Control company data on every phone and laptop, without spying on personal devices

The short answer

Mobile device management (MDM) is software that lets a business set up, secure and, if needed, wipe the phones, tablets and laptops that access company data. It enforces basics such as a passcode, encryption and current software, installs work apps, and lets you remove company data when a device is lost or an employee leaves.

For company-owned devices, use full MDM. For personal phones, use a lighter approach called mobile application management, which protects only the work apps and leaves personal photos and messages alone. If you already have Microsoft 365 Business Premium, you already own Microsoft Intune, which does both. The rest of this article explains the choices and a practical rollout.

What MDM actually controls

• Security settings: require a passcode, screen lock, encryption and a minimum operating system version.
• Apps: push Outlook, Teams and line-of-business apps, and block apps you do not allow on company devices.
• Wi-Fi and email setup: deliver office Wi-Fi and email profiles so staff do not type passwords into settings.
• Compliance checks: flag or block devices that fall out of line, such as a jailbroken phone or one missing updates.
• Remote actions: lock, locate or wipe a lost device, or remove only company data when someone leaves.
• Inventory: a live list of who has which device and its health, which helps with audits and insurance questionnaires.

Company devices versus personal devices

Microsoft’s Business Premium guidance describes two strategies, and most small businesses use both.

Full management for company-owned devices

The business controls the whole device. Microsoft recommends MDM for every company-owned device. Setup is easiest when devices enroll automatically from the start:

• iPhones, iPads and Macs: Apple Business Manager links devices bought from Apple or authorized resellers to your MDM, so they enroll when first switched on.
• Android: Android Enterprise supports fully managed company devices and a separate work profile for personal ones.
• Windows laptops: Windows Autopilot sets up new PCs with your apps and settings, including BitLocker encryption, before or when they reach the user.

App protection for personal phones

The employee controls the phone. The business controls only company data inside managed apps such as Outlook, Teams and OneDrive. Microsoft’s app protection policies can require a PIN to open Outlook, block copying and pasting work data into personal apps and restrict saving copies of work files to personal storage. If the phone is lost or the person leaves, you remove the company data from those apps without touching anything else.

This is usually the right answer for personal phones. Staff accept it more easily, and it covers the main risk, which is company email and files on a device you do not own.

What MDM does not do

MDM is one layer, not a full security program. Be clear about its limits so nobody assumes they are covered.

• It does not stop phishing. A managed phone can still hand a password to a fake login page, so you still need multi-factor authentication and email filtering.
• It does not back up data. Company files should live in OneDrive, SharePoint or another backed-up system, not only on the device.
• It is not antivirus. Laptops still need endpoint protection, and Microsoft sells Defender for Business separately or inside Business Premium.
• It does not manage itself. Policies drift, phones age out of support and new hires arrive with devices nobody enrolled. Someone has to own it.

Which tool should you use?

• Microsoft Intune is included in Microsoft 365 Business Premium as Intune Plan 1, and is sold separately for other plans. It manages Windows, Mac, iOS and Android, and works with Conditional Access to block devices that are not compliant. It is the natural choice for Microsoft 365 businesses.
• Google endpoint management is built into Google Workspace, with more advanced controls in higher editions. It suits businesses that run on Google.
• Apple-focused tools suit businesses where most devices are Macs and iPhones and deeper Apple features are needed.

Pick the tool that matches your email and identity platform. Running a separate MDM alongside Microsoft 365 or Google Workspace means two places to manage the same users.

Not sure how many devices touch your company data? Most owners are surprised by the count once personal phones are included. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, business continuity and technology spending, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

A 30-day rollout plan

Week 1: decide and document

1. List every device that accesses company email or files, and mark each company-owned or personal.
2. Write a short device policy: what is required, what the company can and cannot see, and what happens when someone leaves.
3. Set up the prerequisites. For Intune that means an Apple push certificate, a managed Google Play connection and automatic Windows enrollment.

Week 2: build the policies

1. Create compliance policies for each device type: passcode, encryption, minimum OS version.
2. Create app protection policies for personal iPhones and Android phones.
3. Build Conditional Access rules in report-only mode, such as requiring a compliant device or an app protection policy to reach email.

Week 3: pilot

1. Enroll three to five people, including at least one skeptic and one person with an older phone.
2. Fix what breaks and write a one-page guide with screenshots.

Week 4: roll out and enforce

1. Enroll the rest of the team in groups, with someone available to help.
2. Switch Conditional Access from report-only to on once everyone is enrolled.
3. Add device retirement and selective wipe to your employee offboarding checklist.

Privacy questions staff will ask

Be upfront. With app protection on a personal phone, the company manages only the work apps and their data. With full MDM on a company device, the business can see device details such as model, operating system and installed company apps, and can wipe the device. Put this in your written policy, and explain it in the rollout email before anyone is asked to enroll.

It also helps to say what happens at the end. When someone leaves, a company phone is wiped and returned. A personal phone keeps everything except the work apps’ data, which is removed remotely. Staff who know this in advance rarely push back, and the conversation on their last day is much easier.

Keeping it working

• Review non-compliant devices weekly and follow up.
• Update minimum OS versions as Apple, Google and Microsoft retire old releases.
• Check the inventory against your staff list each quarter.
• Pair MDM with the other basics in our Microsoft 365 security settings guide.

JLB USA sets up and runs device management as part of managed IT for businesses with roughly 25 to 100 employees, including endpoint protection, encryption and same-day removal of leavers.

Keep reading

• IT support for accounting firms: what CPA practices actually need
• IT support for dental offices: imaging, practice software, backups and HIPAA basics
• Microsoft Teams Phone for small business: can it replace your phone system?
• Microsoft 365 vs Google Workspace for small business: how to choose in 2026

Related services

• Managed IT services
• Employee offboarding IT checklist
• Microsoft 365 security settings
• Cybersecurity services