BYOD: how to let staff use their own phones for work safely

Why BYOD is the norm in small offices

In most New Zealand small businesses, staff already use their own phones for work. They check email on the bus, answer Teams messages after hours and photograph receipts for expense claims. Buying everyone a company phone is expensive, and many people do not want to carry two devices. So the real question is not whether to allow BYOD but how to control what company data ends up on personal devices.

Left unmanaged, that data spreads quickly. Attachments are saved to personal photo libraries, documents are forwarded to personal Gmail so they can be opened in a preferred app, and when someone leaves, their phone still holds months of client correspondence. None of that is malicious; it is simply what happens without guardrails. The business then has no way to remove that data, no record of where it went and, if a phone is lost or hacked, no clear answer about whose information was exposed.

App protection without full device control

Microsoft Intune offers app protection policies, sometimes called mobile application management. Instead of enrolling the whole phone, the policy applies to Microsoft apps such as Outlook, Teams, OneDrive, Word and Excel. Inside those apps, company data can be required to sit behind a PIN or face unlock, blocked from being copied into personal apps, prevented from being saved to the phone's photo library, and wiped remotely without touching anything else.

Combined with conditional access, you can require that work email is only accessed through the protected Outlook app rather than the phone's built-in mail app. Staff keep full control of their phone; the business keeps control of its data. Check current Microsoft 365 licensing, because Intune is included in some business plans and not others.

Work profiles and user enrolment

For staff who need more than email and Office apps, both major platforms offer a middle path. Android Enterprise work profile creates a separate, badged container on the phone for work apps, which the business can manage and remove. Apple's User Enrolment does something similar on iPhones, separating managed apps and data from personal content. In both cases, the business cannot see personal apps, photos, messages or browsing, and cannot wipe the whole phone. That reassurance matters: staff are far more willing to install a management profile when they understand exactly what it can and cannot do.

Security basics every phone should meet

Whatever approach you choose, set some minimum requirements. The phone should have a screen lock, run a supported operating system version that still gets security updates, and not be jailbroken or rooted. Conditional access can check these conditions and refuse access to work data until they are met, which is fairer and more consistent than relying on people to remember. Multi-factor sign-in for Microsoft 365 is usually handled through an authenticator app on the same phone. That makes the phone itself important: if it is lost, staff should tell IT quickly so the authenticator can be re-registered and work data wiped.

A short BYOD agreement

Write down the rules in plain language and ask staff to agree before connecting a personal device. Cover what the business can and cannot see, what happens to work data if the phone is lost or the person leaves, the minimum security settings, and whether any phone costs are reimbursed. Be specific that the business will wipe only work apps and data, never the whole device, unless the person asks.

Keep it to a page. Long legal documents go unread, and the point is that people understand the deal. Revisit it when your tools change, for example if you move from app protection to work profiles. Mention too that staff should tell IT before trading in, selling or replacing a phone, so work data can be removed and the authenticator moved across.

When company phones make more sense

BYOD is not right for every role. People who handle very sensitive information, such as health records or legal files, or who need specialist apps, may be better on company-owned phones that are fully managed. The same goes for shared devices, such as a warehouse scanner or a reception tablet. Company devices can be enrolled automatically through Apple Business Manager or Android zero-touch and wiped completely when they change hands. Many offices end up with a mix: company phones for a few roles and BYOD with app protection for everyone else. The important part is that every device touching company data falls under one of those two arrangements, rather than a third category of phones nobody knows about.