Protecting company data on personal phones with Intune app protection
Most staff will not hand their personal phone over to company management, and they shouldn't have to. Intune app protection policies protect the work data inside Outlook, Teams and OneDrive instead, and let you wipe just that data when someone leaves.
Reviewed by the ITRS security team · Last updated
Enroll or not? MAM vs MDM
Mobile device management (MDM) enrolls the whole phone: IT can push settings, require a device passcode, see device inventory and wipe the device. Mobile application management (MAM) manages only work apps and the data inside them. Microsoft Intune supports app protection policies on devices that are not enrolled at all, which is usually what people mean by "MAM without enrollment".
For company-owned phones, enroll. For personal phones, MAM is normally the better balance: the company controls its data, and the employee keeps their photos, messages and browsing private.
| Item | MDM (enrolled) | MAM (app protection only) |
|---|---|---|
Who owns the device | Usually the company | Usually the employee |
What IT controls | Whole device | Work data inside protected apps |
Wipe | Full device wipe or retire | Selective wipe of work data only |
Employee privacy | Lower; device inventory visible | Higher; personal apps untouched |
Setup effort for staff | Enroll in Company Portal | Sign in to Outlook/Teams; policy applies on first use |
App protection policy settings that matter
Intune's app protection settings are grouped into data protection, access requirements and conditional launch. A sensible starting point for personal phones:
- Send org data to other apps: Policy managed apps, so a work attachment cannot be opened in a personal app.
- Save copies of org data: Block, with OneDrive for Business and SharePoint allowed as save locations.
- Restrict cut, copy and paste between other apps: Policy managed apps with paste in, so staff can paste into work apps but not copy out.
- PIN for access: Require (Microsoft's default), allowing biometrics on the device to stand in for the PIN.
- Conditional launch: block jailbroken or rooted devices, set a minimum app and OS version, and use the offline grace period so an app that has not checked in blocks access and eventually wipes work data. Microsoft's default block timer is 1,440 minutes (24 hours); the wipe timer is set by the admin.
Conditional Access for protected apps
App protection only works if staff cannot simply use a different app. A Conditional Access policy for iOS and Android that grants access with "Require app protection policy" forces users into Intune-protected apps such as Outlook, Teams and the Office apps, and blocks the built-in mail app and unprotected browsers from reaching company data.
Microsoft retired the older "Require approved client app" grant: on June 30, 2026 it moved to a read-only state and admins can no longer create new policies with it. If your tenant still has policies that use it, Microsoft's migration guidance is to use "Require app protection policy". Check these policies are actually enforcing.
Selective wipe
When someone leaves, or a phone is lost, an admin can issue a selective wipe request for a user's protected apps. The next time the app runs, company data is removed from it; personal data is untouched. Microsoft notes that app protection policies must be deployed for selective wipe to work, and the wipe happens when the app next launches, so blocking the account and revoking sessions should come first.
Selective wipe is also triggered by conditional launch rules, such as the offline grace period wipe timer, so a phone that drops off the network does not keep company data indefinitely.
What employees see
Tell staff this before rollout, in writing. Most resistance to BYOD controls comes from people assuming IT can see their personal phone. A one-page explanation, linked from your BYOD policy, solves most of it.
- On first sign-in to Outlook or Teams, a message that their organization now protects data in the app, then a prompt to set an app PIN.
- Blocked actions explained in-app, for example "Your organization's data can't be pasted here".
- No change to personal apps, photos, texts or browsing. IT cannot see personal content or the device's other apps under MAM.
- If the phone is jailbroken or rooted, work apps stop opening work data.
Rollout
Inventory mobile access
Use sign-in logs to see which apps and platforms are reaching Exchange and SharePoint from phones.
Create iOS and Android policies
Target all users; start with data protection and PIN settings.
Pilot with IT and a few volunteers
Test attachments, copy/paste, Teams calls and file saving.
Add Conditional Access in Report-only
Find users still on native mail apps or unprotected browsers.
Communicate, then enforce
Send the staff explanation, give a date, switch the policy on.
Add selective wipe to offboarding
Make it a line item in your leaver checklist.
Questions we hear
No. App protection applies only to work data inside managed apps. IT can see that the app is protected, its version and basic device details, not your personal content.
Then use a company-issued phone or don't access company data on it. The policy is the price of convenience, not a requirement to own a smartphone.
Technically yes, but it is a poor fit. Work data protected by a PIN on a tablet the children also use is still a risk; we usually advise against it.
Related reading.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- GuideBring your own device (BYOD) policy guideA BYOD policy has to do two jobs at once: protect company and client data on phones and laptops the company doesn't own, and tell employees honestly what the company can…
- GuideBuilding a device compliance baseline with IntuneA compliance policy answers one question about every laptop and phone: is this device safe enough to open company data?
- GuideWhat to do if a work or personal phone with company data is lostA missing phone exposes email, files and often the MFA codes that protect everything else. The steps differ depending on whether the company owns the phone.
- GuideOffboarding a user in Microsoft 365 the right wayDeleting a departing employee's account is the fastest way to lose their email, their files and any evidence you might later need.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.