ADFS Authentication for BYOD for SWG

• When ADFS authentication is enabled, are BYOD devices expected to experience browsing or authentication issues?

It depends if you are using SSL decryption or not. If you are decrypting SSL traffic through the tunnel your BYOD devices will not be able to browse HTTPS sites without SSL errors.

• How does Netskope handle user identification and authentication for non-domain-joined devices in this setup?

Netskope does not care at all if your devices are AD joined when steering via an IPSEC/GRE tunnel. Authentication is done via SAML for both (unless bypassed) and uses IP or cookie caching (if you have enabled it).

• Are there recommended best practices for handling BYOD traffic when using ADFS with a firewall-based forwarding architecture?

I don’t know of anything specific to ADFS, but:

 Both corporate-managed devices and BYOD devices (phones and personal laptops) are connected to the same LAN and their traffic is forwarded to Netskope through the tunnel.

You should really not have managed and unmanaged devices on the same network. One reason being the above SSL decryption issues. Decrypt the traffic from managed devices and do not decrypt BYOD traffic.