Bring your own device is already happening at most UK SMEs. Staff read work email on personal phones, join Teams calls from the car, and check Outlook on the same handset they use for everything else. The question is rarely whether to allow it. It is how to bring those phones under sensible control without staff feeling like the company has taken over their personal property.
Mobile device management for small business in 2026 is no longer the heavy enrolment model people remember from a decade ago. Microsoft Intune supports an app-protection-only mode that controls company data inside Outlook, Teams and other work apps, without touching personal photos, texts, apps or location. That is the part most staff worry about. However, you can remove that concern from day one.
Most BYOD rollouts stall on three questions
Three questions come up the moment IT mentions managing personal phones. Can my employer see my photos. Can they see my texts, can they wipe my phone if I leave. Those questions are reasonable, and the answer to all three depends on which type of management the business chooses to deploy.
Get that distinction wrong and the rollout stalls before the first device is enrolled. Get it right and most of the resistance disappears.
Two ways to do mobile device management for small business
Intune offers two broad approaches.
| Model | What it does | What staff see |
| Full device enrolment (MDM) | Manages the entire device, including settings, apps and policies. Can wipe the full device. | A managed device with company control over the OS layer. |
| App protection policies (MAM) | Manages only the work apps and company data inside them. Cannot see personal apps, photos or texts. Cannot wipe personal data. | A normal personal phone with a few work apps that follow company rules inside themselves. |
For most UK SMEs, app protection only is enough. It blocks copy-paste from Outlook to a personal WhatsApp, requires a PIN to open the work apps, encrypts company data on the device, and lets the business wipe only the work data if the phone is lost or the employee leaves. The personal half of the phone stays untouched.
Full enrolment makes sense for company-owned devices, particularly where Cyber Essentials evidence or regulated data is involved. For staff-owned phones, app protection usually delivers what the Cyber Essentials v3.3 update asks for, without the personal-property concern.
A working BYOD policy fits on two pages
A workable BYOD policy fits on two pages and answers the questions staff are actually asking. The points that matter:
- Which devices are allowed (modern iOS and Android with current OS versions).
- Which work apps are covered (Outlook, Teams, OneDrive, the rest of Microsoft 365).
- What the business can and cannot see on the device.
- What happens when someone leaves (company data wiped, personal data untouched).
- What happens if the device is lost (the same).
- Who pays for what (data plan, repairs, replacement).
The policy is written for staff to read, not for lawyers to refer to. If staff cannot summarise it back to you in a sentence, it is too long.
A four-step Intune rollout
A practical sequence for an SME on Microsoft 365 Business Premium:
- Inventory. List who needs work apps on a phone, on what device, with what OS version.
- Policy. Configure app protection policies for Outlook, Teams and OneDrive: PIN required, copy-paste restricted to work apps, encryption enforced, selective wipe on leaver.
- Pilot. Enrol three to five willing staff first. Iron out the OS prompts and the PIN experience before the wider rollout.
- Communicate. Send the two-page BYOD policy with a five-bullet summary of what changes and what does not. The we cannot see your photos line goes first.
The technical work is rarely the slow part. The communication is.
Where this sits next to your other controls
App protection on phones complements the controls you already have on laptops and Microsoft 365. Conditional access policies, the Microsoft Purview information protection foundation and Zero Trust principles all rely on knowing what device is making a request and what data lives on it. Without mobile management, the phone is the gap. With app protection, the phone joins the rest of the estate.
However, for Cyber Essentials, assessors want to see that staff protect company data on their phones, not that the business controls the entire device. App protection meets the bar, and aligns with NCSC mobile device guidance.
What it looks like once it is live
A staff member loses a phone on the train. The business issues a selective wipe of the work apps from the Intune portal. Within minutes, IT can remove the work mailbox, Teams chats and OneDrive cache while leaving the staff member’s photos, contacts and personal apps untouched. They report the loss to the carrier and pick up a replacement on the weekend.
That is the model staff can live with. It is also the model that closes the most realistic mobile risk most businesses are carrying.
Roll it out without the politics
Mobile device management does not have to be a fight. With app-protection-only policies, a short BYOD policy and a clear staff briefing, most businesses land Intune in a fortnight without losing goodwill.
If you would like a second pair of eyes on your Microsoft 365 setup before you roll BYOD out, get in touch and we will walk through what your existing licence already covers, where the policy gaps sit, and what a sensible rollout looks like for your team size.