Use Cases
Consider a construction company with 200 employees and a rotating group of contractors, consultants, and project specialists.
Many of these external users need temporary access to cloud applications, but issuing a company-managed computer for every engagement may not be practical. Allowing unrestricted access from personal devices creates a different problem: the organization has limited control over the device and how company information is handled after login.
With HENNGE Identity and HENNGE Secure Browser, the company creates a dedicated access policy for contractors that verifies the user, approves the device, and controls the browser session.
Contractors work from their own computers while access stays limited to the applications and actions required for their role.
The Challenge: A Successful Login Is Only Part of the Problem
The company provides contractors with access to project management tools, shared files, and other cloud applications.
Because their personal computers are not managed like employee laptops, several questions remain after a successful login:
Is this the contractor’s approved computer?
Has the user completed strong authentication?
Which applications should they be able to access?
Can files be downloaded or copied onto the device?
What happens to company data during and after the session?
Passwords and MFA help verify the user, but they do not control how information is handled once access is granted.
The company needs protection around both the login and the session.
Creating a Dedicated Contractor Policy
Using HENNGE Identity, contractors are placed under a separate access policy.
Unlike employees signing in under trusted conditions, contractors always complete OTP authentication, regardless of network location.
Each contractor also receives a personal device certificate for the specific computer approved for the engagement. If the certificate is missing or invalid, access is denied.
Together, these controls verify both the user and the device before company applications become available.
Controlling the Session with HENNGE Secure Browser
Device approval determines which computer can connect, but it does not control what happens after the contractor signs in.
HENNGE Secure Browser creates a controlled workspace on the personal device. Within that session, the company can restrict actions such as:
Downloading files
Copying and pasting information
Taking screen captures
Accessing applications outside the approved list
Retaining corporate session data on the device
The contractor can use the applications needed for the engagement without receiving unrestricted access to the wider environment.
The device certificate answers, “Is this the approved computer?”
Secure Browser answers, “What can happen during the session?”
Trusting the Access Path, Not the Entire Device
The company does not need to fully manage every contractor computer.
Instead, it applies controls to the path used to reach company resources.
Before access is granted, the contractor must:
Complete OTP authentication
Use the approved personal device
Present a valid device certificate
Open applications through Secure Browser
Remain within the permitted application and session controls
The personal computer itself is never declared secure. Trust covers a verified user, an approved device, and a controlled session, nothing more.
The Outcome: Flexible Access with Defined Boundaries
This approach helps the construction company:
Require MFA for every contractor login
Verify the specific personal device being used
Limit access to approved cloud applications
Reduce the risk of files being downloaded or copied locally
Support BYOD without granting unrestricted device trust
Avoid issuing company computers when the engagement does not require one
Contractors can work from their own devices while the organization maintains clear boundaries around its applications and information.
The result: controlled access from a verified personal computer, with boundaries the company sets.
What This Means for MSPs
Many MSP clients rely on contractors, consultants, seasonal staff, and project-based workers.
This is common in construction, professional services, nonprofits, retail, and other industries where access needs change from one engagement to the next.
Clients may not want to purchase, configure, and recover a company device for every temporary user. Basic MFA addresses only part of the problem because it does not determine which personal device may connect or control what happens to company data after login.
With HENNGE Identity and HENNGE Secure Browser, MSPs can help clients:
Apply dedicated access policies to external users
Require MFA on every contractor login
Approve specific personal devices
Restrict access to selected applications
Control downloads, copy and paste, and screen capture
Offer secure contractor access without extending full trust to the device
This gives MSPs a practical identity and access service for clients that need contractor flexibility but are not ready to manage every personal endpoint.
Learn More About HENNGE
HENNGE helps IT teams and MSPs manage identity and control access across Microsoft 365, Google Workspace, and hundreds of other cloud services.
With HENNGE Identity and HENNGE Secure Browser, organizations can verify users and devices, apply Conditional Access policies, and create protected sessions for access from personal computers.
To learn how HENNGE could support contractor access in your organization or client environments, contact our team or request a demo.
Interested in offering HENNGE Identity through your managed security services? Learn more about becoming a HENNGE partner.
This article presents an illustrative scenario based on a real HENNGE Identity configuration. The company, industry, workforce details, and use case are provided as examples to demonstrate how the controls may be applied. They do not represent a named customer deployment or verified customer results.
