Protecting work data on staff's personal phones without managing the phone

The problem with personal phones

In most small offices, staff read work email and Teams messages on their own phones. That is convenient and often unavoidable, but it means client emails, attachments and files sit on devices the business does not own or control. If the phone is lost, sold or used by a family member, or if the person leaves, the business has no way to remove its data.

Full device enrolment solves that for company-owned phones, but staff are understandably reluctant to hand control of their personal phone to their employer. They worry, reasonably, about privacy and about the business being able to wipe their photos. App protection policies offer a middle path that protects business data while leaving the rest of the phone alone.

How app protection works

Instead of managing the phone, app protection manages the work account inside specific Microsoft apps. When someone signs in to Outlook, Teams, OneDrive, Word or Excel with their work account, the policy applies to that account's data inside those apps. Personal accounts in the same apps are unaffected, and nothing else on the phone is touched or visible to the business.

Common settings include requiring a PIN or fingerprint to open work data, blocking copy and paste from work apps into personal apps, stopping work attachments being saved to personal cloud storage or the photo library, and requiring a minimum app version and operating system. Staff install the Microsoft apps from the normal app store and the policy applies when they sign in.

Wiping only company data

When someone leaves or loses their phone, an administrator can issue a selective wipe. The next time the work apps connect, they remove the company account and its data, such as cached email and downloaded files, and leave everything personal in place. The person's photos, messages and personal email are never affected.

Policies can also wipe work data automatically if the apps have not connected for a set number of days, which covers phones that disappear without anyone reporting them. Combined with blocking sign-in on the account when someone leaves, this closes off a gap that most small businesses currently have no answer for.

Forcing staff to use protected apps

App protection only works if work data stays inside the protected apps. If someone sets up their work email in the phone's built-in mail app, the policy cannot apply. Conditional Access can require approved apps or app protection policies before allowing access to email and files on mobile, which pushes everyone towards Outlook and the other supported apps.

Announce the change before turning it on, with simple steps for setting up Outlook and removing the work account from the built-in mail app. Expect some people to need help on the day. Once it is in place, the business has consistent protection across every phone that touches company data, without owning or managing those phones. New starters simply follow the same steps on their first day, which keeps the setup consistent as the team grows.

What it cannot do

App protection does not stop someone photographing their screen with another device, and some settings to block screenshots depend on the phone's platform. It does not protect data in third-party apps that do not support Intune, such as some accounting or CRM apps, so check how those apps handle security separately and whether they offer their own controls.

It also does not replace good sign-in security. Multi-factor sign-in, sensible password rules and a culture where staff report a lost phone straight away all still matter. App protection reduces the damage a lost phone can do; it does not make careless handling of client information acceptable. Staff still need to think before forwarding a sensitive email or opening an attachment on a shared family tablet.

Write it into your policy

Set out the arrangement in a short bring-your-own-device policy: which apps staff must use for work data, what the business can and cannot see, what happens when they leave and what they should do if the phone is lost. Being clear that the business cannot see personal photos or messages makes staff far more comfortable.

Under the Privacy Act 2020, client information on staff phones is still the business's responsibility. A documented policy and app protection together show you have taken reasonable steps to keep it secure, which matters to clients, insurers and anyone investigating a breach. Review the policy each year as apps and phone features change.