The hybrid workplace has brought unprecedented flexibility, but it’s also ushered in new security challenges. One of the biggest? The ubiquitous use of personal phones (BYOD) for work. Employees love the convenience of checking Outlook and Teams on their iPhones and Androids, but for IT and security teams, this can feel like a data exfiltration nightmare.
How do you allow this productivity without letting sensitive company data leak to personal apps, or worse, leaving it vulnerable when an employee leaves?
The answer lies in Microsoft Intune’s Mobile Application Management (MAM), powerfully enforced by Entra ID Conditional Access.
The BYOD Dilemma: Productivity vs. Protection
Imagine this common scenario: An employee checks a sensitive email on their personal phone, downloads an attachment to their local device storage, and then accidentally (or intentionally) shares it via WhatsApp or uploads it to a personal cloud storage account. Suddenly, your company’s intellectual property or customer data is outside your control.
Traditional Mobile Device Management (MDM) would require full device enrollment, giving IT control over the entire phone. While great for company-owned devices, this is often a non-starter for BYOD due to employee privacy concerns.
So, how do you protect the data without managing the device?
The Solution: App Protection Policies (MAM) + Conditional Access
This strategy builds a secure “container” around your corporate apps and data, separating it from the personal side of the phone.
1. Intune App Protection Policies (MAM): Managing the Apps, Not the Device
Instead of enrolling the entire phone, Intune MAM focuses solely on the applications that handle corporate data (e.g., Outlook, Teams, OneDrive, SharePoint).
Key Controls You Can Implement:
- Data Relocation Controls: This is your primary defense. You can:
- Block “Save As” to local device storage or unmanaged cloud locations.
- Restrict “Cut, Copy, and Paste” so data can only be moved between other managed work apps (e.g., from Outlook to Teams) but not to personal apps (e.g., from Outlook to WhatsApp or a personal Gmail).
- Access Requirements: Enforce strong authentication before accessing work apps:
- Require a separate app-level PIN (a 6-digit code or more).
- Mandate biometric authentication (FaceID/Fingerprint) specifically for work apps.
- Data Encryption: Ensure all corporate data stored within the managed apps is encrypted.
2. Entra ID Conditional Access: The Enforcer
While MAM secures the data within the apps, Conditional Access acts as the gatekeeper, ensuring users only access corporate resources from apps that are MAM-protected.
How it works:
- You create a Conditional Access policy that targets all mobile device platforms (iOS, Android) and your core cloud apps (Exchange Online, SharePoint Online).
- The crucial “Grant Control” you set is “Require App Protection Policy.”
- The Outcome: If a user tries to access their corporate email or files from an unmanaged app (like the native iPhone Mail app or a generic file viewer), Conditional Access will block the attempt. It will then prompt the user to download and use the Microsoft Outlook or Teams app, where your MAM policies are active.
The Business Outcomes: Secure and Happy Employees
Implementing this solution brings significant benefits:
- Robust Data Security: Corporate data is encrypted, controlled, and prevented from leaking to personal apps, dramatically reducing the risk of data loss and exfiltration.
- Enhanced Compliance: You can confidently meet regulatory requirements by proving you have control over corporate data on mobile devices.
- Respect for Privacy: Employees maintain full control over their personal device and data, leading to higher adoption and satisfaction. IT manages apps, not personal lives.
- Streamlined Offboarding: When an employee leaves, an “App Selective Wipe” can be issued. This command precisely removes only the corporate data from the managed apps, leaving all personal photos, messages, and apps completely untouched. It’s a clean, surgical removal of company assets.
By strategically combining Intune App Protection Policies with Entra ID Conditional Access, organizations can empower their hybrid workforce to leverage personal devices for productivity, all while maintaining rigorous control and protection over their sensitive corporate data. It’s a win-win for security and user experience.