It depends on what that corporate software is. Only a few of them skew towards real-time viewing of behavior. If what you’re referring to just generates a token that you then use to log onto a Vpn on a work device, that token generation is likely really limited in its access. The less like Google Auth, and the more like a custom solution the tool is, the more you have to think about device access you’re giving. I operate under the assumption any work business I do on any device is potentially logged extensively. The tools you want to be aware of installing on personal devices are “MDM” or similar, at a high level. Those get potentially large access.