BYOD devices: Protect company data without the Safetica Client

Product plans: Standard | Premium | Enterprise | On-Prem (see: Limits by plan)

Product differences:

In-cloud content analysis is not available in Safetica On-Prem and Safetica Platform Standard.
Coming in Q3: The In-cloud content analysis package can be purchased as an add-on for all plans.

Introduction: How can you protect data on BYOD devices?

A BYOD (bring your own device) device is any device without the Safetica Client: a personal laptop, a home computer, or a mobile phone that still accesses your company data in Microsoft 365 or Google Workspace.

Since you cannot install the Safetica Client on devices you do not manage, Safetica protects the data itself instead of the device. The protection runs in Safetica Cloud Protection, at the level of your connected Microsoft 365 tenant or Google Workspace organization. It therefore applies to any device where users sign in with their company accounts, including BYOD devices. You activate the individual protection layers in the Safetica console under Integrations:

Exchange protection: Audits all outbound emails sent through Exchange Online from any device, including mobile phones and tablets.
Outlook protection: Notifies users about or blocks policy-violating emails before they are sent from Outlook on the web, Outlook for Windows, or Outlook for Mac.
SharePoint protection: Audits file activity in SharePoint, OneDrive for Business, and Teams and cancels file sharing that violates your policies.
Google Drive protection: Audits file sharing in Google Drive.
In-cloud content analysis: Analyzes email attachments, bodies, subjects, and shared files for sensitive content directly in the cloud, so content analysis works even on devices without the Safetica Client.

✍️ Without In-cloud content analysis, Safetica evaluates emails and files from BYOD devices based on existing classification only (classification identifiers added by third-party tools such as Microsoft MIP, Boldon James, or Tukan GREENmod).

Prerequisites

Connect your Microsoft 365 tenant to Safetica. Learn more here
Activate Exchange protection, Outlook protection, and SharePoint protection.
To cover Google Workspace, connect your Google Workspace organization and activate Google Drive protection. Learn more here
To analyze email and file content from BYOD devices for sensitive data, use In-cloud content analysis. Learn more here

Emails sent from BYOD devices

Two layers protect company email communication in Microsoft 365 on devices without the Safetica Client:

Exchange protection gives you visibility into all outbound email communication:

Audits every email (with or without attachments) sent through Exchange Online, regardless of the device or email app. This includes mobile phones and tablets.
Evaluates attachments based on existing classification.
With In-cloud content analysis: Analyzes email attachments, body, and subject for sensitive content.
Supports only auditing (the Log action). It cannot block emails or notify users.

Outlook protection adds active protection through the Safetica Outlook add-in:

Applies your Email policies before the email is sent: Log, Notify, Block (with override), and Block.
Verifies recipients against safe and untrusted destinations.
Evaluates attachments based on existing classification. With In-cloud content analysis: Analyzes and controls attachments, body, and subject based on sensitive content.
Works in Outlook on the web, Outlook for Windows (version 2206, build 15330.20196, or newer), and Outlook for Mac (version 16.65.827.0 and newer).

The add-in runs in Microsoft 365 and evaluates policies directly in Safetica Cloud Protection, so it works without the Safetica Client. With Block (with override), users can override the block after providing a justification.

❗Outlook Classic on a BYOD device is only audited through Exchange protection. Blocking emails in Outlook Classic requires the Safetica Client.

Files shared from BYOD devices: SharePoint, OneDrive, and Teams

SharePoint protection controls the sharing of Microsoft 365 files no matter which device the sharing happens from. Safetica will:

Based on auditing policies:
- Audit file sharing, downloads, and uploads in SharePoint, OneDrive for Business, and Teams.

Based on data policies with the Sharing from M365 cloud storage destination type:
- Cancel the sharing of files and folders that violates a blocking policy. The user receives an email notification about the cancelation. Processing may take up to 5 minutes.
- Let users override a cancelation caused by a Block (with override) policy. The notification email contains an override form where the user provides a reason and can then share the file again.
- Email users a warning when their sharing violates a Notify policy. The sharing stays active.
- Evaluate shared files based on existing classification. With In-cloud content analysis: Analyze shared files for sensitive content.

Admins can also cancel any recorded sharing manually with the Cancel this sharing button in the operation detail in Data.

❗ File uploads and downloads to Microsoft 365 from BYOD devices are only audited. Blocking uploads requires a device with the Safetica Client.

Example: You have a blocking policy for M365 file sharing and use In-cloud content analysis. A user shares a file from their personal laptop via SharePoint, and the file contains keywords that match one of your data classifications. Even though the file was shared from a device without the Safetica Client, In-cloud content analysis detects the sensitive content, the sharing is automatically canceled, and the user receives an email notification.

Files shared from BYOD devices: Google Drive

Google Drive protection audits file sharing and uploads in Google Workspace:

Records every sharing and upload operation in the Data section of the Safetica console.
Classifies shared files by existing classification.
- With In-cloud content analysis also by sensitive content, filename, and filetype.

Recognizes safe and untrusted destinations.

Google Drive protection has these limitations:

All sharing operations are audited (logged) only. The Block, Block (with override), and Notify actions do not apply to Google Drive sharing at this time.
File downloads from Google Drive are not audited at this time.
Google Labels are not supported as existing classification.
Gmail is not covered. Safetica protection for Google Workspace applies to Google Drive only.

Mobile phones and tablets

Mobile devices are BYOD devices from Safetica's perspective, with one additional limitation:

Outgoing company emails sent from any mobile email app through Exchange Online are audited by Exchange protection. With In-cloud content analysis, attachments, body, and subject are analyzed for sensitive content.
Emails cannot be blocked on mobile devices. The Outlook add-in is not supported in Outlook mobile apps (a Microsoft platform limitation), so Outlook protection does not apply there.
File sharing from Microsoft 365 or Google Drive works the same as from any other BYOD device: SharePoint protection can cancel violating shares, and Google Drive protection audits them.

In-cloud content analysis: Content analysis without the Safetica Client

Without the Safetica Client on the device, Safetica cannot analyze file content locally. In-cloud content analysis closes this gap: it analyzes email attachments, bodies, and subjects (in Exchange protection and Outlook protection) and files shared via Microsoft 365 or Google Drive for sensitive content, regardless of whether the file ever touched a device with the Safetica Client.

In-cloud content analysis has these limits:

Each email body and each attachment or shared file counts as a separate analysis toward your plan's monthly limit. Files beyond the limit are not analyzed for sensitive content; Safetica still performs a partial analysis (existing classification and metadata) and records the operation with the status Not analyzed: Plan or operation limit.
Files larger than 100 MB are not analyzed and are marked Not analyzed: File was too large.
Image-only files are not analyzed for content (no OCR).
The analysis triggers when an email is sent or a file is shared. It does not trigger when a file is edited, uploaded, or downloaded in the cloud.
When a user shares a whole folder, up to 10 files from the folder are analyzed.

Where to see BYOD activity records

All records from Safetica Cloud Protection appear in the Data operations section of the Safetica console:

To see Microsoft 365 records, set the Application filter to Exchange Online, SharePoint Online, or Microsoft Teams.
To see sharing operations, use the Operation filter (for example Shared via M365 to external recipients or Shared via GDrive to external recipients).
To see upload and download operations, filter or group records by Operation. To narrow them to one service, combine the Operation and Application filters (for example uploads to SharePoint Online only).
Records from In-cloud content analysis show whether the content analysis finished successfully and its result.

Security and privacy

Exchange protection receives a copy of each sent email as a hidden (BCC) recipient in Exchange Online. The hidden recipient is never visible to the email sender.
Emails and attachments are processed in Safetica Cloud Protection and deleted immediately after processing (within seconds, 7 days at maximum).
In-cloud content analysis downloads each analyzed attachment or file into a container in Safetica's Azure environment dedicated to your Microsoft 365 tenant. After the analysis, the file is immediately deleted. Safetica does not retain a copy of the file.
Records are kept only until Safetica syncs them to your database (every 5 minutes for cloud, more often on-premises).

Complement Safetica with Microsoft tools

Some of the BYOD limitations described in this article can be closed with Microsoft Intune (a valid Intune license is required):

To prevent users from copying data out of company Microsoft 365 apps or saving files from them to their mobile devices, use Intune App protection policies. They work even on unmanaged BYOD devices. Learn more here
To ensure users can add their company Microsoft 365 account only to approved email clients, combine Intune App protection policies with Entra Conditional access policies. Learn more here
To block users from adding personal or non-Microsoft accounts to company Outlook, use Intune App protection policies (on mobile devices) or Intune Configuration policies (on desktops managed by MDM). Learn more here

FAQ

Q: Can Safetica block emails sent from a mobile phone or tablet?

A: No. On mobile devices, Safetica can only audit outgoing emails sent through Exchange Online (Exchange protection must be active). The Outlook add-in, which enforces blocking, is not supported in Outlook mobile apps.

Q: Can Safetica cancel file sharing from a mobile phone or tablet?

A: Yes. SharePoint protection processes sharing operations directly in the cloud and works with the files on SharePoint itself, so it does not matter which device the sharing came from. Safetica can cancel violating M365 shares from any device, including mobile phones and tablets.

Q: Can Safetica block file uploads from a BYOD device?

A: No. Uploads to Microsoft 365 and Google Drive from devices without the Safetica Client are only audited. Safetica can, however, cancel M365 file sharing that violates your policies.

Q: Does Safetica audit file uploads and downloads from BYOD devices?

In Microsoft 365: yes. Uploads and downloads are processed in the cloud, so SharePoint protection audits them from any device, even without the Safetica Client (e.g., upload a file from mobile phone to company SharePoint). Only the Log action is available for these operations; blocking uploads requires a device with the Safetica Client.

In Google Drive: only uploads are audited on BYOD devices. Downloads from Google Drive are not recorded at this time.

Q: Are personal (non-M365) email accounts on BYOD devices protected?

A: No. On BYOD devices, Safetica protects only accounts in your connected Microsoft 365 tenant. Protecting non-M365 accounts (for example a Gmail account added to Outlook, or clients using SMTP, POP3, and IMAP) requires a Windows device with the Safetica Client.

Alternatively, you can block the adding of non-Microsoft accounts to company Outlook altogether with Microsoft Intune. Learn more here