Free DownloadThe ultimate guide to mobile device security in the workplace
Organizations must lock down all endpoints that access business data and put measures in place to ensure the data doesn't fall into the wrong hands. When it comes to mobile devices, however, there are unique security challenges for organizations to mitigate. This guide covers the ins and outs of mobile device usage in the workplace, with an emphasis on mobile device security policies, including the steps for implementation and best practices.
Bring your own device programs can expand workforce flexibility and reduce hardware spend, but they also force IT and security leaders to decide how corporate data will be protected on endpoints the business does not fully own.
For most organizations, the key BYOD question is no longer whether personal devices can reach corporate apps. It is how the organization will govern access, separate work and personal data, enforce minimum controls and respond when a user leaves, loses a device or falls out of compliance.
Defining a BYOD policy
The first step in creating a BYOD policy is defining the scope of control that the organization expects to maintain over employee-owned devices. Organizations could take plenty of different approaches here. On one extreme, an organization could treat personal devices like corporate assets in return for allowing employees access to IT resources from those devices. The other extreme is to assume no control over the devices themselves and instead focus on access controls and limiting risks such as leaving corporate data on BYOD devices. The optimal BYOD policy might lie somewhere between these two limits.
A BYOD policy should address acceptable use of corporate apps and data, minimum device and app security controls, authentication requirements, certificate or identity-based access controls, and the organization's rights to remove or restrict corporate data. In practice, the most sensitive parts of the policy usually involve lost or stolen devices, employee departure, selective wipe rights and the limits of what IT can see or change on a personal device.
For most organizations, the key BYOD question is no longer whether personal devices can reach corporate apps.
Acceptable-use policies could require a VPN when accessing corporate systems and prohibit the storage of passwords to business applications. Security controls might also require encryption for stored data, device password protection and registration of devices with a mobile device management (MDM) platform or a more comprehensive platform such as unified endpoint management (UEM), which includes MDM capabilities. IT administrators should ensure that employees understand all aspects of the BYOD policy and consent to them.
However, written policies and employee consent are not enough to protect an organization's information assets. Even well-intentioned employees can make mistakes, such as forgetting to set a device password or downloading confidential information over an unencrypted session. Mobile device policies should have an enforcement mechanism to ensure that these policies prevent such actions.
Enforcing a BYOD policy
Many organizations can enforce part of a BYOD policy with tools they already license, but they should first determine whether they need app-level data protection, full device management or both.
In Microsoft environments, that decision often comes down to Microsoft Intune, Microsoft Entra ID and Conditional Access. Intune app protection policies can protect corporate data inside supported apps even when a personal device is not enrolled in MDM. Conditional Access can then require approved client apps or app protection before users reach corporate resources. If the organization needs deeper control over device settings, compliance posture, configuration and reporting, it should move beyond app protection alone and require enrollment through MDM or UEM.
Third-party MDM platforms can support a wider array of BYOD policy enforcement operations, including full lifecycle management, app inventory control, data protection, certificate distribution, device configuration and lockdown.
BYOD enforcement can combine app protection, identity controls, MDM or UEM, depending on how much control the organization needs over personal devices.
BYOD policy enforcement begins with provisioning. MDM platforms can ensure consistent device configuration, install applications and create accounts on self-service management portals. If existing policies limit the apps that IT can deploy to a BYOD device, the IT department can use an MDM system that accounts for unauthorized app detection.
Most MDM applications support remote wiping, but completely wiping a device is drastic and, in many cases, might not be necessary. MDM apps can selectively wipe data, letting device administrators delete corporate data while leaving personal data intact.
A BYOD policy might also require that all devices accessing corporate systems be registered with the IT department and configured with an SSL certificate for authentication. MDMs that support certificate distribution can minimize management headaches for this operation. MDM systems can further ease that burden by reporting on expired certificates, revoked certificates and other certificate management concerns.
MDM systems also enable IT admins to recommend, and in some cases enforce, device OS updates and patches. While forcing an OS update on an end user's personal device might walk the line between privacy and security, ensuring that devices accessing corporate data are on a minimum OS or patch level might be required to provide a strong security posture. MDM systems let IT admins create OS compliance policies, such as minimum OS versions, for devices to enroll and be granted continued access to corporate applications.
Finally, look for MDM platforms for device configuration and lockdown functions. IT might want to lock down cameras, Bluetooth, GPS and Wi-Fi for some users. If the mobile admins specify an encryption policy, look for an MDM that can enforce this policy.
Modern mobile management platforms support provisioning, compliance, selective wipe and policy enforcement across both managed and personal devices.
Major mobile platforms now offer established BYOD enrollment models that are designed to separate work and personal use more cleanly. Apple's User Enrollment is built for BYOD deployments and is designed to let IT manage the organization's accounts, settings and data without exposing the user's personal account or personal data. Android Enterprise work profiles likewise keep corporate apps, data and policies inside a separate work container on employee-owned devices.
App protection vs. full device enrollment
BYOD enforcement does not always require full device enrollment. Some organizations can protect work data with app-level controls, Conditional Access and selective wipe. Others need full MDM or UEM enrollment to enforce device settings, compliance posture and reporting. The right model depends on how much control the business needs and how much privacy it wants to preserve on personal endpoints.
What devices are acceptable for BYOD management?
Having a BYOD policy is important, but it's equally important to have a strategy for the types of devices IT allows under that policy. Not all devices are created equal.
End users have a lot of choices regarding the type of device they want to use, which also means that IT cannot control an important security layer: the device's software and security update level. It also can't determine for sure if that device will see update support down the road. An MDM system can retain some control by enabling IT to create compliance policies around minimum software versions for device enrollment and application access.
A strong BYOD program depends on two decisions: how much privacy the organization will preserve on personal devices, and how much control it truly needs at the app, access and device layers.
IT administrators should give users clear eligibility guidance for Apple and Android devices based on support status, enrollment compatibility and minimum OS requirements. The goal is not just to recommend popular devices. It is to ensure that personal endpoints can support the organization's chosen BYOD model, whether that means Apple User Enrollment, Android Enterprise work profiles, app protection policies or compliance-based access controls.
These policies can be frustrating for end users with devices that do not meet the minimum requirements for OS version or other criteria. IT can often help these users through steps such as validating if their device runs the latest OS, and there might be other avenues to get their device to a compliant state. However, users might need to either upgrade their personal device -- perhaps with a subsidy from their organization -- or enroll in a corporate-owned device program.
Editor's note:This article was originally published in 2022 and was updated in 2026 to reflect current BYOD enforcement models, platform enrollment options and Microsoft identity and app protection terminology.
Michael Goad is a freelance writer and solutions architect with experience handling mobility in an enterprise setting.
Dan Sullivan, M.Sc., is an author, systems architect and consultant with more than 20 years of IT experience across advanced analytics, systems architecture, database design, enterprise security and business intelligence.
