Your staff read work email on their phones, join Teams calls from tablets and open company files on whatever device is to hand. Some of those devices belong to the business. Many belong to the employee. Every one of them that can open business email is part of your security boundary.
Microsoft Intune offers two ways to protect company data on those devices: mobile device management (MDM) and mobile application management (MAM). They solve different problems, and choosing the right one for each type of device is the key to a BYOD (bring your own device) policy that is secure without feeling intrusive.
What MDM does
With MDM, the device is enrolled in Intune and the organisation manages it. IT can require encryption and a passcode, enforce operating system updates, deploy approved apps, configure Wi-Fi and email, check compliance and, if a device is lost or stolen, wipe it.
That level of control is right for devices the company owns. It is usually too much for a personal phone, because the employee does not want their employer to have that kind of reach over their own device.
What MAM does
With MAM, protection is applied to the apps, not the whole device. Intune app protection policies apply to managed apps such as Outlook, Teams, OneDrive and Word. They can:
- require a PIN or biometric unlock to open work apps;
- stop copying and pasting company data into personal apps;
- block saving work files to personal storage;
- encrypt company data inside the app;
- remove company data with a selective wipe, leaving personal photos, messages and apps untouched.
App protection can work without enrolling the device, which is why it suits personal phones so well. The organisation protects its data; the employee keeps control of their device.
MDM vs MAM at a glance
| MDM | MAM | |
|---|---|---|
| What is managed | The whole device | Company data inside work apps |
| Device enrolment | Required | Not required |
| Typical devices | Company-owned | Personal (BYOD) |
| Wipe | Whole device or company data | Company data only |
| Settings and updates | Enforced by IT | Left to the user |
| Employee privacy | Lower on personal devices | Higher |
Match the approach to who owns the device
Company-owned phones, tablets and laptops
Use full MDM. Automated enrolment through Apple Business Manager, and Android Enterprise options for corporate-owned devices, mean devices arrive configured and secured, and IT keeps control throughout the device’s life.
Personal devices (BYOD)
Start with app protection policies, which may be all you need for email and Teams. Where you need more, both main platforms offer a middle ground. On Android, a work profile keeps company apps and data in a separate space that IT manages, while personal apps and data stay outside its reach. On iPhone and iPad, Apple’s User Enrollment similarly secures only the work side of a personal device.
Shared, kiosk and frontline devices
Devices used by several people, such as warehouse scanners, reception tablets or shift workers’ phones, can be locked to specific apps and configured for shared use.
Conditional Access ties it together
MDM and MAM decide how devices and apps are protected. Microsoft Entra Conditional Access decides who gets in. It lets you set rules such as “only allow company email on devices that meet our compliance policy” or “only through apps protected by an app protection policy”. Without it, a user could simply open email in an unprotected app and bypass your controls.
Licensing matters here. Microsoft 365 Business Premium includes Intune and Microsoft Entra ID P1, which provides Conditional Access, so many small and medium businesses already own these tools without having switched them on. Owning the licence is not the same as being protected: the policies still have to be designed and configured.
Be open with staff about privacy
BYOD works best when people know exactly what the company can and cannot see. With app protection or a work profile, IT manages company data and work apps; it does not see personal photos, personal messages or what you do in personal apps. Put this in writing in your BYOD policy, explain it during rollout, and staff are far more likely to enrol willingly.
A rollout that avoids disruption
- Discover: list the devices in use, who owns them and what data they access.
- Design: decide the approach for each ownership model and write the policies.
- Pilot: test with a small group, including someone from each type of device and role.
- Deploy: roll out in stages, with clear guidance for users.
- Manage: review policies, monitor compliance and support users as devices change.
When someone leaves or loses a phone
Device management pays for itself in these moments. For a company device, you can lock or wipe it. For a personal device, a selective wipe removes company data from work apps the next time they check in, while personal content stays. Combine that with revoking the user’s sessions and account access, and work data stops leaving with people.
Frequently asked questions
Can we protect email on personal phones without managing the phone?
Yes. App protection policies secure company data inside apps such as Outlook and Teams without enrolling the device, and Conditional Access can require those protected apps.
Will IT be able to see my personal photos or messages?
Not under app protection or a work profile. IT manages work apps and company data only. Being clear about this is an important part of any BYOD policy.
Do we need extra licences for Intune?
Possibly not. Microsoft 365 Business Premium includes Intune and Entra ID P1. Check which plans you have before buying separate tools.
Bring company devices and BYOD under control
Everything IT provides Microsoft Intune and MDM services from Dublin: assessment and design, Intune deployment, device compliance and Conditional Access, Apple and Android management, app protection policies, and ongoing managed support. As a Microsoft Partner with ISO 27001 certified, information-security-led delivery, we roll out device management in a structured way that protects users from unnecessary disruption.
Talk to us about MDM and Intune →