BYOD

Staff already use their own phones for work. Protect the work data, not the phone.

Banning personal phones does not work: people forward email to personal accounts instead. Intune app protection keeps work data locked inside Outlook, Teams and OneDrive, leaves personal photos and apps alone, and lets you wipe just the work data when someone leaves. Here is how it works, what phones qualify, and what goes in the policy.

Microsoft Intune requirements from Microsoft Learn, checked 30 October 2026.

Set up BYOD properly Check a phone 07 3114 2808

App protection vs MDM
Minimum phone versions
Policy essentials

Reviewed by Blake Bath, General Manager, on 30 October 2026.

A tradesperson in hi-vis checks work email on his own phone from the driver's seat of a ute, with a toolbox and hard hat beside him. — **The short version**App protection on personal phones. Full management on company phones.

What app protection does

What app protection controls on a personal phone.

Only inside work apps. Nothing else on the phone is touched.

PIN or face to open work apps

A separate lock on Outlook, Teams and OneDrive, even if the phone is unlocked.

PIN or biometric
Personal apps unaffected
Timeout set by IT

BYOD phone check

Will this phone work with a BYOD policy?

Pick the phone type and version. The result is based on Microsoft's published Intune minimums.

Starting a job with a BYOD policy? Check whether your phone can run protected work apps. On iPhone, find the version in Settings, General, About.

Phone type

iOS version

Result

Meets requirements

This phone meets Microsoft's requirements.

Keep it updated. Many businesses set the minimum to the current or previous major version, and a minor update may still be needed.

Based on Microsoft's published Intune minimums. Your employer's policy can be stricter.

Set up BYOD properly

Which approach

App protection or full device management?

	App protection (MAM)	Full management (MDM)
Controls	Work apps and work data only	The whole device
Personal data	Not visible, not wiped	IT can wipe the device
Staff acceptance	High	Low on personal phones
Best for	Personal phones	Company-owned phones and laptops

Pair app protection with a Conditional Access policy that requires it on iOS and Android, so unprotected apps cannot reach your data.

Where to draw the line

What BYOD should and should not cover.

Fine: email and Teams on a personal phoneThrough app protection.
Fine: occasional web access from a personal laptopWith browser session controls where needed.
Fine: authenticator app on a personal phoneFor MFA.
Not fine: a personal laptop as the main work computerWithout device compliance, you cannot see if it is patched or protected.
Not fine: confidential data saved on personal devicesKeep it in managed apps and storage.
Not fine: forwarding work email to personal accountsBlock automatic forwarding outside the business.

In writing

What goes in a BYOD policy.

ScopeWhich devices and apps are allowed, and for what.
Consent to app protectionAgreed before access is granted.
Minimum device requirementsSupported OS version, screen lock and recent updates.
Lost or stolen devicesReport straight away so work data can be wiped.
Leaving the businessWork data will be removed. Personal data will not be touched.
CostsAny allowance for phone or data use, stated up front.

Our view

Most BYOD problems show up when someone leaves.

The setup is the easy part. The gap is offboarding: work email and files sit on an ex-employee's phone because nobody ran the selective wipe. Tie the wipe to the offboarding checklist and block the account at the same time, so the phone cannot sign back in even if the wipe is delayed.

Set the minimum iOS version in line with Microsoft's own support, not years behind it. Microsoft recommends matching Microsoft apps' support of the current and previous major iOS release.

Rolling it out

Setting up BYOD in five steps.

Step 1Find out what is happening
Who uses personal devices for work, and for what.
Step 2Write the policy
Short, clear and acknowledged by staff.
Step 3Configure app protection
Outlook, Teams, OneDrive and Office apps.
Step 4Require it with Conditional Access
Unprotected apps cannot connect.
Step 5Test a selective wipe
On a sample phone, before you need it.

Related guides

BYOD sits on top of Intune. These guides cover the rest.

Device management, access policies and leavers.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about BYOD.

My new job's BYOD policy needs a newer iOS than my phone has. What now?

Update the phone if it can: Settings, General, Software Update. Intune app protection currently needs iOS 17 or later, and Microsoft is moving that to iOS 18 shortly after iOS 27 is released. If your phone cannot update that far, ask your employer whether they supply a work phone, or whether email on the web is allowed instead.

Can my employer see my personal photos and messages?

Not with app protection. It only applies to work apps like Outlook, Teams and OneDrive. Your photos, messages, personal apps and location are not visible to IT, and a wipe only removes work data.

Should a business use MDM or app protection for personal phones?

App protection, also called MAM. It protects work data inside work apps without taking control of the phone. Full device management, MDM, is for company-owned phones.

What happens to work data if I lose my phone?

Report it straight away. IT can wipe the work data from your work apps the next time the phone connects. Your personal data stays.

Do we need Intune for BYOD?

If you use Microsoft 365, Intune is the standard tool and it is included in Business Premium. Pair app protection with a Conditional Access policy so only protected apps can reach your data.

Next step