Small Business

Should Employees Use Personal Devices for Work?

November 4, 2026 · Jonanna Mason

Allow personal phones and computers only for approved work, through approved apps, and only while the device meets your security requirements. Keep administration, sensitive records, and jobs that store large amounts of data on the device on company equipment. This guide covers which work to allow, the minimum device requirements, app protection versus device enrollment, and what to do when a device is lost or an employee leaves.

Yes, for some work, on some devices, under conditions you set in advance. Let personal phones and computers reach company information only for tasks you have approved, only through apps you have approved, and only while the device meets your security requirements. Keep administration, sensitive records, and any job that stores large amounts of company data on the device itself on company-owned equipment.

The harder problem is that the decision usually gets made without anyone deciding. An employee adds the work mailbox to their phone so they can answer a customer after hours. Someone finishes a proposal on the family laptop at home. A new hire signs in to the accounting system from a tablet because it is what they have. Each step is reasonable on its own, and together they mean company data now lives on hardware the business does not own, did not configure, and may not know about.

That is fixable, but only once you treat it as a policy decision rather than a habit. The rest of this article walks through what to allow, what to require, and what to do when a device is lost or an employee leaves.

What BYOD Looks Like in a Small Business

Bring your own device, or BYOD, covers any personally owned phone, tablet, or computer used to reach company systems or information. In practice it tends to look like this:

The company mailbox and calendar set up on someone's own phone
A home laptop signed in to Microsoft 365 or Google Workspace
Video meetings and team chat joined from a personal tablet
Customer files opened, edited, or saved from a personal computer
Line-of-business tools such as the accounting package, CRM, or scheduling system reached from whatever device is at hand

The distinction that matters most is where the information ends up. Some access leaves the data in the cloud and shows the employee a view of it. Other access copies it onto the device as attachments, downloads, synced folders, or cached app data. The second kind is the one that needs controls, because that copy stays behind when the session ends.

Where a Personal Device Takes Control Away From You

On a company laptop, your IT provider decides what is installed, when updates run, and who can sign in. On an employee's own device, the employee makes those choices, and some of them will not line up with what the business needs. Device and app management tools can close part of that gap, but what they can enforce depends on the platform, the app, and how the device is enrolled.

Employee working from a cafe with a laptop and smartphone.

These are the gaps worth planning for:

Shared use:: A home computer or tablet is often used by a partner or children, sometimes under one shared login. The UK National Cyber Security Centre says that if an employee cannot follow your policy, for example because work cannot be separated from other family members using the device, BYOD access should not be permitted.
Update status:: You may have no reliable way to confirm that the device runs a supported operating system with current security updates. Storage shortages, app compatibility worries, and devices that are never restarted all delay updates.
Stray copies:: Downloads land in personal folders and get swept into personal cloud backups the business cannot see or manage. Opening a file in a personal app can make another copy.
Other apps:: Personal apps may hold permission to read files, contacts, or the clipboard, and the business usually has no list of what is installed.
Repairs:: A cracked phone or failed laptop may go to any repair shop with work email, saved sign-ins, and downloaded files still on it. The NCSC suggests wiping company data before a repair and having a plan for when that is not possible, such as a device that will not power on.
Departures:: Disabling an account stops future access to cloud services. It does nothing about files already copied to personal folders, unmanaged apps, or personal backups.

Match Access to the Work, Not to the Person

A single yes-or-no answer for everyone tends to fail in both directions. A more workable approach is to sort the work itself into three groups and decide where each group may happen.

Open to approved personal devices:: Reading and replying to email, calendars, meetings, and chat through apps your IT provider has approved and can protect.
Allowed only inside protected apps:: Viewing and editing company documents where the app can stop copies being saved to personal storage or pasted into personal apps, and where company data can be removed later.
Company device only:: Administrator and security tasks, bulk exports of customer data, financial and payroll records, health information, legal files, and any role that needs large amounts of data stored locally.

The NCSC is direct about the last group for administrators: users with privileged or administrative access should not have that level of access from a personal device, although they can still receive the standard access you permit for BYOD. The same thinking applies to anyone who manages user accounts, backups, firewalls, or line-of-business systems. A compromised personal laptop with administrator sessions open is a much larger problem than a compromised personal phone that can read email.

The NCSC also gives a useful example of splitting access inside one service. You might let staff submit expense reports from their own phones but not change bank details, or allow less sensitive folders in your file storage while blocking the most sensitive ones from personal devices.

Contractors and temporary staff belong in the same tiers. Scope their accounts to the systems the engagement actually needs, and give that access an end date when you create it.

Requirements a Personal Device Should Meet Before It Connects

Set these as conditions of access, not suggestions. Where your management tools can check them automatically, let the tools enforce them. Where they cannot, make them part of the written policy the employee accepts.

A smartphone and laptop being used in an office.

1. The operating system is still supported and receiving security updates. Older or unsupported versions are more likely to have weaknesses that will never be fixed, so block devices that cannot run a current version.
2. Updates install promptly, and the employee restarts the device when an update asks for it.
3. The device locks automatically when idle and needs a PIN, password, or biometric to open. The NCSC advises using a different password to unlock the device than the one used for company services.
4. Storage encryption is turned on, so a lost or stolen device does not hand over its contents. It has to be enabled before the loss, and it depends on a strong unlock PIN or password.
5. Multi-factor authentication protects every company account reached from the device. The NCSC describes MFA as a minimum requirement for BYOD.
6. The device is not jailbroken or rooted. Removing the operating system's built-in restrictions also removes protections that management tools depend on, and Microsoft Intune app protection policies include a setting to block managed apps on these devices. Detection is not perfect, so treat it as one control among several.
7. Work happens in the apps you have approved for email, files, chat, and line-of-business tasks, and nowhere else.
8. A computer that other people use has a separate account for the employee, and nobody else knows its password. If that separation is not possible, the device does not get access.

Two more points complete the list. Employees need to know exactly who to call if a device is lost, stolen, broken, replaced, or behaving as though it is infected, and they need to know it before it happens, because early reporting is what gives you time to act. And MFA protects the account, not the files already on the device. Encryption and protected apps cover that part.

App Protection Versus Device Enrollment

Most of the practical control over personal devices comes from one of two approaches, and they suit different situations.

Mobile device management, or MDM, enrolls the whole device. It can push settings, report whether the device meets your requirements, and in some enrollment types wipe the device completely. Microsoft's Intune planning guide notes that for organization-owned devices this can remove all data from the device, including personal data, which is exactly why it is a difficult thing to ask of an employee about their own phone.

Mobile application management, or MAM, protects company data inside specific apps instead of the whole device. In Microsoft Intune these are called app protection policies. Microsoft's documentation describes them as applying only when the app is used in a work context, so personal data is left alone. They can require a PIN to open work data, block saving company files to personal storage, restrict cut, copy, and paste into personal apps, and block managed apps on jailbroken or rooted devices. The planning guide places personal devices in this kind of app-level strategy and says a selective wipe is great for personal devices because it keeps personal data on the device and removes only organization data.

For Microsoft 365 customers, Conditional Access ties the two together. A policy can require that phones and tablets use an approved, protected app before they reach company email and files, so an employee cannot simply sign in from an unprotected mail app instead.

Know the limits before you rely on them. Microsoft's selective wipe documentation states that the user must open the app for the wipe to occur, and that the wipe may take up to 30 minutes after the request. A device that stays switched off, or an app that is never opened again, will not receive the command. Selective wipe also only reaches data the protected app controls. A file that already made it into an unmanaged app, a personal backup, or local storage the policy did not cover is outside its reach. That is why the device requirements above still matter even when app protection is in place.

Whichever approach you use, tell employees in writing what the business can see, change, lock, and remove on their device. Most people accept reasonable controls more readily when the boundary is clear.

Write the Policy Before You Grant Access

A short written policy, accepted before any company access is added, prevents most of the disputes that come up later. Each of these areas needs a clear answer:

Eligibility:: The roles and people allowed to use their own devices, and the tiers of work each may do.
Devices:: Permitted device types and the oldest operating system version you will accept.
Apps and files:: The approved apps for each task, and whether company files may be stored on the device at all.
Sharing:: Whether anyone else may use the device, and the separate-account rule if they do.
Visibility and control:: Exactly what the business or its IT provider can see, change, lock, or remove.
Loss, repair, and resale:: Who the employee notifies and what must happen first.
Role changes and exits:: How access is reduced or ended and how company data is removed.
Costs:: Who pays for mobile data, repairs, and replacements.

Employment, privacy, and data protection rules differ by location, and they affect what you may monitor on a device you do not own. Have the policy reviewed for every state or country where you employ people before you roll it out.

When a Device Goes Missing or an Employee Leaves

Both situations call for the same core response, so it helps to keep one checklist and run it either way.

1. Disable or restrict the account's access for that device, and revoke active sign-in sessions.
2. Send a selective wipe for company data in protected apps, and confirm later that it completed.
3. Take the device out of your device inventory and management console so it no longer counts as approved.
4. Review recent sign-in activity for anything unexpected, and reset credentials if they may have been exposed.
5. Note what company information the device could have held, so you can judge later whether the loss needs further action.

For a departure, add two steps. Agree with the employee how any company files on their own device will be returned or deleted, and remove work profiles, certificates, email accounts, and VPN settings where your tools support it. Our guide to why offboarding starts at onboarding covers the wider process.

When a Personal Device Is the Wrong Answer

Provide a company-owned device instead when any of these is true:

The job involves administrator rights or regulated and confidential records
The work only functions with large volumes of company data kept on the device
Other people use the device and work cannot be walled off from them
Security updates have ended for the operating system, or storage encryption is unavailable
The operating system's protections have been removed by jailbreaking or rooting
Your tools have no way to keep company data apart or take it back
The employee declines the controls the role requires

Company devices are also simpler to support, because their settings and installed software are known. The NCSC notes that BYOD adds its own costs: more device types and operating systems to support, patch, monitor, and investigate.

How Cyber One Solutions Can Help

Cyber One Solutions manages Microsoft Intune, Conditional Access, and MFA as part of our Microsoft 365 and cloud management, which is where the app protection, device compliance, and selective wipe controls in this article are configured. Our managed cybersecurity services add security monitoring and incident response. If you are starting from scratch, our earlier article on overcoming barriers to a smooth BYOD program covers the people and process side.

Frequently Asked Questions

Is browser-only access a safe middle ground?

It is simpler, not safer. The NCSC notes that browser access caches some data on the device and that no technical controls can reliably prevent data loss that way. Keep browser-only access to low-sensitivity work, and use Conditional Access to limit which devices and browsers are allowed.

We already require MFA. Isn't that enough?

No. MFA protects the sign-in. It does not protect files already stored on the device, stop copies being made, or patch an outdated operating system. You still need updates, a screen lock, encryption, approved apps, and a plan for lost devices.

What can the company see on an employee's phone?

That is set by how the phone is managed. With app protection only, the policies apply to company data inside the work apps and leave personal data untouched. Enrolling the whole device gives IT more device information and broader settings control. Spell out the specifics in writing before anyone enrolls.

Can we wipe an employee's entire phone?

Only if the phone is enrolled in device management, and even then it is rarely the right call. A full wipe returns the phone to factory settings and takes the employee's photos, messages, and apps with it. On employee-owned devices, a selective wipe of company data is the better tool where your platform supports it.

Does BYOD save money?

Sometimes. Savings on hardware can be offset by the extra management, setup, and support effort of handling many device types. The answer depends on how many roles qualify and how much of the work you allow on personal devices.

Sources and Further Reading

If employees already use their own devices for work, ask your IT provider what those devices can reach today and which of the controls above are actually in place. If you do not have an IT provider, contact Cyber One Solutions and we will help you sort it out.