In most small businesses, the team reads work email on their own phones. It’s convenient, and it’s also where company data is least protected: phones get lost, lent, sold on, and someone leaving the business walks out with their work inbox in their pocket.
Managing the whole phone is the wrong answer. Nobody wants their employer able to wipe their family photos. The right approach protects the work apps, and only those.
What the business controls
The Microsoft 365 apps on the phone (Outlook, Teams, OneDrive, Word, Excel) become a protected workspace. They can ask for a PIN or fingerprint when opened, separate from the phone’s own lock. A company document can be stopped from being copied into a personal app, saved to the photo library or sent from a personal account. And access can be refused if the phone is too old to receive security updates.
These apps can also be made mandatory: company email then opens only in protected Outlook, not in the phone’s built-in mail app, where none of these rules apply.
What stays private
Everything else. The business can’t see photos, texts, browsing history, installed apps or the phone’s location. It can’t wipe or lock the whole phone. Saying so plainly to the team when this is rolled out heads off most of the reluctance.
When a phone is lost, or someone leaves
Company data in the work apps is wiped remotely. Email, files and Teams chats disappear from the phone; photos, personal contacts and the rest are left alone. When someone leaves, this is part of the procedure, alongside blocking their account (see When someone joins or leaves: what happens to their access and files?).
What about company phones?
A phone the business provides calls for full management: enrolled, kept up to date, lockable and fully wipeable if lost. It’s the same thinking as for laptops, set out in managed devices.
What it takes to set up
This protection is part of Microsoft 365 Business Premium and is configured once for the whole team. It’s included in the Cloud offer, precisely for teams who work on their own phones. If the business provides the phones, the 360 offer manages them fully, alongside the laptops.
