[closeparen]

In general, you can prevent BYOD with this approach by rolling out client certificates with config management and requiring them at the proxy.

[londons_explore]

And the client certs can be tpm backed so they can't be copy+pasted to other machines.