Two ways to secure a phone
- Device management (enrollment). The company manages the whole device. That's common for company-owned phones. It gives more control, but many employees understandably resist it on their own phone.
- App protection (without enrollment). The company protects only its data inside approved apps. Microsoft Intune supports this for Outlook, Teams, OneDrive and other Microsoft apps, and it's often a better fit for personal phones.
Microsoft 365 Business Premium includes Intune. Check your plan to confirm what's included.
What app protection can do
- Require a PIN or biometric to open work apps
- Block copying and pasting work content into personal apps
- Prevent saving work files to personal storage
- Remove work data from the apps when needed, without wiping the phone
- Require a current app and operating system version
Combined with conditional access, you can also require that work email be read only in the protected Outlook app, not in the phone's built-in mail app.
What it can't do
- It doesn't protect the whole phone from malware or theft.
- It doesn't cover work data people move outside the protected apps by other means, like photographing a screen.
- It doesn't replace MFA. See got a new phone? don't get locked out.
For roles that handle especially sensitive data, a company-owned, fully managed phone may still be the better answer.
A short BYOD policy
Write down, in plain language:
- Which apps are approved for work data
- What the company can and can't see or do on a personal phone
- What happens when a phone is lost, replaced or the person leaves
- Whether the company contributes to phone costs, which is a decision for your leadership and HR
- Who to call when something goes wrong
Clear answers to "Can IT see my photos?" do more for adoption than any technical setting.
FAQ
Can IT see my texts or photos with app protection?
App protection is designed to manage work data inside approved apps, not personal content. Your company's policy should say exactly what's visible.
What if an employee refuses any controls on their phone?
Options include web-only access, a company-provided phone or no mobile access to work data. Decide the rule in advance.
Does this matter for a small office?
Yes. Phones get lost, and a phone with open access to email can expose client information. See when an employee leaves.
Verification sources
- Microsoft Learn, "Mobile Application Management (MAM) for unenrolled devices in Microsoft Intune": https://learn.microsoft.com/en-us/intune/app-management/protection/mam-without-enrollment
Still have a question?
Ask Little Sprout for general information. To set up phone access your team will actually accept, schedule a free 15-minute discovery call.