Work apps on personal phones: when an SME should set up app protection with Intune

Why the personal phone is the weak spot

In most SMEs, laptops are now properly sorted: encrypted, updated and managed. The phone is often the device that falls outside every agreement. Employees install Outlook themselves or use the built-in mail app, sign in with their work account and carry customer email, Teams conversations and shared files in their pocket.

That works until something changes. An employee leaves and keeps email and files on their own phone for months. A phone gets lost without a screen lock. Or someone saves a quote to personal cloud storage or forwards it through a chat app because that was quicker. You do not know, and there is little you can do afterwards.

What app protection does and does not do

With an app protection policy you manage the work apps, not the device. That is the difference from full device management, where the whole phone is enrolled in Intune. For phones owned by employees, app protection is usually the right choice: enough protection for company data, without intruding on their private life.

• access to the app: Outlook, Teams and OneDrive ask for a PIN, fingerprint or face recognition, even when the phone itself is already unlocked;
• data stays business: you can block copy and paste to personal apps, saving to personal cloud storage and sharing to unmanaged apps;
• encryption: company data inside the apps is stored encrypted;
• selective wipe: when someone leaves or loses the phone, you remove only the company data from the work apps, while photos and personal apps stay;
• minimum requirements: you can require a minimum operating system version and refuse phones with a jailbroken or rooted operating system.

What you do not see: personal photos, personal messages, browsing history or the phone’s location. Explain that to employees as well; it prevents a lot of resistance.

Why Conditional Access belongs with it

A policy on Outlook and Teams makes little sense if employees can also use the built-in mail app on their phone with the same account. That is why you link app protection to Conditional Access: phones only reach work email, Teams and files through apps where the policy is active. Other apps get no access.

Laptops work differently. There you use device compliance: only managed, encrypted and updated laptops may reach company data. Together those two rules cover most situations in an SME.

What to sort out this month

Keep the first step small enough to actually carry out:

• map who uses work email, Teams or files on their own phone, and with which apps;
• choose the work apps you allow, usually Outlook, Teams, OneDrive, Word, Excel and Microsoft Authenticator;
• decide the rules: PIN or biometrics, block copying to personal apps, save only to OneDrive or SharePoint;
• write a short explanation for employees: what the company can and cannot see, and what happens when they leave;
• test the policy with a pilot group first, then switch on Conditional Access for everyone.

What not to do on day one: block the built-in mail app before employees have set up Outlook. Then half the team is without email on Monday morning.

Leavers and lost phones: the moment it counts

The real value of app protection shows at two moments. When someone leaves, you wipe the company data from their personal phone as a fixed part of the leaver checklist, without asking them to hand in the phone. When a phone is lost or stolen, you wipe only the company data, while the employee can have the phone itself blocked by their provider.

If you want to go further, combine it with sensitivity labels and data loss prevention, so confidential documents stay extra protected on the phone too.

How Floor ICT rolls this out — and what you decide

Floor ICT checks your licences, creates an app protection policy in Microsoft Intune for iPhone and Android, and tests it with a pilot group. Then we switch on Conditional Access, so only protected apps can reach company data. Selective wipe becomes part of the fixed leaver procedure, and employee questions go through the ticket portal.

You decide which apps are allowed, how strict the rules for copying and saving are, and whether company-owned phones are fully managed. We advise; the trade-off between convenience and protection stays with you.