BYOD Policy Tips: Fixing the Common Barriers

Here's how most small businesses end up with a bring-your-own-device programme. Nobody decides to have one. Someone asks if they can get work email on their phone, someone else says "sure", and three years later twenty personal phones, two personal laptops and somebody's iPad are all signed into company email, Teams and the shared files.

That's a BYOD programme. It just doesn't have any rules.

BYOD makes a lot of sense for small businesses. Staff already carry a phone they like, nobody wants two, and buying devices for everyone costs real money. But the informal version has gaps you can drive a truck through. Here are the barriers that usually stop businesses formalising it, and how to get past each one.

Barrier 1: "I don't want IT seeing my personal stuff"

This is the big one, and it's a fair concern. Staff hear "device management" and picture IT reading their texts and scrolling their photos. If that's what they think is on offer, they'll resist, or quietly use workarounds.

The fix is to manage the work apps, not the whole device. With Microsoft Intune app protection policies, you can protect company data inside Outlook, Teams, OneDrive and the other Microsoft apps without enrolling the phone at all. The policy can require a PIN or biometric to open work apps, block copying company data into personal apps, and stop files being saved to personal storage. The business never sees the photo gallery, the browsing history or the personal messages.

For staff who want a bit more separation, Android's work profile creates a separate, sandboxed space for work apps on a personal phone, and Apple offers a user enrolment option for personally owned iPhones that keeps work and personal data apart. Either way, put the "what we can and can't see" list in plain English in your policy. Being specific about what you can't see does more for adoption than any amount of reassurance.

Barrier 2: "What if a phone gets lost?"

Let's do the arithmetic. With twenty staff each carrying a phone for, say, three years, that's sixty phone-years of exposure to pubs, taxis, beaches and toddlers. Losing one or two in that time would be completely normal.

Without controls, a lost phone with an unlocked Outlook app is a potential data breach, and if personal information is involved it may need to be assessed under the OAIC's Notifiable Data Breaches scheme. With app protection in place, it's an inconvenience. The work apps are locked behind their own PIN, and you can run a selective wipe that removes company data from the managed apps while leaving the owner's photos, contacts and apps untouched. Staff are much happier to report a lost phone quickly when they know you won't erase their whole life.

Barrier 3: devices of every age and condition

Personal devices come in every state imaginable. Some are current; some are a five-year-old Android that stopped receiving security updates two years ago. You can't patch a phone you don't own, but you can refuse to let an unsafe one in.

Set minimum requirements and enforce them automatically:

• A screen lock is mandatory.
• The operating system must be a supported version still receiving security updates.
• No jailbroken or rooted devices.
• Access only through approved apps (Outlook rather than the phone's built-in mail app, for example).

Microsoft Entra Conditional Access can check these before granting access, so a device that falls out of compliance simply loses access to work data until it's updated. Patching operating systems and applications are two of the ASD's Essential Eight, and this is how you apply them to hardware you don't own. Phones are targets in their own right; see our piece on mobile malware and what to do about it.

Barrier 4: offboarding

When someone leaves, the company laptop comes back. Their personal phone doesn't. If you have no way to remove company data from it, that phone walks out the door with your email history, your client files and possibly a logged-in session to your systems.

A good offboarding checklist for BYOD includes disabling the user's account, revoking active sessions, and running a selective wipe on any devices registered to them. With the right setup that takes minutes. Without it, you're relying on asking nicely.

Barrier 5: who pays?

Staff using their own devices are absorbing a cost on the business's behalf: the device, the data plan, the wear and tear. Some businesses pay a monthly allowance; others reimburse a portion of the phone bill. There's no single right answer, but it's worth comparing the numbers.

As an illustration: buying twenty business phones at $1,000 each is $20,000 upfront, plus plans and management, every three years or so. A $30-a-month allowance for twenty staff is $7,200 a year. Neither is automatically cheaper once you factor in plan costs and replacements. What matters is deciding deliberately, writing it down, and getting your accountant's view on the tax treatment.

Barrier 6: monitoring and the law

In NSW, the Workplace Surveillance Act 2005 says computer surveillance of an employee outside work is only allowed on equipment or resources the employer provided. That's another strong reason to manage the work apps and data rather than the device itself, and to say so in your policy. Our article on employee monitoring covers the notice requirements. This is general information, not legal advice.

Barrier 7: the policy goes stale

A BYOD policy written in 2021 probably doesn't mention AI apps, passkeys or the fact that your team now uses Teams on their personal laptops at home. Once staff spot one outdated rule, they assume the whole document is optional.

Review the policy once a year and when your systems change. Keep it short: what devices are allowed, minimum security, what the business can and can't see, what happens when a device is lost, what happens when someone leaves, and how costs are handled. That's about a page and a half. It should sit alongside your other core IT policies.

When BYOD isn't the right answer

BYOD works well for phones and for light access to email and documents. It works less well for laptops doing heavy, sensitive work. A personal laptop shared with family, running unknown software, is a poor place for your client database. For staff who do most of their work on a computer, a company-owned, managed laptop is usually worth the cost; see our checklist for securing company laptops at home. Some businesses use a mix: personal phones under app protection, company laptops under full management.

The right setup depends on the work, the data and the people. A managed IT partner can configure Intune, Conditional Access and selective wipe properly through Microsoft 365, so the policy you write is the policy the systems enforce.

Frequently asked questions

What should a BYOD policy include?

Which devices are allowed, minimum security requirements (screen lock, supported OS, no jailbreaking), which apps may be used for work, what the business can and can't see, what happens if a device is lost or the employee leaves, how costs are handled, and how to get support.

Can my employer wipe my personal phone?

With app protection policies, a business can remove company data from managed work apps (a selective wipe) without touching personal photos, messages or apps. A full device wipe is only possible on fully enrolled devices, which is why many BYOD programmes don't enrol personal phones at all.

How do you secure BYOD without device management?

Use app protection policies (such as Microsoft Intune's) to protect data inside work apps, require MFA, and use Conditional Access to block devices that don't meet minimum security requirements. The device itself stays unmanaged.

Is BYOD a good idea for small business?

Often yes for phones, provided work data is protected inside managed apps and the policy is clear. For laptops handling sensitive data, company-owned, managed devices are usually the safer choice.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want a BYOD setup your staff will actually accept? Talk to us — we'll protect your data on personal devices without touching anyone's personal life.