BYOD asset discovery usually starts the same way. Your asset sheet looks great. Every company laptop has a tag, an owner, and a color-coded status column someone spent a weekend on. Then a customer security review lands in your inbox with one simple question. Which personal devices can open your files?
The spreadsheet goes very quiet.
Here's the thing. Finding personal devices is the easy part, because your identity provider already knows about most of them. The hard part is turning that evidence into records you'd actually show an auditor, with a named owner, a known access path, and an honest level of confidence. Here's how one IT team did it in six steps, with two admins and two weeks.
The Question the Asset Sheet Couldn't Answer
Picture a 120-person company where a quarter of the staff are contractors. People work from the office, from home, and from cafés with questionable Wi-Fi. Two admins run IT on Microsoft 365, with Intune managing the company laptops.
Then a big customer's security questionnaire asks how many personal devices can access customer data. The deadline is two weeks away. The identity records list about two and a half times as many devices as the asset sheet.
BYOD asset discovery is the process of finding personal devices that access company systems or data, then recording who uses them, how they connect, and what they can reach. You track the access, not the ownership. For the basics of running a BYOD program, see our separate guide.
Why Personal Devices Never Reach the Asset Inventory
Most IT asset management(ITAM) records start with a purchase. IT buys a laptop, tags it, and adds it to the list. Personal devices skip that step completely. They show up through a sign-in instead, usually in one of three ways.
- A personal phone with work email. An employee adds their work account in two minutes. The phone never appears anywhere IT checks.
- A contractor's own laptop. They log in from it on day one. When the contract ends, the laptop leaves with them.
- A shared family PC. Someone opens Slack "just for a minute." Now a computer used by two people has a company login on it.
The problem isn't the tools. It's the process. Onboarding never asks, "Which device will you use?" So the IT inventory only shows what the company bought, and BYOD asset discovery has to start with sign-ins, not purchases.
How to Turn BYOD Asset Discovery Into Accountable Records: 6 Steps
Most BYOD asset discovery can run on data you already have in your identity provider and MDM. Many personal devices never touch the office network, so identity data does the heavy lifting. A network scan covers the devices that do, and our guide to IT asset discovery explains how the methods fit together.
Step 1. Decide Which Company Data Puts a Device in Scope
Start with data, not devices. A device is in scope when it can reach something that would hurt if it leaked. Think customer files, finance systems, source code, and work email.
The team listed five sensitive apps. Any personal device that signs in to one of them counts. This took one afternoon.
Watch out. Don't try to inventory every phone on guest Wi-Fi. That's a lot of work for a list nobody will use.
What you get. A short scope list of apps and data that the whole team agrees on.
Step 2. Pull Device Evidence From Identity, MDM and Network Records
This step is about collecting evidence. Export from four sources.
- Your identity provider. Pull the device list and sign-in logs from Microsoft Entra ID, Okta, or Google Workspace.
- Your MDM. In Intune, filter by ownership type. In Jamf, check devices enrolled through account-driven User Enrollment.
- Work mailboxes. List the mobile devices connected to them.
- The office network. Our free Network Scanner finds every device on your LAN, including personal phones and laptops on office Wi-Fi. Export the results as a CSV and add them to your spreadsheet.
The team ended up with about 300 device entries. The asset sheet had 118 laptops.
Some entries won't have a device name. A laptop that signs in through a browser often shows only an OS and a browser in Entra sign-in logs. Keep those rows anyway. They're real access.
Watch out. Don't rely on MDM alone. The devices you most need to find are never enrolled, so MDM can't see them. Also, don't fully trust Intune's "Personal" label. Intune marks self-enrolled devices as Personal by default, so a few company laptops may be in that list.
What you get. One raw spreadsheet with a column showing where each record came from. You'll need it in Step 4.
Step 3. Clean the List Before You Count Anything
Raw device data is messy. Clean it with four rules before you report any number.
- Merge duplicates. One phone can appear several times after a reset or an app reinstall. Match by user, model, and OS, not by name. Half your users' phones are just called "iPhone."
- Match scan results by hostname. Phones use a random MAC address on office Wi-Fi, so the MAC can't tell you it's the same device.
- Mark old devices as stale. No sign-in for 90 days means stale. Don't delete them, since you may need the history later.
- Flag shared devices. Follow up instead of guessing the owner.
Here, cleanup merged 61 duplicates, marked 52 devices as stale, and flagged 6 shared ones. That left 187 active personal devices, after about two days of work.
Watch out. Don't send the raw number to management. The first BYOD asset discovery number always looks scary. Report the cleaned one.
What you get. A clean list of active personal devices.
Step 4. Sort Every Device: Seen, Attributed or Accountable
This is the step most teams skip, and it's the one that makes BYOD asset discovery worth trusting. Sort each device by how much IT actually knows about it.
Use these three levels to label every device on your clean list.
The goal isn't to make every device Accountable. The goal is that no device with access to sensitive data stays at Seen. Auditors trust honest uncertainty more than fake completeness.
Most devices on the team's list started at Seen, including every browser-only row from Step 2. A short message to each employee and contractor ("Is this your device?") moved most of them to Attributed within three days.
Watch out. "Registered in Entra ID" doesn't mean "managed." Registered only means the device signed in. It says nothing about whether IT controls it.
What you get. Every device has a confidence level.
Step 5. Choose Control Levels Based on Data, Not Device Type
Next, decide how much control each Attributed device needs. Let the data it can reach make the call.
- Sensitive data. Use app protection (MAM, or mobile application management) or allow browser-only access.
- Everything else. Require sign-in with conditional access rules, which check things like location and device health before letting someone in.
The team started with contractors. Their devices change the most, IT knows the least about them, and they leave when the project ends. We'd start there every time.
One manager refused to put MDM on their phone. Fair enough. A one-page note explaining what IT can and can't see fixed it. Track work access only. Never collect location, personal apps, or browsing history.
Watch out. Forcing full MDM on every personal device causes pushback, and people find workarounds. The workaround is usually worse.
What you get. Every Attributed device has a control level, which moves it to Accountable.
Step 6. Build Lifecycle Triggers So Records Stay Current
A BYOD record starts going out of date the day you create it. People buy new phones, and contractor projects end. Without triggers, BYOD asset discovery becomes a one-time project that's stale by next quarter. Tie updates to moments that already happen.
- Onboarding. Add one question to the checklist, "Which device will you use?" Then create the record.
- Device change. Update the record when someone gets a new phone or laptop.
- Offboarding. Revoke access, wipe work data if the device is enrolled, and close the record with a date.
The team gives every contractor record an end date on day one, so access expires on time. That's what turns a one-time cleanup into real IT inventory tracking.
Watch out. Don't delete the record at offboarding. The closed record proves access ended. Auditors like proof. They're less fond of "we're pretty sure."
What you get. Records that update through normal work, plus a quick monthly check to move leftover Seen devices to Attributed.
What IT Can Answer Now That It Couldn't Before
The questionnaire is no longer scary. That's the practical payoff of BYOD asset discovery.
After two weeks, the team's 300 raw entries came down to 187 active personal devices. Of those, 142 were fully Accountable, 31 had a confirmed owner, and 14 were still unconfirmed and blocked from sensitive apps. The answer to the customer was short. In total, 173 personal devices can reach customer data, every one has a named owner, and 14 unconfirmed devices are blocked. It's not a perfect number. It's a defensible one.
The team can now also answer the usual follow-ups, like who owns each device, what IT actually controls, and which devices lose access when someone leaves.
This matters for security, too. Verizon's 2025 Data Breach Investigations Report looked at devices infected with password-stealing malware. Of those that held company logins, 46% weren't managed by IT. Knowing your BYOD devices won't change that number. But it shows you which of those devices could be yours.
How AssetLoom Supports Accountable BYOD Records
Most inventory management software for IT assumes the company bought the device. BYOD breaks that assumption. Identity and MDM tools give you the evidence and the controls. AssetLoom is where the inventory record lives once BYOD asset discovery has done its job.
- See what's on the office network. The free AssetLoom Network Scanner finds devices on your LAN without agents and exports the results as a CSV, ready to import into AssetLoom.
- Bring device data into one place. Import your cleaned device list as a CSV, including scan results and identity-provider exports.
- Track every device through its lifecycle. Each record has a status, so you can see which devices are active and which have been closed.
- Automate onboarding and offboarding. Workflows handle the repetitive steps, so offboarding doesn't depend on someone's memory.
Your MDM controls devices. AssetLoom keeps the inventory record of which devices exist and where they stand. It doesn't replace your MDM or wipe devices. It keeps the record that tells you which devices to act on.
Start With Evidence, End With Records You Can Defend
Personal devices were never missing from your company, only from your IT inventory. Scope by data, clean before you count, be honest about confidence, and let normal work keep records current.
Start with the free Network Scanner to see what's on your office network. Still on spreadsheets? AssetLoom offers free IT inventory management for teams under 250 assets. Accurate records are what make BYOD asset discovery worth the effort.
FAQs
1. What happens to a BYOD record when someone leaves?
Close it with a date and a note on how access was revoked. Don't delete it. The closed record proves that access ended.
2. Should personal devices be part of your ITAM inventory?
Yes, as a separate asset class. Track the owner, access scope, control level, and status. Skip cost and depreciation, since the company doesn't own the hardware.
3. Is it legal to record employees' personal devices?
Recording work access is common, but rules differ by country. Tell employees exactly what you collect and why. This isn't legal advice, so check with your legal team.
4. Why does one phone show up as several devices?
In identity records, resetting a phone or reinstalling a work app can register a new device object. On a network scan, phones often use a randomized MAC address on each Wi-Fi network. Match by user, model, and OS in identity data, and by hostname in scan results.
5. How is BYOD different from CYOD and COPE?
It comes down to ownership. With BYOD, the employee owns the device. With CYOD, employees choose from company-approved devices. With COPE, the company owns the device but allows some personal use.
Top comments (0)