Answer the policy questions first
Decide whether personal devices are allowed, which devices and operating-system versions are acceptable, which apps staff should use and what will happen when a device is lost or a person leaves. Staff should understand the arrangement before connecting the device.
Choose the right level of management
- Company-owned device management
The business manages the whole device, including configuration, updates and security requirements. - App-level protection for personal devices
Work apps and business data follow defined rules without giving the organisation control over unrelated personal content. - Access conditions
The business can require suitable sign-in protection and supported software before allowing access.
Plan for the end, not only the start
Record how work access will be removed when the person leaves, changes role or replaces the device. Test the process before relying on it. The objective is to remove the organisation's data and access while respecting the employee's personal information.
Tide IT explains the difference between company and personal device controls on its Microsoft 365 and device management page.