Ask yourself a simple question: how many people in your company read work email on their phone? In our experience the answer is almost always “everyone.” Now the second question: how many of those phones could the company lock or wipe if they disappeared today? The answer is usually “none.”
Companies pay attention to computers: antivirus, updates, encryption, password policies. Phones stay in a personal zone, even though they hold the same email, the same Teams conversations, OneDrive documents, customer contacts and, often, the second sign-in factor for every company system. For a thief or a finder, that is a full ring of keys.
In this article we explain what actually happens when a phone is lost, how the risk differs between personal and company devices, what a mobile device management (MDM) system does in practice and how to roll it out so that employees do not feel the company is reaching into their private lives.
What happens when a phone with company email goes missing
Picture a common situation: a sales manager leaves a phone in a taxi on Friday evening. He notices on Saturday morning. He tells IT on Monday, because he “didn’t want to disturb anyone over the weekend.”
In those 60 hours the phone could have been unlocked, if it had a simple PIN or none at all. It has Outlook open with every email, including the ones where colleagues send contracts and passwords. Teams is open with internal chats. OneDrive holds the pricing spreadsheets. And most importantly, it has the authenticator app that approves sign-ins to Microsoft 365. With the phone and mailbox access, someone can reset the password and approve the second factor on the same device.
Without MDM, all the company can do here is change the employee’s password and hope the phone was locked. It cannot check whether the device was encrypted, cannot remove company data remotely and cannot show an auditor or the data protection authority that personal data was not accessible to third parties. Under GDPR, that is exactly what you need to assess within 72 hours.
With MDM the same situation looks different: the employee reports it, IT locks the device and removes company data remotely within minutes, and the system shows that the device was encrypted and protected by a strong passcode. The incident ends up as a log entry, not a notification to a supervisory authority.
BYOD or company devices: different risk, different rules
Most companies run a mixed model: some employees use company phones, others use their own (BYOD, bring your own device). Both can be secure, but they call for different approaches.
A company device is company property. It can be managed fully: you set which apps are allowed, enforce encryption, require updates, block unknown app sources and wipe the whole device when the employee leaves. The employee knows it is a work tool, so there is little resistance.
A personal device belongs to the employee, and the company has no right to see their photos, messages or apps. Here MDM works differently: it creates a separate work profile or manages only company apps. The company sees and controls just that part: Outlook, Teams, OneDrive, the authenticator app. If the phone is lost, only that part is wiped and personal data stays. When the employee leaves, the same applies.
This is the table we use to explain the difference to managers:
| Question | Company device | Personal device (BYOD) |
|---|---|---|
| What the company manages | The whole device | Only the work profile or apps |
| What the company sees | Apps, settings, location (if enabled) | Only the state of work apps |
| If the phone is lost | The whole device is wiped | Only company data is wiped |
| When the employee leaves | The device is returned and wiped | The work profile is removed |
| Privacy risk | Low, the device is for work | Controlled by technical boundaries |
Neither model is better. What matters is that it is chosen deliberately and written into a policy, not left to emerge by itself.
What MDM actually does
Mobile device management is not one feature but a set of rules that the system applies automatically. The most important ones:
- Encryption and screen lock. The device must be encrypted and have a passcode of at least six digits or biometrics. Without that, company email simply does not open.
- Remote lock and wipe. If a phone is lost or stolen, you do it from the management console within minutes, without the employee’s involvement.
- App policy. Company apps are installed automatically, and you can forbid copying data from Outlook into a personal WhatsApp or saving attachments to a personal cloud.
- Update requirements. A phone running an operating system two years out of date loses access until it is updated.
- Conditional Access. Signing in to Microsoft 365 is possible only from devices that meet the policy. This ties MDM to Microsoft Entra ID and blocks sign-ins from random devices.
- Inventory. The company knows at any moment how many devices can reach its data, which versions they run and when they last connected.
- Offboarding. Disabling an account in Entra ID automatically removes work data from all of that person’s devices.
These rules are also what NIS2 and DORA expect for access control and asset management. When an auditor asks “how do you manage mobile devices,” a company without MDM has no answer.
How to roll it out without employee pushback
The most common reason MDM fails is not technical. Employees hear “the company will control my phone” and simply do not enrol. A few things have worked for us.
First, tell the truth about what the company sees and what it does not. Show the console. An employee who sees that it contains only the state of their work profile, not photos and messages, calms down. Put it in the policy in plain sentences.
Second, start with management. When the CEO and the department heads enrol first, it stops being “control” for everyone else and becomes the normal way of working.
Third, make it simple. Enrolment should take a few minutes and be described in a few screenshots. If someone needs to call the helpdesk, your IT support team will help, but most people manage on their own.
Fourth, connect it to a benefit for the employee. If they lose a phone, they know nobody can reach their work data and they will not have to explain anything. A new device gets all work apps automatically.
Fifth, set a deadline and turn on Conditional Access after it. While MDM is optional, some employees will never enrol. Once work email does not open without it, the question resolves itself within a week.
Where to start
- Count how many devices have access to company email today. In the Microsoft 365 admin centre you can see it immediately, and the number usually comes as a surprise.
- Decide on a model: company devices, BYOD or mixed. Write a one-page policy on what the company manages and what it cannot see.
- Turn on the minimum rules: encryption, screen lock and remote wipe. This removes the biggest risk in the first week.
- Link MDM to Conditional Access for Microsoft 365, so the policy is a condition, not a recommendation.
- If nobody can look after this in-house, our mobile device management service covers rollout, policy setup and daily administration, and when a phone is lost, a response from the helpdesk.
A phone is just a company computer, only smaller and lost more often. Treat it accordingly.
