When devices are unmanaged (BYOD) and the organization cannot install the Netskope Client, the Reverse Proxy deployment model is the appropriate steering mechanism for cloud-based SaaS applications such as Microsoft 365. Reverse Proxy works by redirecting authentication traffic through Netskope via SAML integration, so even unmanaged devices accessing corporate SaaS applications are subject to Netskope’s Real-time Protection policies. This approach does not require any software installation on the device and works regardless of the user’s physical location. IPsec and GRE tunnels are suitable for on-premises network-level steering. Explicit Proxy requires client-side configuration. Secure Forwarder with DPoP is used for server-side traffic and on-premises deployments, not BYOD user scenarios.