Intune and BYOD: How to Protect Company Data on Laptops and Phones Without Owning Every Device

Intune, included in Microsoft 365 Business Premium as Intune Plan 1, does two different jobs and the difference matters most for staff-owned devices.

The rule of thumb: company owns it, manage it; person owns it, protect the data. A business can use both at once, and Intune lets you apply a stricter app protection policy to unenrolled devices than to managed ones.

The scenario every business has: a member of staff with Outlook and Teams on their personal iPhone or Android. Without any policy, company email and files can be copied into personal apps, saved to personal cloud storage, and stay on the phone after the person leaves.

With an app protection policy, from Microsoft's documentation:

• The work apps require a PIN or fingerprint/face to open in a work context, separate from the phone's own lock.
• Copy, paste and save-as from work apps into personal apps can be blocked or restricted to approved apps.
• Work data is encrypted inside the apps.
• Apps can be blocked from running on jailbroken or rooted phones, and a minimum operating system version can be required.
• When someone leaves, IT performs a selective wipe that removes the company data from the work apps and leaves photos, messages and personal apps untouched.

Microsoft organises these settings into three levels (basic, enhanced, high). Level 2, "enhanced data protection", is described as applicable to most users accessing work data, and it is where we start most businesses.

Two things to get right: pair the policies with a Conditional Access rule that requires an approved app with app protection, otherwise staff can simply use a different mail app and bypass everything; and tell people what the policy does and does not do, because "IT can see my phone" is the objection, and it is not true.

For devices the business owns, enrol them in Intune and manage them properly. The settings that matter for a small business:

1. Compliance policy. Encryption on (BitLocker on Windows, FileVault on Mac), screen lock, a supported operating system version, Defender running. A device that fails is marked non-compliant.
2. Conditional Access. Company data only from compliant devices. This is the single control that turns "we have policies" into "the policy is enforced".
3. Update rings. Windows and macOS updates applied on a schedule you control, with evidence for Cyber Essentials' 14-day requirement for high and critical fixes.
4. Baseline configuration. Firewall on, admin rights removed from everyday accounts, unnecessary features off.
5. Apps. Office, Teams, Defender and your line-of-business apps deployed automatically, so a new laptop is ready without an engineer touching it.
6. Windows Autopilot. A new laptop shipped straight from the supplier, switched on by the user, and configured by Intune over the internet. Included with Business Premium.
7. Remote wipe and retire. Tested, so that when a laptop is lost the button works.

Macs, iPhones and Android are all supported, so a mixed estate is not a reason to avoid it.

Most Intune rollouts go wrong by switching on Conditional Access before devices are ready, locking everyone out on a Monday morning. The order we use:

1. Inventory. Which devices exist, who owns them, and what operating systems they run. Anything unsupported is replaced first.
2. App protection policies for everyone, in report-only or warning mode first, then enforced. This is low-risk and protects the phones immediately.
3. Enrol company devices in groups, starting with IT and a friendly pilot team. Apply compliance policies but do not enforce Conditional Access yet; watch the compliance report.
4. Fix what the report shows. Usually: a few machines without encryption, one on an old OS, a personal laptop someone has been using for work.
5. Enforce Conditional Access once compliance is above 95 percent, with a documented exception route for the last few.
6. Autopilot for new devices, so nothing is set up by hand from this point.
7. Review quarterly. New starters, leavers, OS updates and Microsoft's own changes all move the picture.

• "Staff will not accept IT on their personal phones." They do not need to. App protection touches only the work apps, and a selective wipe removes only work data. Show them the policy in writing.
• "We are too small for this." Intune is included in a licence many small businesses already pay for. A ten-person business with laptops and phones has exactly the risks it addresses.
• "It will slow people down." Done in the order above, the visible changes are a PIN on Outlook and occasional update prompts. The lockouts people fear come from rushed Conditional Access, which is a sequencing problem, not an Intune one.
• "We have antivirus already." Antivirus does not encrypt a lost laptop, wipe a leaver's phone or prove your patching. Intune and Defender for Business are designed to work together and both come with Business Premium.

Device management is part of our standard onboarding: we enrol company devices, set the compliance and app protection policies, stage Conditional Access so nobody is locked out, set up Autopilot for new kit, and review the compliance reports as part of the managed service. It is also most of the evidence a Cyber Essentials assessor asks for, so we build it once and use it twice.

For the licence side, see the Microsoft 365 licensing and security guide; for what Cyber Essentials expects of devices, see the Cyber Essentials guide.