How to Secure Microsoft 365 on Personal and BYOD Devices
Most Australian SMBs have staff accessing Microsoft 365 from personal devices - a home laptop, a personal iPhone, a family iPad. Preventing this entirely is operationally impractical in most environments. The security question is not 'how do we stop BYOD?' but 'how do we allow BYOD access with appropriate controls that protect company data without requiring employees to hand over management of their personal device?'
The BYOD security problem
A personal device accessing Microsoft 365 is not subject to your Intune compliance policies unless the user chooses to enrol it. An unenrolled personal device may be running an outdated operating system, have no screen lock, be shared with family members, and have no encryption. From a security perspective, a compromised personal device with Microsoft 365 credentials stored or sessions active is as dangerous as a compromised corporate device.
The other problem is data residency. When a staff member accesses Teams or SharePoint on a personal device, company data may be cached or downloaded locally - on a device you do not manage and cannot wipe if the employee leaves or the device is lost.
The two control approaches: MDM vs MAM
Microsoft Intune supports two fundamentally different approaches to managing device access, and the right choice for personal devices is usually MAM, not MDM.
MDM vs MAM for BYOD
| Approach | What it manages | Device enrollment required? | Appropriate for |
|---|---|---|---|
| Mobile Device Management (MDM) | The entire device - settings, applications, compliance state, remote wipe of the whole device | Yes - user must enrol their personal device into Intune | Company-owned devices; employees willing to allow full device management |
| Mobile Application Management (MAM) | Only the Microsoft 365 applications and the data within them, not the device itself | No - user installs Outlook, Teams, etc. from the App Store; policies apply to those apps only | Personal BYOD devices where full device enrollment is not acceptable |
App protection policies (MAM without enrollment)
Intune App Protection Policies (APP) - also called MAM-WE (MAM Without Enrollment) - apply security controls to the Microsoft 365 mobile applications on a personal device without enrolling the device itself. The user installs Outlook, Teams, OneDrive, and other Microsoft 365 apps from the standard App Store, signs in with their work account, and the app protection policies apply to the work account within those applications.
Controls available through app protection policies:
- Require a PIN or biometric to open Microsoft 365 applications
- Prevent copy-paste of company data from Outlook to a personal app (like Notes or Gmail)
- Block saving Microsoft 365 files to personal storage (personal iCloud, Google Drive, local device storage)
- Encrypt company data within the applications, separate from personal data on the device
- Selectively wipe only company data from the device if the employee leaves - without wiping personal photos, messages, or applications
- Block jailbroken or rooted devices from accessing company data
- Require that the applications are up to date before access is granted
Conditional Access for BYOD
Conditional Access policies (available through Entra ID P1, included in Business Premium) can be configured to require that mobile access occurs only through app-protected applications. This means that if a user tries to access company email through their phone's native Mail app - which is not subject to app protection policies - access is blocked. They must use the Outlook app, which is covered by the policy.
A common Conditional Access configuration for BYOD environments:
- For mobile devices (iOS and Android): require an approved app and require app protection policy. This forces mobile access through Outlook, Teams, and OneDrive apps with protection policies applied - and blocks access through native device apps.
- For unmanaged computers (personal laptops): require MFA for all access. Optionally restrict downloading of files by limiting access to web-only (browser) rather than sync clients. This prevents company data from being cached locally on unmanaged computers.
- For managed devices (company-owned, enrolled in Intune): require a compliant device. This is the highest-trust access condition and is appropriate for devices under IT management.
What this looks like for employees
When app protection policies and Conditional Access are configured for BYOD, the employee experience is:
- 01
Install Microsoft 365 apps
The employee installs Outlook, Teams, and OneDrive from the App Store on their personal device. No device enrollment is required.
- 02
Sign in with work account
When the employee signs in with their work Microsoft 365 account, the app protection policies are applied automatically. They do not need to do anything to activate the policies.
- 03
App-level protection is active
The employee can use Outlook, Teams, and OneDrive normally. They will be prompted to set a PIN for the apps. Attempting to copy company content to personal apps, save files to personal storage, or access email through the device's native Mail app will be blocked.
- 04
Personal apps are unaffected
The employee's personal apps, contacts, photos, and data are completely separate from the managed work account. IT has no visibility into or control over personal applications.
The most common mistake in BYOD security is treating it as a binary choice between 'full device management or nothing.' App protection policies provide meaningful security controls over company data on personal devices without requiring employees to enrol their personal device or grant IT access to their personal data. This is the approach that works in practice because employees will accept it.
Windows personal laptops
Mobile BYOD is relatively straightforward to manage with app protection policies. Windows personal laptops are harder. App protection policies for Windows have more limited scope than mobile, and the full benefit of Intune management requires device enrollment.
For personal Windows laptops, the practical approach is: require MFA for all sign-ins, configure Conditional Access to allow browser-based access but restrict OneDrive sync client installation, and consider whether accessing Teams and SharePoint through a browser only (rather than installed apps) is an acceptable trade-off for the security benefit of no local data caching.
For businesses where staff regularly work from home on personal laptops, the stronger approach is providing company-owned and managed devices rather than attempting to secure personal Windows hardware through policy alone.
Next step
Cloud Security Baseline
The Cloud Security Baseline configures app protection policies, Conditional Access rules for BYOD devices, and device compliance policies for managed devices - giving your organisation appropriate controls for mixed device environments.
Learn more