Which apps staff need
Most staff need four apps. Outlook for email and calendar, Teams for chat, calls and meetings, OneDrive for files, and Microsoft Authenticator for sign-in approvals. Depending on role, add the Office app or individual Word, Excel and PowerPoint apps for editing documents, SharePoint for browsing team sites, and Planner or To Do for tasks. Install only what the person will use, because every app adds notifications.
Set up the apps with the person rather than sending instructions by email. Fifteen minutes together on day one, signing in, adding the shared mailboxes they need and checking notifications, avoids weeks of half-working setups and the quiet frustration of staff who never got Teams calls on their phone. Use the Outlook app rather than the phone's built-in Mail app. The built-in apps on iPhone and Android can connect to Microsoft 365, but they support fewer security features, handle shared mailboxes and calendars less well and cannot be protected with Microsoft's app protection policies. Many businesses block built-in mail apps for that reason.
Signing in and the Authenticator app
Set up Authenticator first, because the other apps will ask for approval when signing in. Once Authenticator is registered for the work account, signing into Outlook, Teams and OneDrive becomes approving a prompt with a number match. Show staff how to recognise legitimate prompts and to deny any approval request they did not trigger themselves, which is a common sign someone else has their password. When a person changes phones, Authenticator needs to be moved or re-registered. Plan this before the old phone is wiped or traded in. A staff member who arrives with a new phone and the old one already reset may be locked out until an administrator resets their sign-in methods.
Work phones versus personal phones
For company-owned phones, device management enrolment lets the business set a passcode requirement, push the right apps, configure Wi-Fi and wipe the phone if it is lost. Staff should know the phone is a business device and that the business can see its basic configuration and remove it from service.
For personal phones, many staff do not want their employer managing the whole device, and that is reasonable. App protection policies, available with Business Premium and some other plans, protect work data inside the Microsoft apps only: requiring a PIN to open Outlook, blocking copy and paste from work email into personal apps, and allowing the business to remove work data without touching photos, messages or personal apps. Agree a simple written policy so staff know what the business can and cannot see.
Notifications and work-life boundaries
Phones can bring the office into every evening. Help staff set Outlook and Teams quiet hours so notifications stop outside their working hours, and use the phone's own focus or do not disturb modes. Encourage people to turn off notifications for email they do not need to see immediately, and keep them for direct Teams messages and calls. Managers set the tone. If the business owner sends messages at 10pm, staff assume they must reply. Scheduling messages to send in the morning, which Outlook and Teams both support, avoids that pressure without changing anyone's working habits too much.
Files on phones
OneDrive and Teams let staff open and share documents from their phones, which is helpful on site or between meetings. Encourage sharing links rather than downloading copies to the phone, so the file stays in one place with the right permissions. Photos taken on site can be uploaded straight into the right SharePoint or Teams folder rather than sitting in the personal camera roll. The document scanning feature in the OneDrive and Office apps turns paper into PDF on the spot, useful for signed delivery dockets, receipts and whiteboard notes. Scans saved straight into a shared folder can be filed or processed back at the office without anyone emailing photos to themselves.
When a phone is lost or someone leaves
If a phone is lost or stolen, report it straight away. For company phones under device management, an administrator can lock or wipe it. For personal phones with app protection, the business can remove work data from the Microsoft apps. In either case, signing the person out of all sessions and resetting their password closes off access from the missing device.
When someone leaves, remove work data from their personal phone as part of offboarding, and collect company phones with their passcode and any activation lock removed. Phones returned still locked to a personal Apple or Google account cannot be reused until that account is removed, so do it on the last day while the person is still there.
In short
- Use the Outlook app, not the phone's built-in mail app.
- Set up Authenticator first and plan for phone changes.
- Use device management for company phones and app protection for personal phones.
- Set quiet hours and remove work data from phones when staff leave.