MDM versus MAM: MDM (Mobile Device Management) manages the whole device and fits corporate-owned hardware; MAM (Mobile Application Management) manages only the company's apps and data, and is the natural fit for BYOD. Intune app protection policies, Android Enterprise work profiles and Apple User Enrollment implement that separation.
What is BYOD?
BYOD (Bring Your Own Device) is the model in which employees use their personal devices —phones, tablets, laptops— to access corporate resources: email, SaaS applications, documents, VPN. It cuts hardware costs and friction for the user, but it brings into the perimeter endpoints the company neither bought nor fully controls: unpatched systems, apps of dubious origin sitting next to the CRM, and customer data on a device the employee's children also play with. Governing it well is not about banning it —it already happens de facto in almost every organisation— but about managing it with data separation, minimum posture requirements and a policy the workforce knows and has signed.
Why does it matter?
Because ungoverned BYOD is the cheapest route to corporate data. A personal phone with company email configured and no PIN stolen on the metro, a home laptop with malware syncing SharePoint, a Microsoft 365 session left open on the family computer: none of those scenarios requires a sophisticated attacker. Phishing also converts better on small screens, far from the network perimeter the company monitors. The modern technical answer is not to block the device but to condition access on its posture: with conditional access control, only devices meeting requirements (encryption, biometrics, supported OS version, no jailbreak) reach the data, and corporate data lives in a managed container the company can wipe without touching anything personal. There is also an unavoidable legal layer: under GDPR — and in Spain the AEPD's criteria — the employer must be proportionate, inform employees beforehand and restrict its control to the corporate side of the device; a wipe or monitoring that reaches into personal content exposes the company to fines and renders evidence unusable.
Key points
Data separation as the governing principle: corporate data lives in an encrypted container (work profile, managed apps) with policies blocking copy-paste into personal apps, saving to local storage or forwarding through WhatsApp. That boundary is also where DLP policies apply.
Conditional access as the gate: identity alone is no longer enough; device posture becomes another signal. Rules such as "email only from managed apps", "no Intune registration, no SharePoint" or "block if the OS is out of support" are Zero Trust translated into BYOD practice.
Selective remote wipe: when the device is lost or the employee leaves, the corporate container —accounts, managed apps, data— is removed without touching photos, chats or personal files. Full device wipe is reserved for company-owned hardware.
Enforceable minimum posture: encryption on, biometric lock or strong PIN, supported OS version, no root/jailbreak and MFA on access. Whoever does not comply does not get in — no seniority-based exceptions, which is where incidents usually start.
A written, communicated and signed BYOD policy: what the company can and cannot see, what happens on departure, who supports the device, what gets wiped and how. Without that document, every incident becomes a labour dispute on top of a technical one.
Example: the same lost phone, with and without BYOD governance
An 80-person consultancy allows company email on personal phones "because it has always been that way". A manager loses his on a Friday: no mandatory PIN, the native mail client configured, OneDrive syncing. Nobody can wipe anything remotely because the device is not enrolled anywhere. By Monday the firm must assume proposals, client data and cached credentials are in a stranger's hands: a security breach notification to the data protection authority, disclosure to affected clients and a week of credential rotation.
The same loss under BYOD governance is a formality: email only works inside managed Outlook with an app protection policy, protected by biometrics and encryption; conditional access requires a registered device and kills the session the moment the loss is reported; and the administrator triggers a selective wipe that removes the corporate container in minutes, leaving the family photos untouched. There is no exposed data to notify, and the employee replaces the phone without the incident escalating beyond a ticket.
Common mistakes
- Running de facto BYOD with no policy: corporate email reachable from any client with username and password, and no inventory of which devices touch the data. That is the real state of many organisations that claim they 'do not allow' BYOD.
- Forcing full MDM onto personal devices: technically possible, legally slippery and socially explosive. Staff perceive it as surveillance, workarounds appear (forwarding to Gmail) and the outcome is less control, not more. For BYOD, MAM is almost always enough.
- Not enforcing minimum posture: accepting unencrypted, out-of-support or rooted devices because 'it is the director's phone'. Boardroom exceptions are the ones that end up in forensic reports.
- Forgetting offboarding: former employees keeping company email and Teams on their personal phones for months because nobody ran the selective wipe on departure. Revocation must be a mandatory step of the leaver process, not a favour someone remembers to ask for.
- Ignoring the privacy dimension: wiping an employee's entire personal device, or monitoring their location and personal apps, invites regulatory fines and turns any evidence into waste paper in court. Proportionality is not optional under GDPR.
Related terms
Related services
This concept may be related to services such as:
Frequently asked questions
My employees already read company email on their personal phones — what is the minimum I should require?
Four controls you can roll out in weeks: email only through managed apps (Outlook with an app protection policy, not the native client), mandatory MFA, posture requirements in conditional access (encryption, PIN or biometrics, supported OS, no jailbreak) and a selective wipe capability that has been tested, not merely configured. With Microsoft 365 Business Premium all of this is included in a licence many SMBs already pay for; it is usually a matter of configuring it properly, not buying anything new. The fifth element is not technical: a two-page BYOD policy the workforce signs.
Can I remotely wipe the personal phone of an employee who is leaving the company?
You can — and should — wipe the corporate container: accounts, managed apps and their data. What you should not do is a full wipe of a personal device, except with express consent and even then carefully: destroying an employee's photos and private data is disproportionate under GDPR and invites claims. This is why architecture matters: if corporate data lives in a work profile or in MAM-protected apps, a selective wipe resolves offboarding in minutes and without conflict. Make it a mandatory step of the leaver process, alongside session and credential revocation.
MDM or MAM for BYOD? I do not want staff to feel we are spying on them.
For personal devices, MAM except in edge cases. With app protection policies the company manages only its own applications: it can require a PIN to open them, encrypt their data, block copy-paste into personal apps and wipe them remotely — but it cannot see browsing history, location, or the user's apps and photos. Communicating that boundary explicitly —what we see and what we do not— defuses most of the pushback. Full MDM is for company-owned hardware or genuinely high-risk profiles (access to specially protected data), ideally as COPE with a separated profile.
We are an SMB on Microsoft 365 — how do we build secure BYOD without buying more tools?
With what you probably already license. Intune for app protection policies (MAM without enrolling the device), Entra ID conditional access to require MFA and minimum posture, encryption of corporate data inside managed apps, and selective wipe from the same console. The sensible order: inventory which devices access data today, publish the policy, pilot the policies with one group, then block access from unmanaged clients. An external review of your Microsoft 365 security configuration typically uncovers the usual gaps in hours: legacy auth still enabled, forgotten exceptions and conditional access rules that do not cover every app.