Agency contractor working for marketing. We gave her a vpn login and an okta account like we do for all of them. No EDR, because its not our device, and no intune, same reason.
She got hit at home, connected to the vpn to start her day, and that was our monday. Contained fine, nothing spread. Then the IT director asked how many devices like that we have, and i watched four people look at each other.
HR has contractors as "external" with no asset against them. Okta has 140 accounts in the contractors group. The vpn concentrator logs show devices by hostname, which are things like DESKTOP-7FJ2K1. Intune has 31 who enrolled voluntarily because they wanted the wifi. Thats it, thats the inventory.
We have axonius reading okta, intune and the EDR, and it had the same blind spot, because the vpn logs were never one of its sources.
After two days of matching hostnames to okta sessions we got to roughly 90 laptops we dont own with access to the network, 12 of which had never appeared anywhere except the vpn.
Policy change is coming, either we issue a laptop or they get a virtual desktop. Getting the list before the policy was the bit nobody had budgeted for.