HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Devices & Intune

How do we secure personal phones with Intune without enrolling them?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

Use Intune app protection policies, also called MAM without enrollment. They protect company data inside apps like Outlook, Teams and OneDrive on personal phones, with a PIN, copy and save restrictions, and selective wipe, without managing the whole device. Enforce them with a Conditional Access policy that requires an app protection policy for mobile access.

Key facts

  • App protection policies manage the app and its company data, not the phone.
  • Employees keep full privacy: IT cannot see personal apps, photos or messages.
  • Conditional Access with Require app protection policy blocks unprotected apps from company data.
  • Selective wipe removes only company data from protected apps.
  • Android needs the Company Portal app installed as a broker; iOS uses Microsoft Authenticator. Neither enrolls the device.

How app protection works

An app protection policy is a set of rules Intune applies to supported apps when a user signs in with a work account. The rules apply to the work account's data in that app. Personal accounts and personal apps are not affected.

Typical rules require a PIN or biometric to open the work app, block copy and paste from work apps to personal apps, block saving work files to personal storage, require encryption, and set minimum app and OS versions. If the phone is lost or the person leaves, IT issues a selective wipe that removes only company data.

Recommended settings

Microsoft publishes a data protection framework with tiered app protection configurations. Starting from those tiers is faster and easier to defend than building settings from scratch.

SettingTypical choice
Access requirementPIN or biometric, re-checked after a period of inactivity
Data transfer to other appsPolicy-managed apps only
Receive data from other appsPolicy-managed apps, with exceptions if needed
Save copiesBlock, except to OneDrive and SharePoint
Cut, copy and pastePolicy-managed apps, paste-in allowed
Open linksMicrosoft Edge
Jailbroken or rooted devicesBlock access or wipe data
Offline grace periodBlock after a set period, wipe after a longer one

Enforce it with Conditional Access

A policy only helps if unprotected apps cannot reach company data. Create a Conditional Access policy for iOS and Android that grants access to Office 365 only when an app protection policy is applied. Combine it with a policy that blocks legacy authentication, so native mail apps that cannot be protected are kept out.

Microsoft retired the older Require approved client app grant, so build new policies on Require app protection policy.

Rollout steps

  • Decide which apps are allowed on personal phones: usually Outlook, Teams, OneDrive, Edge and the Office app.
  • Create iOS and Android app protection policies targeted to user groups.
  • Pilot with IT and a friendly department, including a test of selective wipe.
  • Create the Conditional Access policy in report-only mode, review sign-in logs, then enable it.
  • Communicate clearly to staff what IT can and cannot see on their phone.
  • Expand to all users and remove access for native mail apps.

When to enroll instead

App protection is right for personal phones. Company-owned phones are usually better enrolled, with Android Enterprise fully managed or work profile, or Apple Business Manager with automated device enrollment, so IT can manage the whole device, push apps and wipe it fully. Some organizations also enroll personal Android devices with a work profile for stronger separation. Pick the model per device ownership type.

How Accred Consulting approaches it

Accred Consulting starts by reviewing your mobile access today: which apps people use, which devices are company owned, and your Conditional Access policies. The proposal sets the app list, policy tiers, enforcement plan, a fixed price and a timeline. Our US-based specialists configure iOS and Android app protection policies, Conditional Access in report-only then enforced mode, and selective wipe procedures, and run a pilot before the full rollout. At handover you get documentation, a staff privacy explainer and help desk steps, with optional support afterward.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

No. IT sees the work account in protected apps, the app version and limited device details such as OS version and model. It cannot see personal email, photos, messages, browsing or location, and it cannot wipe the whole phone.
App protection policies are part of Intune, included in Microsoft 365 Business Premium, E3 and E5. The Conditional Access policy that enforces them needs Entra ID P1, which those plans include.
No. App protection only works with apps built with the Intune SDK, such as Outlook. Native mail apps cannot be protected, which is why the Conditional Access policy should block them and direct users to Outlook.
Yes, for Microsoft Edge on Windows through Intune app protection for Windows, combined with Conditional Access. It protects work data in the browser on unmanaged PCs without enrolling them. Desktop Office apps are more limited, so many organizations allow only browser access from personal computers.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation