Mobile application management in Intune, and a question that hasn’t changed in seven years
In 2019, an IT contractor at a client of ours asked an employee for her phone so he could set up two-factor authentication on it. She asked whether he was installing software to monitor her use.
In April 2026, a different client rolled out Intune’s mobile application management (MAM) to a company full of personal phones. The IT manager emailed us afterward: “1 person freaked out and said, ‘They can see our data and can delete it.'”
The technology got a lot lighter in those seven years. The fear it runs into is the same one, and that fear stalls these projects more often than licensing, the Intune console, or any particular setting does. Employees push back when a company asks them to install something on a personal phone, and they assume the worst about what it can do once it’s there.
So, this post is about three decisions, including:
- Which tool
- How far to go
- What to say to your staff so nobody thinks you’re reading their texts
Why you can’t leave personal phones alone
If you have a phone that’s lost or stolen, and don’t have a way to prove that your client data can be wiped from it, then you have a disclosable breach on your hands. It doesn’t matter how good the passcode is or whether Face ID is on. Those can be worked around. If someone has the phone, you can’t guarantee that everything in that inbox isn’t in a hacker’s hands.
For an SEC-registered adviser, that stopped being theoretical this year. Under Regulation S-P, a firm has to notify affected clients “as soon as practicable, but not later than 30 days” after learning of unauthorized access to customer information. Smaller advisers came under the rule on June 3, 2026. Every client whose information might have been on that phone gets a letter.
Examiners know it. The SEC’s own request list asks for the firm’s policies on “Adviser-issued and personal devices” and its “ability to remotely monitor, track, and deactivate remote devices.” Insurers ask a version of the same question, regulator or not. That means if you have a bring your own device policy, there must be protections in place.
When we start with a new client, most of them have no way to remove their data from a lost or departing employee’s personal phone. This is both a compliance problem and a real-world security problem.
Here’s the requirement you need to go with. You need a logged, centrally controlled way to wipe your data off a phone you don’t own, whether it’s lost, stolen, or walking out the door with someone who just resigned. How much of the phone you touch to get there is the decision.
MAM vs MDM, and the one question that decides it
Intune, which comes with Microsoft 365 Business Premium, has two deployment modes. Mobile device management (MDM) takes control of the full phone. Mobile application management (MAM) security only controls the ability to wipe your data out of the Microsoft apps.
Here’s how we laid it out for a client in June:
“You use a built-in Microsoft tool called Mobile Application Management (MAM), which can only wipe data from the Microsoft apps. This is usually the preferred method for our clients because it’s easier to set up and you, as a company, have NO access to anything on the employee’s phone other than company data. If the phone is lost or stolen or the employee leaves the company, you click a couple of buttons and have a nice clear audit trail showing the deletion.”
MDM, by contrast, gives you total control over the entire phone. You click the same couple of buttons and get the same audit trail, but it wipes the whole thing.
We usually suggest MAM security. It’s easier to install and manage, employees find it less creepy, and it still lets you wipe company data if a phone is lost or stolen.
But here’s the thing… is your staff going to stay completely within the Microsoft or Google family of apps? Will they only use Outlook, Teams, OneDrive, and SharePoint (or Gmail and Google Drive)? Remember, MAM can’t wipe emails that are stored on your device in Apple Mail.
One client was set for MAM until the team insisted on keeping Apple Calendar. Once you do that, you need to go with MDM. We wrote more about that issue in Apple Mail vs. Outlook.
You can mix. Two executives on MDM because they won’t give up Apple Mail, everyone else on MAM, is a setup we’ve recommended more than once. What you can’t do is soften MDM security. A client’s operations manager asked whether it could be restricted to “delete only.” It can’t. It’s all or nothing.
Company-owned phones get MDM with no argument from us. This post is about the phones you don’t own.
What your company can and can’t see on a personal phone
People assume a lot of things that aren’t true. Your company won’t be using location tracking, message reading, or have a record of which apps you use.
But the thing is, when you put a company-controlled app on a personal phone, every one of those assumptions comes along with it. You need to get out ahead of that by having a roll-out plan and great communications in place.
Here’s the list we send clients whose staff are asking. Even under full MDM, the administrators can’t:
- Read your personal text messages, WhatsApps, or iMessages
- Look at your camera roll, personal photos, or videos
- View your personal web browsing history
- Read your personal emails (like your private Gmail or Yahoo accounts)
- Listen through your microphone or view through your camera
- See your personal screen time or what personal apps you are using
Microsoft publishes similar details, and it adds one thing people have a hard time believing: on a personal device, the organization can’t view the phone’s location either. Location is a corporate-owned-device feature.
What an enrolled phone does show is:
- Model
- Serial number
- Operating system version
- Names of the work apps installed
On MAM security alone it’s less. Per Microsoft’s data collection page, a MAM-only deployment doesn’t collect the serial number, phone number, or location at all. It sees the device name, the model, the OS, and which Microsoft apps you’ve signed into with your work account.
The exact inventory matters less than it seems. Every regulated firm has to do something here, and MAM is the most privacy-conscious option available.
What does matter is whether people believe you. Since 2019 our advice has been to allay concerns by showing people the actual settings being configured, so the whole thing is transparent. Enroll one iPhone and one Android, pull up the Intune console in front of the team, and show them what you can do and what you can see, which isn’t much.
How far is too far
What makes a deployment creepy is which switches get flipped after the tool is installed.
What we see a lot of companies do is turn Intune on, see all these neat switches they can flip, and flip them all. That’s not the best way to go about mobile application management with Intune.
Start with the ability to wipe the phone if it’s lost or stolen. Add controls over time and do it thoughtfully. When it comes to MAM vs. MDM, both can block copy and paste. We had one CEO who was really upset because he couldn’t copy an address out of his Outlook calendar into Google Maps.
An employee at a CMMC client wanted to screenshot their Outlook calendar to share their availability with people outside of their company. Here’s why the policy blocked it:
A screenshot moves data from a managed app (Outlook, protected by MAM/DLP policies) into the device’s unmanaged photo library. From there it can flow to iMessage, personal email, social media, all uncontrolled channels.
It turned out that Microsoft Bookings solved the scheduling problem because it gave them a link they could send to outside people to schedule a call. Security was maintained, and the solution was actually better than the original approach.
At the far end is controlled unclassified information (CUI) under CMMC. We used to tell those clients personal phones and a bring-your-own-device (BYOD) policy weren’t going to fly. One analyst on our team put it bluntly: implement everything NIST 800-171 asks of a device and “it ceases to be a personal device.”
Our opinion has shifted. A personal phone with MAM security is fine, although we’d turn on more of the security features for CMMC. We don’t know that an assessor has accepted it yet. We believe they will.
The other end is an adviser whose IT lead set MAM up on Outlook and Teams only and said that’s as far as they’d go, because the firm doesn’t own anyone’s phone. From a privacy standpoint, we were very happy with that.
The bottom line is that every firm is different and that means that every firm will have different needs when it comes to deciding between MAM vs. MDM.
Announcing it without the freak-out
The client whose employee was “freaked out” had done most things right. They had sent three notices before enforcement, which is their standing rule for any policy change. Next, they sent out this clarification email similar to this (consider using it yourself):
“The new MAM (Mobile Application Management) policy does not install anything new on your phone. It simply applies security rules to [the company’s] Microsoft 365 apps while they are being used. [The company] cannot view your personal data, access other apps on your phone, or remove anything unrelated to [the company’s] Microsoft 365 apps.”
The line that probably lit the fuse was in the first announcement: “If you don’t respond to this email, you may not be able to continue to use Outlook on your mobile device.” That’s a judgment call by each client. We don’t have enough of a read on any client’s culture to overrule it.
Same for the question we get most: Do we need a signed bring-your-own-device (BYOD) policy before we enforce, or is an announcement enough?
Again, there is no one rule. What matters is that it’s well communicated and carefully rolled out.
Count who actually uses email on their phone before you roll anything out.
Let’s use the client we just discussed as an example. They had 26 employees that could have had Outlook on a phone. Only ten did. We used Microsoft’s Conditional Access policies to block the other 16 from logging in on their mobile devices.
And when someone hates the Outlook app, and someone will, the answer is that they can use webmail, or they can accept MDM security and give the company the ability to wipe the whole phone.
Test the wipe before you need it
A mistake we often come across is firms only wiping a device if an employee leaves on bad terms. Instead, you should wipe whenever someone leaves, along with resetting their:
- Password
- Sessions
- MFA
All you do is click a few buttons and it tells you it was wiped.
One client’s IT manager tested it on their own Android before rolling it out. Within about a minute, Outlook, Teams, OneDrive, and SharePoint had all signed them out of their work account. Nothing else on the phone changed. They also found the catch that we think is important: after a wipe, the person stays on Intune’s User-Level Wipe list, and until you remove them, the apps refuse to let them sign back in.
They found something else. Blocking and wiping are two separate controls. A Conditional Access block stops new sign-ins but leaves cached emails. The wipe removes the work profile entirely.
Here’s the sequence we recommend. Block apps first, and see who complains. Then, wipe the phones that stay blocked.
Two things Microsoft’s own wipe documentation says that clients don’t expect. The wipe only fires the next time the user opens the app, and it “may take up to 30 minutes after the request was made.”
That’s why the account gets disabled first. And contacts synced from Outlook into the phone’s address book get removed, but anything that has since synced onward, to iCloud say, can’t be.
Firms that have actually run the wipe are in a different position from firms that believe they could. Run it once, on purpose, on a phone that isn’t lost.
Intune Mobile Application Management setup checklist for small businesses
If your people only use Microsoft tools, go down the mobile application management route. It’s easier to install and manage, and employees find it less creepy. It doesn’t let you manage the phone’s data and settings, but it lets you control company data and wipe it from the phone if needed. Take a minimalist approach as opposed to trying to build out the whole Intune suite.
Send this to whoever runs your Microsoft 365 and ask them to confirm each one:
- Separate app protection policies for iPhone and Android, with the Company Portal app required on Android
- A Conditional Access policy that blocks mobile email unless the app protection policy applies (the “require app protection policy” grant)
- Only the wipe turned on to start; copy-and-paste and screenshot blocks left off until you’ve decided you want them
- One test wipe run on a real phone, with the person’s name taken off the User-Level Wipe list afterward
- A written offboarding sequence: reset sessions, password, and MFA, then wipe
Ask them to reply with which of these are already in place. Anything that comes back unclear, send our way.
The gotchas
The following are some scenarios where you could run into issues.
Your IT provider may not know the difference between MAM and MDM
We’ve asked a few IT companies to implement MAM, and they scoped a full MDM rollout and told staff their personal phones would have to be wiped to enroll. On an iPhone, MAM installs nothing and works through Outlook, so nobody’s phone gets wiped. If your provider says otherwise, ask them which of Intune’s two modes they’ve quoted.
Android needs one extra app
MAM on Android requires the Intune Company Portal app to be installed, though the phone doesn’t get enrolled. iPhones don’t need it.
MAM only covers the Microsoft apps
Redtail, Dropbox, and Salesforce are outside of MAM security. For those, confirm the mobile app doesn’t store data locally and that disabling the account cuts off any cached data.
Licensing
MAM comes with Business Premium, or with an Intune Plan 1 add-on. If you’re a regulated firm still on Business Standard, move everyone to Premium. Standard usually isn’t enough for the security controls you need anyway.
One phone, one employer
A client had an employee that also worked for a second company that managed their phone. The two configurations conflicted. On both an iPhone and Android, each phone can only be controlled by one MDM provider. This is a rule from Apple/Google, and it’s not something you can change. The workaround is either stick with MAM or use a second device.
Use the current Conditional Access control
Older guides say “require approved client app.” Microsoft retired that grant on June 30, 2026. New policies should use “require app protection policy.”
Google Workspace users
What Microsoft calls MAM maps to what Google calls basic mobile management, and it works very similarly. It covers the work account inside the Google apps, needs no agent on the phone, and can wipe that account remotely. Google’s advanced management controls the whole phone. Google’s version has fewer knobs than Microsoft’s, but it’s acceptable.
How to Protect Company Data on Employees’ Personal Phones – Final Thoughts
If your staff can live inside Outlook and Teams on their phones, we almost always recommend going with MAM. It installs nothing on an iPhone, and you can still wipe your data in a couple of clicks with an audit trail to show the examiner. If two people won’t give up Apple Mail, put those two on MDM and leave everyone else alone. It’s OK to mix and match.
Whether you do MDM or MAM, turn on and test the wipe first, with no other settings. You can always add controls later. It’s a lot harder to take them back once people are upset.
Then tell your staff what you did, in plain English, before it’s enforced. Show them the console if you have to. And run one wipe on purpose, on a phone that isn’t lost, so the first time you do it isn’t the day it matters.
If your IT provider quoted something that doesn’t sound like what you read here, send it our way. That’s where our Virtual CISOs help the most: we guide your IT provider to keep you as safe as possible.
