MDM vs BYOD: Why Unmanaged Personal Phones Are a Bad Idea

Somewhere in your office right now, there is a phone. It belongs to a lovely employee. It has your company email on it, a few patient or client documents in the Downloads folder, a screenshot of an insurance card from March, the passcode "1-2-3-4" (because "it's easier"), and a cracked screen held together by optimism and a sparkly case. Last weekend it went to a birthday party at a trampoline park. Next month its owner might take a job across town, and the phone (plus everything on it) goes with them.

That's not a horror story. That's a Tuesday. "Bring your own device," or BYOD, happens in nearly every small office whether anyone decided on it or not. Somebody wanted email on their phone, somebody else needed to check the schedule from home, and before long half the staff is doing real work on devices the business doesn't own, can't see and can't lock. We call this "BYOD by accident," and it's one of the most common security gaps we find when we walk into a medical office, dental practice or accounting firm.

The good news: you don't have to buy everyone a phone, and you don't have to become the Big Brother of the break room. Mobile device management (MDM) and its gentler cousin, app protection, let you protect company data on any device, including personal ones, without reading anyone's texts or seeing their vacation photos. This guide explains how it works in plain English, what your IT provider can and can't see, how HIPAA fits in, what it costs, and how to roll it out without a staff revolt.

What is MDM, in plain English?

Mobile device management (MDM) is software that lets a business set security rules on phones, tablets and laptops, push out work apps, and remove company data remotely if a device is lost or someone leaves. Think of it as a remote control for the work side of a device.

For an all-Microsoft office, the MDM tool is Microsoft Intune (what is Intune?). Intune is a cloud service that manages Windows PCs, Macs, iPhones, iPads and Android devices from one console. It's included in Microsoft 365 Business Premium (as Intune Plan 1), alongside Entra ID P1 for sign-in rules and Defender for Business for endpoint protection, according to Microsoft's plan description. If you're not sure which plan you have, our Microsoft 365 plan picker will sort it out in a couple of minutes.

With MDM in place, you can typically:

• Require a passcode (and not "1234") before a device can open work data.
• Require encryption, so data on a lost device is scrambled and unreadable.
• Push work apps like Outlook, Teams and OneDrive, already configured.
• Block old, unpatched operating systems from reaching company email and files.
• Remove company data remotely when a device is lost, stolen or walking out the door with a former employee.
• Prove all of the above to an auditor, insurer or client security questionnaire.

There's a second flavor worth knowing on day one. Mobile application management (MAM), which Microsoft calls app protection policies, protects the data inside specific work apps without managing the whole device. That distinction is the whole ballgame for personal phones, and we'll dig into it shortly.

If you want the bigger picture of what Intune does for laptops and desktops too, see our Microsoft Intune guide for small businesses.

Why is letting staff use unmanaged personal phones a bad idea?

Because company data on an unmanaged phone is data you can't protect, can't retrieve and often can't even prove exists. When something goes wrong, and with phones something always eventually goes wrong, you have no lever to pull.

Here are the five classic ways "just use your own phone" goes sideways. Every office we've ever met has at least one of these stories. Most have three.

Disaster #1: The phone that went to Disney World

A hygienist takes a few photos of a patient's X-ray on her personal iPhone to text the specialist. Efficient! Then she goes on vacation, and the phone goes on Space Mountain, and then it goes nowhere at all, because it fell out of her fanny pack somewhere between the churro cart and the parking tram. The phone has no passcode because "Face ID is annoying with sunglasses." There's patient data on it. You have no way to wipe it, and now you get to figure out whether you have a reportable breach.

Disaster #2: The ex-employee who still gets your email

The office manager leaves on perfectly good terms. Six weeks later she mentions, kindly, that her phone is still getting the shared scheduling inbox, and also, did you know Dr. Patel's daughter is engaged? The account was never fully shut off because the mail app on her phone kept a saved connection and a local copy, and nobody had a way to remove it.

Disaster #3: The family iPad

The practice owner checks the patient portal and practice email on an iPad at home. That iPad is also the household's official Minecraft machine, logged into the family Apple account, with a 10-year-old who has discovered that "Allow" makes pop-ups go away. Nobody knows what's installed on it. Nobody updates it. It is, functionally, a petting zoo for malware with your email inside.

Disaster #4: The texting thread of doom

Front desk staff text patients appointment reminders, "your crown is in," and occasionally photos of forms from their personal numbers. The threads live forever in personal iMessage, synced to personal iCloud, backed up to who-knows-where. When a staff member leaves, those conversations leave too, and the patient keeps texting a number that now belongs to someone who works at a car dealership.

Disaster #5: The phone that's never been updated

An old Android phone, still running a version that stopped getting security updates years ago, with your email on it. It's not that the owner is careless. It's that nobody told them, and nothing stopped it from connecting.

What do these have in common? Not one of them requires a hacker in a hoodie. They're ordinary life meeting company data with no guardrails. And the attackers are paying attention to phones. The Verizon 2026 Data Breach Investigations Report (DBIR) found that in phishing simulations, the median click rate for phone-centric lures (text messages and voice) was about 40% higher than for email, roughly 2% versus 1.4%. The same report found the human element was present in 62% of breaches, and it made a point that should be printed on a poster in every office: the mobile phishing attempts it could measure were only visible because those devices were managed, either company-owned or under some form of MDM. In Verizon's words, if employees use purely unmanaged personal devices for work, "this can represent a risky gap in your visibility."

Translation: if you can't see it, you can't protect it, and you won't even know when it went wrong.

The fix, in one line: decide on purpose which devices can touch company data, and put every one of them under either device management or app protection. The rest of this guide is how.

BYOD vs company-owned devices: which should your office use?

Most small offices should use company-owned devices for anything shared, anything at the front desk, and anyone whose job runs on a mobile device, and allow personal phones for email and Teams only under app protection policies. Pure "everyone brings their own, no rules" is the one option that's never right.

Here's how the main models compare:

A few honest trade-offs to weigh:

• Control vs. privacy. Full management of a company phone is reasonable because it's the company's phone. Full management of someone's personal phone feels invasive, and people resist it. App protection threads that needle.
• Cost vs. simplicity. Company devices cost money up front but are simpler to secure, replace and hand off. Personal devices are cheaper but need a clear policy so everyone knows the rules.
• Turnover. If your front desk turns over often, company-owned devices save you from repeating Disaster #2 every few months.

What to do: list every role in your office and mark each one "company device," "personal phone with app protection," or "no mobile access needed." That list becomes your policy's backbone.

Intune enrollment vs app protection policies: what's the difference?

Enrollment puts a whole device (or a separated work area of it) under management. App protection policies (MAM) protect only the data inside specific work apps like Outlook, Teams and OneDrive, with no device enrollment at all. For most personal phones, app protection is the right starting point.

Let's unpack each.

Full device enrollment (MDM)

When a device is enrolled in Intune, the business can set device-wide rules: passcode length, encryption, OS version, Wi-Fi profiles, approved apps and more. For company-owned devices, this is what you want. Windows PCs can even set themselves up automatically using Windows Autopilot, which is how we handled zero-touch laptop setup in our software startup case study. New laptops configured themselves on first sign-in, and, in that project's words, a lost laptop became "a hardware problem, not a data breach."

For personal devices, Microsoft and the phone makers offer privacy-focused enrollment types that only manage a walled-off work area:

• Apple User Enrollment (account-driven). Microsoft's documentation describes how this sets up a personal iPhone or iPad so that work data lives on a separate encrypted volume and in managed apps, away from personal data and apps. IT can remove the work side but cannot wipe the whole device.
• Android Enterprise personally-owned work profile. Enrollment creates a separate work profile to hold work apps and data. Microsoft's Android guide says personal apps and data stay separate and remain unaffected by Intune, and that IT can't read, access or erase data the user owns.

App protection policies (MAM without enrollment)

App protection policies don't enroll the device at all. Instead, they wrap specific Microsoft apps (Outlook, Teams, OneDrive, Word, Excel and others that support Intune app protection) in rules that travel with the data:

• Require a PIN or Face ID to open work apps.
• Block copy and paste from work apps into personal apps (so patient details don't wander into a personal notes app).
• Block "Save As" to personal storage like a personal Dropbox or the camera roll.
• Encrypt work data inside the app.
• Block access if the phone is jailbroken or rooted, or below a minimum OS version.
• Selectively wipe only the company data from those apps when needed.

Microsoft's selective wipe documentation sums up the point nicely: when a device is lost or stolen, or the employee leaves, you want company app data removed, but you might not want to remove personal data, especially on an employee-owned device. That's exactly what selective wipe does.

Side-by-side

Pair it with sign-in rules. App protection works best alongside conditional access, a feature in Microsoft Entra ID that checks conditions before letting someone sign in (conditional access explained). For example: "You can read company email on a phone only through the protected Outlook app, and only after multi-factor sign-in." That rule is what stops someone from bypassing your nice protected app by adding the work account to the phone's built-in mail app. And yes, multi-factor sign-in should be on for everyone. Our MFA guide covers how to roll it out painlessly.

What to do: for personal phones, start with app protection plus conditional access. Use full enrollment for every device the business owns. Use personal enrollment only when someone genuinely needs more than the core Microsoft apps.

What can my employer actually see on my enrolled personal phone?

Far less than people fear. Microsoft's own documentation lists what organizations can never see on an enrolled device: calling and web browsing history, email and text messages, contacts, calendar, passwords, pictures (including the camera roll), and the content of user-created documents.

This is the single biggest source of BYOD pushback, so let's do a little myth-busting. Picture the staff meeting where you announce the phone policy. Somebody in the back crosses their arms and says, "So you're going to read my texts." Here's your answer, straight from Microsoft's "What info can your organization see when you enroll your device?" page.

What your organization can always see on an enrolled device:

• Device owner and device name
• Serial number, model and manufacturer
• Operating system and version
• The device's IMEI (a hardware identifier)

What it might see, depending on setup:

• Phone number: only the last four digits on a personal device.
• Storage space: sometimes, when troubleshooting app installs.
• Location: only for lost corporate-owned devices. Microsoft states plainly that organizations can't view a personal device's location.
• Apps: on personal devices, the managed app inventory (the work apps). Microsoft notes some configurations can show more, so ask your IT provider exactly what's configured.

What it can never see: your texts, your photos, your browsing history, your contacts, your personal email, your calendar, your passwords, or the contents of your personal documents.

And remember, with app protection only (no enrollment), the business isn't managing the device at all, just the work apps. That's even less visibility.

Myth vs. reality

What to do: hand staff this table before you roll anything out, and have your IT provider confirm in writing what your specific configuration collects. Transparency kills the rumor mill faster than any policy memo.

What happens when a phone with company data is lost or stolen?

With management, it's a five-minute call and a selective wipe. Without it, it's a scramble to work out what was on the phone, whether it was protected, and whether you now have to notify people.

Let's walk through the same lost phone twice.

Version A: Unmanaged

1. Staff member realizes the phone is gone (usually hours later, often on a weekend).
2. They might call you. They might not, because they're embarrassed, or they assume it'll turn up.
3. You try to figure out what was on it: company email? Downloaded files? Photos of patient documents? Texts with patients? Nobody knows.
4. Was it locked? "I think so?" Encrypted? Modern iPhones and Androids are encrypted when a passcode is set, but you have no way to confirm it was.
5. You can't remove anything. The best you can do is change the person's password and hope the mail app hadn't already cached a pile of messages.
6. If the phone held patient information, you start a breach risk assessment based mostly on guesses.

Version B: Managed

1. Staff member reports it (your policy says to report within a set time, and nobody gets in trouble for reporting).
2. IT checks Intune: the device was compliant, encrypted, passcode-protected, and work data lived only inside protected apps.
3. IT issues a selective wipe (personal phone) or a full wipe or lost mode (company phone).
4. IT revokes active sign-ins, and the user signs in on their replacement device with multi-factor authentication.
5. You document what happened for your incident log. Total drama: low.

Why encryption matters so much for HIPAA

Under the HIPAA Breach Notification Rule, breach notification duties apply to unsecured protected health information. HHS guidance specifies encryption (and destruction) as the ways to render PHI "unusable, unreadable, or indecipherable" to unauthorized people. In plain English: if a lost device's patient data was properly encrypted, HHS treats that very differently from a phone full of readable records. That's not a loophole. That's the whole point of encryption, and MDM is how you prove it was on.

The cost of not having it is well documented. In 2020, HHS's Office for Civil Rights (OCR) announced that Lifespan, a Rhode Island health system, paid $1,040,000 to settle potential HIPAA violations after an unencrypted laptop was stolen from an employee's car, with OCR citing a failure to encrypt and a lack of device and media controls. And in an older but very on-topic case, Catholic Health Care Services of the Archdiocese of Philadelphia agreed to a $650,000 settlement after a company-issued iPhone was stolen. According to HHS, that iPhone was unencrypted and not password protected, and the organization had no policies on mobile devices containing PHI. Note that was a company phone. Owning the device doesn't help if you don't manage it.

The Verizon 2026 DBIR also flags this in healthcare specifically, listing Loss among the top errors in the sector and describing it as "often involving unencrypted user devices and portable media."

What to do: require a passcode and encryption on every device that touches company data, enforced by Intune compliance policies, and write a simple "lost device" procedure: who to call, how fast, and what IT does next. Pin it to the break room fridge right next to the "please label your yogurt" sign.

What happens when an employee leaves with client data on their phone?

Without management, the data leaves with them. With Intune, you disable the account and selectively wipe company data from their devices on their last day, and their personal photos never get touched.

Most ex-employee data walkouts aren't malicious. They're inertia. The Verizon 2026 DBIR makes the same point about insiders generally: your own people "are typically much more likely to lose an asset or make a mistake than to intentionally abuse their access." But "accidentally kept 400 patient emails" is still 400 patient emails.

Here's what lingers on an unmanaged personal phone after someone leaves:

• Cached company email (sometimes thousands of messages) in the phone's mail app
• Files downloaded from OneDrive or SharePoint into the phone's local storage
• Photos of documents, whiteboards, schedules and insurance cards
• Text threads with patients or clients
• Saved passwords for practice software in the phone's browser
• A still-signed-in Teams app, if nobody revoked sessions

The offboarding checklist for mobile devices

• Disable the user's Microsoft 365 account (or convert the mailbox to shared if you need to keep it).
• Revoke all active sign-in sessions in Entra ID.
• Issue a selective wipe of company app data on personal devices.
• Collect company-owned devices and wipe or re-provision them.
• Remove the person from shared mailboxes, groups and practice software.
• Change any shared passwords they knew (and then stop having shared passwords).
• Forward their work phone number or business texting line to a current staff member.
• Document the date and actions in your offboarding log.

For medical and dental offices, this isn't optional housekeeping. The HIPAA Security Rule includes "termination procedures" for ending access when someone leaves, under its workforce security standard. Being able to say "we removed company data from all devices on her last day, here's the log" is exactly the kind of answer that keeps an audit short.

What to do: make the mobile offboarding steps part of your standard exit checklist, and have your IT provider confirm completion in writing. If your provider can't do a selective wipe today, that tells you something.

Is it a HIPAA problem to have PHI on personal phones?

HIPAA doesn't forbid personal phones, but it does require you to protect electronic protected health information (PHI) wherever it lives, with safeguards you've assessed and documented. A personal phone with patient data, no passcode, no encryption, no remote wipe and no policy fails that test.

PHI is any individually identifiable health information: names tied to appointments, diagnoses, X-rays, insurance details and so on (PHI defined). When it's electronic, HIPAA's Security Rule applies.

The Security Rule doesn't name products. It asks you to do a risk analysis, then put reasonable safeguards in place, including (among others):

• Device and media controls: knowing where devices with ePHI are and how data is removed from them.
• Access controls: unique user logins, automatic logoff, and encryption where reasonable.
• Workforce security: granting and ending access properly.
• Security incident procedures: what to do when, say, a phone goes missing.

HHS's own HealthIT.gov guidance for mobile devices reads like an MDM feature list: enable encryption, use a password or other authentication, install and activate remote wiping or disabling, keep security software up to date, research apps before downloading, keep physical control of the device, and delete stored health information before discarding a device. NIST SP 800-124 Revision 2, the federal guidance on managing mobile devices in organizations, covers both organization-provided and personally owned (BYOD) devices and leans heavily on MDM for exactly these controls.

Your mobile devices should show up in your risk analysis. If you haven't done one recently, our HIPAA security risk assessment guide walks through it, and our free HIPAA security checklist is a good five-minute gut check.

About the proposed HIPAA Security Rule changes: HHS published a proposed update to the Security Rule in January 2025 that would make several safeguards, including encryption and asset inventories, more explicitly required. As of this writing it has not been finalized, and reporting on HHS's regulatory agenda suggests final action has slipped to 2027. Check HHS for the latest, but don't wait: managed, encrypted, inventoried devices are good practice under today's rule.

Texting patients: is it allowed?

It can be, with care. HHS guidance on email (and the same logic is widely applied to texting) says providers may communicate with patients electronically if they apply reasonable safeguards. If a patient initiates contact by email, the provider can generally assume that's acceptable unless the patient says otherwise, and if a patient is warned about the risks of unencrypted messages and still prefers them, the patient has the right to receive information that way. HHS also suggests limiting the amount and type of information sent.

Where personal phones go wrong isn't the idea of texting. It's that texts from a staff member's personal number:

• Live in personal accounts and personal cloud backups you don't control.
• Leave with the employee.
• Can't be reviewed, retained or produced if you ever need them.
• Tend to drift from "your appointment is Tuesday at 2" to "here's a photo of your biopsy results, lol sorry for the glare."

Better options:

1. Use a business texting platform (often part of your practice management software, patient communication tool or phone system) that signs a business associate agreement (BAA) with you (what's a BAA?).
2. Keep texts to minimum necessary content: reminders and logistics, not diagnoses.
3. Document patient communication preferences.
4. Use secure portals or encrypted email for anything clinical. Our HIPAA-compliant email encryption guide explains the email side.

Photos of patient stuff

Front desks photograph insurance cards. Assistants snap intraoral photos. Doctors photograph X-rays to send a colleague. On a personal phone, every one of those lands in the camera roll and probably syncs to a personal cloud account.

Fixes:

• Capture images in your practice software or imaging system, not the phone camera.
• If a phone must be used, use a company-owned device whose camera roll isn't synced to anyone's personal cloud.
• Block saving work data to personal storage using app protection policies.
• Add "no patient photos on personal devices" to your policy, in bold, with a reason, not just a rule.

What about shared tablets and front-desk iPads?

Shared devices should always be company-owned and fully managed, locked to only the apps they need, and set to sign out or reset between users. A shared iPad signed into one person's account is basically a shared password with a touchscreen.

You know the one. It lives at the front desk, it's signed into the office manager's Apple ID, and it's used by four people for patient check-in, the practice's social media, and occasionally ordering lunch. It has no passcode because "it's always here." Then one day it isn't.

How to set shared devices up properly:

• Company-owned and enrolled in Intune, ideally through Apple Business Manager (for iPads) so enrollment can't be removed by someone resetting it.
• Single-app or limited-app mode for check-in kiosks, so patients can't wander off into Settings or Safari.
• Shared device modes where available, so each staff member signs in with their own account and work data is cleared between sessions.
• No personal Apple IDs or Google accounts on shared devices. Ever.
• Auto-lock after a short period, and a passcode that isn't taped to the back.
• Asset tags and an inventory, so you know you have seven iPads, not "somewhere between five and nine."

In a dental office, the operatory tablet used for patient education videos should be locked to those videos. In a medical office, the intake tablet should run only the intake app. In a CPA firm, the conference room iPad used for client presentations should not still be signed into last tax season's intern's email.

What to do: count your shared devices this week. For each one, ask: who owns it, whose account is it signed into, and what happens if it walks out the door? If any answer is "um," that device is next on the list.

What does it cost: company phones or BYOD stipends?

A stipend for personal phones is usually cheaper in cash; company devices cost more but give you full control and simpler offboarding. Either way, the management software is often already in your Microsoft 365 plan if you're on Business Premium.

Let's be honest about the numbers. These are typical ranges, not quotes, and they vary by carrier, device and region.

A few notes on the money side:

• Taxes on phones and stipends. The IRS addressed employer-provided cell phones in Notice 2011-72: when a business provides a phone primarily for noncompensatory business reasons (such as needing to reach an employee for work emergencies), the business use is treated as a tax-free working condition fringe, and incidental personal use as a de minimis fringe. Stipends and reimbursements have their own rules. Ask your accountant how to structure a stipend for your situation.
• Some states have their own rules about reimbursing employees for work use of personal devices. If you have remote staff in other states, check with your employment advisor before you set the policy.
• Hidden costs of "free" BYOD. The cheapest phone policy in the world gets very expensive the day a lost phone turns into a breach investigation. The HHS settlements above are extreme examples at large organizations, but the investigation time, notification letters and lost sleep scale down to small practices too.

A common mix for a 10–25 person practice:

• Company-owned, fully managed tablets for check-in and operatories.
• Company-owned phones for the practice owner and any on-call or field roles.
• Personal phones for everyone else, with a modest stipend for those who need work email or Teams, protected by app protection policies and conditional access.
• No work access at all for roles that don't need it. (Not everyone needs email on their phone. That's a feature, not a punishment.)

What should a BYOD policy include?

A good BYOD policy fits on two or three pages and answers: who can use personal devices, for what, under which security rules, what the business can and can't see, and what happens when a device is lost or someone leaves. Here's an outline you can adapt.

This is a template outline, not legal advice. Have your HR or employment advisor review the final version, especially anything touching pay, stipends or monitoring.

BYOD policy template outline

1. Purpose and scope

• Why the policy exists (protecting patient/client data and the business).
• Which roles may use personal devices for work, and which may not.
• Which device types are covered (phones, tablets, personal laptops).

2. Eligible devices

• Minimum operating system versions (supported, still-updated versions only).
• No jailbroken or rooted devices.
• Device must support a passcode or biometric lock and encryption.

3. What work you can do on a personal device

• Allowed: company email, Teams, calendar, OneDrive through approved apps.
• Not allowed: storing patient/client data in personal apps, photos of patient or client documents, texting patients from a personal number, using personal cloud storage for work files.

4. Security requirements

• Install and use only approved work apps (e.g., Outlook, Teams, OneDrive).
• Accept app protection policies (or enrollment, if your role requires it).
• Use multi-factor authentication.
• Keep the device updated.
• Use a passcode of at least six digits (or a strong biometric with passcode).

5. Privacy: what the business can and can't see

• Plain-English list of what's visible (device model, OS, work apps) and what's not (texts, photos, browsing, personal email, location of personal devices).
• Name the tool (Microsoft Intune) and link to Microsoft's data-visibility page.

6. Lost or stolen devices

• Report within a set number of hours to a named contact.
• The business will remove company data (selective wipe); personal data is not affected under app protection.
• No penalty for prompt reporting.

7. Leaving the company

• Company data will be removed from personal devices on the last day.
• Company-owned devices must be returned.

8. Reimbursement or stipend

• Who's eligible, how much, how it's paid.

9. Acceptable use and support

• What IT will and won't support on personal devices.
• Who to contact for help.

10. Acknowledgment

• Employee signature and date. Re-acknowledge annually.

How do you roll out MDM without a staff revolt?

Roll it out in phases over about 30 days: inventory, decide the model, configure policies quietly, explain the privacy facts, pilot with a few people, then enforce. Surprise enforcement on a Monday morning is how you get a mutiny at the coffee machine.

A 30-day rollout plan

Week 1: Find out what you've actually got

1. Pull a sign-in report from Microsoft 365 to see which phones and apps are connecting to company email.
2. List every company-owned device (tablets, phones, laptops).
3. Ask staff, nicely, which devices they use for work. You'll be surprised.
4. Decide, role by role, which device model each person gets.

Week 2: Configure, quietly 5. Turn on multi-factor authentication for everyone if it isn't already. 6. Create app protection policies for iOS and Android (PIN, block copy/paste to personal apps, block saving to personal storage, minimum OS, selective wipe). 7. Create compliance policies for company-owned devices (passcode, encryption, OS version). 8. Build conditional access rules in report-only mode first, so you can see who would be blocked before anyone actually is. 9. Enroll company-owned tablets and shared devices.

Week 3: Explain and pilot 10. Hold a 20-minute staff huddle. Show the "can never see" list. Answer questions. Bring snacks. (This step is load-bearing.) 11. Pilot with three to five people, including at least one skeptic. 12. Fix the friction points they find.

Week 4: Enforce 13. Switch conditional access from report-only to enforced. 14. Help each person set up Outlook and Teams under app protection (most take five minutes). 15. Remove the work account from built-in mail apps. 16. Collect signed BYOD acknowledgments. 17. Add mobile devices to your risk assessment and your offboarding checklist.

Our device management service handles all of this for clients, including the awkward staff-meeting part.

Mistakes we see all the time

These are the patterns that keep turning up. Some are funny. None are rare.

1. Enrolling personal phones with full device management. It technically works, it terrifies staff, and it's usually unnecessary. Use app protection or the personal enrollment types instead.
2. App protection without conditional access. The protected Outlook app is lovely, but if people can still add the work account to the built-in mail app, they will, and your policy becomes decorative.
3. Forgetting the iPad at home. The owner's personal tablet often has more access than anyone's phone. Include it.
4. Shared devices signed into a personal account. The check-in iPad should not know the receptionist's iCloud password, her kid's birthday or her Spotify playlist.
5. No lost-device procedure. If nobody knows who to call, the call comes three days late.
6. "We'll do offboarding later." Later is how ex-employees end up with your email for six weeks.
7. Allowing ancient phones. If a phone can't run a supported OS, it shouldn't touch company data. Set a minimum version and stick to it.
8. Texting patients from personal numbers "just this once." It's never just once.
9. Not telling staff what IT can see. Silence breeds rumors. Rumors breed workarounds.
10. Buying MDM and never turning it on. We see Business Premium licenses with Intune sitting completely unconfigured more often than you'd think. It's like buying a gym membership and counting the purchase as cardio.

Questions to ask your IT provider

Whether it's us or someone else, these questions separate "we manage your devices" from "we've heard of device management."

• Which of our devices are enrolled in Intune today, and which are company-owned vs. personal?
• Do we have app protection policies on iOS and Android? What do they enforce?
• Is conditional access blocking unprotected mail apps?
• Can you show me a compliance report: encryption, passcode, OS version?
• How fast can you do a selective wipe, and who can request one?
• What exactly can you see on a personal phone under our configuration?
• Are shared tablets enrolled through Apple Business Manager or Android Enterprise?
• Are mobile devices in our HIPAA risk analysis?
• What's in our offboarding checklist for devices?
• How do you handle a lost device on a Saturday? (Our answer: report it through the support portal or by phone, and we act on it; monitoring is 24/7, and we'll tell you honestly how fast a person responds.)

Scenario walk-throughs

A dental office (12 staff)

Before: Hygienists text X-ray photos to specialists from personal phones. The check-in iPad is signed into the office manager's Apple ID. Three ex-employees may still have email on their phones. Nobody's sure.

After:

• Imaging is shared with specialists through the imaging software or encrypted email, not phone cameras.
• Two company-owned iPads for check-in, enrolled and locked to the intake app.
• Staff phones use Outlook and Teams under app protection; conditional access blocks other mail apps.
• Ex-employees' sessions revoked and data selectively wiped.
• Mobile devices added to the risk analysis and offboarding checklist.

For broader dental tech, see our dental office IT guide.

A medical office (20 staff)

Before: Providers check messages on personal phones with no passcode policy. Front desk texts patients from a shared personal cell phone that lives in a drawer. A nurse practitioner's old Android hasn't been updated in years.

After:

• Patient texting moved to a business texting platform with a signed BAA, limited to reminders and logistics.
• The drawer phone is retired (with a small ceremony).
• Providers use app protection with a minimum OS requirement; the outdated Android is blocked until replaced.
• On-call providers get company-owned phones, fully managed.

A CPA firm (8 staff)

Before: Partners keep client tax documents in the Downloads folder on personal iPads. Seasonal staff use personal phones for email during tax season and keep access long after April.

After:

• Client files stay in OneDrive/SharePoint; app protection blocks saving to personal storage.
• Seasonal staff get access through app protection only, with a calendar reminder to selectively wipe and disable on their end date.
• The firm can now answer "how do you protect client data on mobile devices?" on client questionnaires. (Professional firms also have specific obligations under the FTC Safeguards Rule. Our IT security guide for CPA firms covers that.)

Quick self-check: is your office running amok?

Answer yes or no:

• We know every phone and tablet that can access company email and files.
• Every one of those devices requires a passcode and is encrypted.
• We can remove company data from any of them remotely.
• Personal phones use protected work apps, not the built-in mail app.
• Shared tablets are company-owned, enrolled and not signed into anyone's personal account.
• Nobody texts patients or clients from a personal number.
• Our offboarding checklist includes removing company data from devices.
• Staff have signed a BYOD policy and know what IT can and can't see.
• Mobile devices are in our HIPAA risk analysis (healthcare) or written security program (CPA firms).

Fewer than seven yeses? You're not alone, and you're not doomed. You're just one well-planned month away from a lot fewer 3 a.m. "where's my phone" moments.

The bottom line

Letting staff run amok with personal devices isn't a moral failing. It's what happens by default when nobody sets rules. But company data on unmanaged phones is data you can't lock, can't wipe and can't account for, and the attackers have noticed that phones are where people click.

You don't need to buy everyone a phone, and you definitely don't need to read anyone's texts. Use company-owned, fully managed devices where the business owns the risk: shared tablets, front desks, clinical roles and on-call staff. Use app protection and conditional access for personal phones, so work data stays in a protected bubble you can pop on demand. Write a short policy, explain the privacy facts, and build device cleanup into every exit.

That's a beefed-up mobile setup without the beef with your staff.

If you'd like help figuring out which model fits your office, or you want someone to set up Intune and run the staff huddle for you, book a free 20-minute call. We'll look at what's connecting to your email today and give you a plain-English plan.