Infrastructure
Tips for Overcoming Barriers to a Smooth BYOD Program
Personal phones and tablets are now everyday work devices. Learn how to run a secure BYOD program, from clear policies and business VoIP apps to app protection policies that secure company data without managing personal devices.
Bring your own device, or BYOD, took hold with the smartphone. Today, employees routinely read company email, join Teams meetings, and open shared files from their personal phones and tablets. Those devices are often the least protected endpoints with access to business data, because the company does not own or manage them.
BYOD differs from corporate-owned mobile programs. Instead of using company-issued devices, employees use their personal phones, tablets, and sometimes computers for work. Many businesses find this approach the most economical way to keep their teams productive, since purchasing devices and wireless plans for all staff is often out of reach financially.
You can run a BYOD program securely, but it requires putting the right practices in place. Too often, business owners do not have a clear picture of which personal devices are connecting to business data or what information may be stored on them.
Define Your BYOD Policy. If there are no defined rules for BYOD, the process cannot be expected to be secure. Employees may leave business data unprotected or connect to public Wi-Fi and expose their business credentials without realizing the risk. A formal policy protects the company from unnecessary exposure and can also address specifics like compensation for employees who use personal devices for work.
Keep Your Policy Current. A policy that becomes outdated loses relevance. If employees notice that one directive is stale, they may disregard the policy entirely. Review and update your BYOD policy regularly to reflect any changes that affect it.
Use VoIP Apps for Business Calls. Employees who work away from their desks often give customers their personal cell numbers. That creates problems when an employee leaves the company: customers keep calling a number the business no longer controls. A business VoIP phone system solves this. These services include mobile apps that allow employees to make and receive calls using a business number from any device, keeping personal numbers private.
Protect Company Data at the App Level. Many employees will not let their employer fully manage a personal phone, and they should not have to. App protection policies, sometimes called mobile application management (MAM), protect company data inside approved apps such as Outlook, Teams, and OneDrive without enrolling the whole device. With Microsoft Intune app protection policies, you can require a PIN or biometric to open work data, block copying company data into personal apps or personal storage, and remotely wipe only the company data when a phone is lost or an employee leaves, leaving personal photos and apps untouched. Pair those policies with Microsoft Entra Conditional Access so that email and files can be opened only in protected apps. Both are included in Microsoft 365 Business Premium.
Create Restrictions on Saved Company Data. Remote work has expanded the BYOD challenge beyond mobile phones to include personal computers. Personal computers are harder to protect with app policies alone, so many businesses allow browser-only access to Microsoft 365 from unmanaged computers and block downloads, or provide a managed laptop or a cloud desktop for anyone who works with sensitive data. Regardless of device type, restrict the types of data staff can store on personal devices.
Require Device Updates. Unpatched personal devices can expose your business data to attack. App protection policies can block access from devices running an outdated operating system or from jailbroken or rooted phones. For devices that employees agree to enroll, device management can enforce updates, encryption, and a screen lock.
Include BYOD in Your Offboarding Process. When an employee leaves your company, their personal device may still have access to business email, cloud platforms, and saved passwords. A thorough offboarding process should selectively wipe company data from their apps, revoke sign-in sessions, and remove the device from your network and accounts. Our guide to employee offboarding covers the full checklist.
Let Cyber One Solutions Help You Explore Endpoint Security.
Securing a BYOD program does not have to be complicated with the right tools in place. Cyber One Solutions helps businesses in Texas and Tennessee configure app protection, Conditional Access, and device management that protect company data while respecting employee privacy. Learn about our Microsoft 365 support or contact us to review how your team uses personal devices.