly, the login is allowed or denied (without going into the various SAML methods - SP-initiated or IdP-initiated - here). This effectively means that the user is not granted access from their private device. However, it would be much nicer if the user could have access, but IT could control what they are allowed to do on company devices - and what they are not allowed to do on private devices. ![Conditional Access](https://rheintec.io/hs-fs/hubfs/Conditional%20Access.png?width=2143&height=799&name=Conditional%20Access.png) ## What can you achieve with an identity proxy? When using an identity proxy (part of an SSE solution), access to a SaaS application is not simply blocked or allowed. Instead, a third option is created: browser isolation. Within this isolation, you can control in detail what the user may or may not do in the session. Common features are - Restrictions based on groups, users, time, device type, URL or application (and much more) - Use of microphone and camera within the SaaS (e.g. Microsoft Teams) - Control of the copy-paste function (clipboard) in or out of isolation - Control of file uploads and downloads - Permission or prohibition of print functions - Read-only mode (keyboard input disabled) - Display of Office documents within the isolation - Deep linking (opening application links of local applications on the client) from isolation Effectively, this means that users can also access SaaS applications securely from private devices - without the risk of data loss, malware infection or breaches of compliance guidelines. Secure BYOD for SaaS in other words. ## How does access work with an identity proxy? In order for BYOD devices to be dynamically redirected to a browser isolation, the authentication of the SaaS application must first run via the SSE component. This means that the SAML request does not go directly to the IdP, but first to the SSE provider. The SSE provider checks whether the request originates from a managed or unmanaged device and remembers this information. The request is then forwarded to the actual IdP (e.g. Entra), where it is verified whether the user account is active, exists and is activated for the SaaS. Group memberships can be passed through so that IdP-based roles and authorizations in the SaaS continue to function. If the user is authorized to use the SaaS, the SSE provider - based on the device status - either sends a redirect to the browser isolation or transparently authenticates the user to the SaaS. Whether a device is considered "managed" is determined via a browser plugin or the existence of an SSE agent on the device. The above-mentioned security guidelines are then applied within the browser isolation. Both Zscaler and Cloudflare can be used as identity proxies and support browser isolation (with slightly different features). The following example shows isolated (Zscaler) and native (Cloudflare) access. ![Identity Proxy](https://rheintec.io/hs-fs/hubfs/Identity%20Proxy.png?width=1896&height=1671&name=Identity%20Proxy.png) Conclusion Et voilà: We have enabled the secure use of SaaS applications on private devices! Users can now finally access corporate SaaS from their personal devices - without compromising (data) security. Would you have known? [Zscaler](https://rheintec.io/en/it-security-blog/tag/zscaler), [SASE](https://rheintec.io/en/it-security-blog/tag/sase), [Cloudflare](https://rheintec.io/en/it-security-blog/tag/cloudflare) ### You might like [![Zscaler & Jumpcloud](https://rheintec.io/hs-fs/hubfs/Zscaler%20%26%20Jumpcloud.png?width=352&name=Zscaler%20%26%20Jumpcloud.png) ](https://rheintec.io/en/it-security-blog/zscaler-internet-access-service-status-monitoring-with-jumpcloud?hsLang=en) ##### [Zscaler Internet Access Service Status Monitoring With JumpCloud](https://rheintec.io/en/it-security-blog/zscaler-internet-access-service-status-monitoring-with-jumpcloud?hsLang=en) This blog page focuses on Zscaler Internet Access(ZIA) service monitoring on the Client device and how to create alerting mechanism to inform Internal Security teams when the ZIA service disabled. The purpose behind this alerting to make sure to have visibility on the endpoint device and help to... [![](https://rheintec.io/hs-fs/hubfs/website_assets/Blog/Zscaler.webp?width=352&name=Zscaler.webp) ](https://rheintec.io/en/it-security-blog/comparing-zscaler-privilege-remote-access-and-browser-isolation-to-vdi?hsLang=en) ##### [Zscaler Privilege Remote Access and Browser Access vs a VDI solution](https://rheintec.io/en/it-security-blog/comparing-zscaler-privilege-remote-access-and-browser-isolation-to-vdi?hsLang=en) Organizations have to make well-informed decisions regarding secure remote access needs with quick-changing business scenarios. With the increase of remote work and the need to prevent cyberattacks, businesses are exploring various solutions to ensure their operations remain efficient and secure.... [![Jumpcloud and CrowdStrike Conditional Access](https://rheintec.io/hs-fs/hubfs/Architektur%20Workshop%20Template%20-%20Proposal.png?width=352&name=Architektur%20Workshop%20Template%20-%20Proposal.png) ](https://rheintec.io/en/it-security-blog/jumpcloud-and-crowdstrike-for-conditional-access?hsLang=en) ##### [Jumpcloud and CrowdStrike for Conditional Access](https://rheintec.io/en/it-security-blog/jumpcloud-and-crowdstrike-for-conditional-access?hsLang=en) Conditional Access allows an IdP to bind authorization to more parameters than just a correct password and MFA. For example, it also takes into account device status and context. Jumpcloud now allows you to do this in conjunction with CrowdStrike. How this works and all the details below. ... ## How much does IT security cost for your SMB? Easily estimate your IT security expenses with our pricing calculator. [ Check our pricing calculator ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLLdDaGp037PwumG%2BW1z1Azp65Anr6w1bT6quyIouhPKiq9x7zfbiD2B5x7NH%2Bq7KohFerMK6uORsvnlI7w%2F%2Bcc42MZwuwbW7LvWtuiY1SdwKH3wM5erK5rc7V%2Bo4C75GnQhTIVya%2B8KfbeTtmznXJYqAgmVKwW7AKWj14zj0TvjCQ%3D%3D&portalId=48452581) [![logo-white](https://rheintec.io/hubfs/website_assets/logo/logo-white.svg "logo-white")](https://rheintec.io?hsLang=en) [Legal Notice](https://rheintec.io/legal-notice?hsLang=en) [Privacy Policy](https://rheintec.io/en/privacy-policy?hsLang=en) [Careers](https://rheintec.io/de/karriere?hsLang=en) [![rht-tuev-iso-9001](https://rheintec.io/hubfs/website_assets/iso/rht-tuev-iso-9001.webp)](https://rheintec.io/hubfs/Rheintec%20ISO%209001%20EN.pdf?hsLang=en) [![rht-tuev-iso-iec-27001](https://rheintec.io/hs-fs/hubfs/website_assets/iso/rht-tuev-iso-iec-27001.png?width=200&height=95&name=rht-tuev-iso-iec-27001.png)](https://rheintec.io/hubfs/Rheintec%20ISO%2027001%20EN.pdf?hsLang=en)   Locations ![switzerland flag](https://rheintec.io/hs-fs/hubfs/website_assets/flags/switzerland%20flag.webp?width=80&height=49&name=switzerland%20flag.webp) Rheintec Solutions AG Uferstrasse 90, CH-4057 Basel ![germany flag](https://rheintec.io/hs-fs/hubfs/website_assets/flags/germany%20flag.png?width=60&height=37&name=germany%20flag.png) Rheintec Solutions GmbH Gartenstrasse 28 • DE-86938 Schondorf am Ammersee Contact Us +41 (0) 61 568 73 95 info@rheintec.ch Subscribe to our newsletter for security insights. © 2026 All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Linus Espach", "url" : "https://rheintec.io/en/it-security-blog/author/linus-espach" }, "dateModified" : "2025-10-28T19:46:11.119Z", "datePublished" : "2025-10-28T19:46:11.000Z", "headline" : "SSE: BYOD for SaaS with Identitiy Proxy", "image" : [ "https://rheintec.io/hubfs/Zscaler%20&%20Cloudflare%202.png" ], "mainEntityOfPage" : { "@id" : "https://rheintec.io/en/it-security-blog/sse-byod-for-saas-with-identitiy-proxy", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://rheintec.io/hubfs/rheintecblue.png" }, "name" : "Rheintec Solutions AG" } } ```