Should Employees Use Personal Devices for Work?
It is common for a small business to let people check work email on their own phone or finish a document on a home laptop. It saves money and people like it. It also puts company information on personal devices you do not own, cannot inspect and cannot fully control. That is not a reason to forbid it, but it is a reason to decide on purpose.
What “bring your own device” covers
Bring your own device, often shortened to BYOD, means employees use personal phones, tablets or computers for work. It ranges from a quick email check to doing a full day’s work on a family computer. The more work happens on the device, the more you need to think about it.
What you cannot fully control on personal devices
- Updates. A personal phone or laptop may be months behind on security updates, or too old to receive them.
- Other people. A spouse, a child or a friend may use the same device or know its passcode.
- Where files end up. Work files can be saved to personal cloud storage, backed up to a personal account or sent to a personal email address, with no record of it.
- Other apps. Games, free utilities and browser extensions can read information on the device, and some are not trustworthy.
- Repairs and resale. A device sent for repair, traded in or sold may still hold company data.
- Leaving the company. When an employee leaves, there is no easy way to be sure work data is gone from their device.
Your options
Company devices only. The simplest and strongest approach: the business buys and manages the devices, so it can enforce updates, encryption and protection, and can lock or wipe a lost device. It costs more up front.
Personal devices with rules and technical limits. This works when the rules are backed by settings. For example, Microsoft’s Intune can apply app protection policies that protect work data inside approved apps on a personal phone, without taking over the whole device. It can require a PIN, restrict copying work data into personal apps, and wipe only the company data from those apps if the person leaves or the phone is lost. It does not require enrolling the personal device, though you cannot manage the rest of the device this way.
A mix. Many small businesses give laptops and desktops to everyone and allow personal phones for email and chat only, through protected apps.
What a sensible policy includes
Keep it to a page that people will actually read:
- Which devices and apps are allowed, and for what kinds of work.
- Minimum protection: a screen lock, device encryption, current operating system updates and no jailbroken or rooted devices.
- Where company data may live. Work files stay in approved company storage, not on the device or in personal cloud accounts.
- Sign-in protection: multi-factor authentication on every work account, ideally with an authenticator app or a passkey.
- Lost or stolen devices: report it right away so access can be cut off.
- Leaving the company: what is removed and who does it.
- Privacy. Be clear about what the business can and cannot see on a personal device. People accept rules more easily when they know you cannot read their personal messages or photos.
Mistakes to avoid
- Letting personal devices connect to everything, including file shares and admin tools.
- Having no way to remove access when someone leaves.
- Making a policy nobody follows because it is not enforced by any setting.
- Using text message codes as the only sign-in protection. See our post on moving beyond SMS codes.
For people who work from home, our post on home office security basics covers what they should do on their end.
Where we can help
Our Microsoft 365 support covers multi-factor authentication, access policies and device management, for example with Intune, and our managed IT services cover hardware purchasing and support if you decide to provide company devices. A free security review looks at who can get into your systems and how accounts and passwords are protected today.
Frequently asked questions
Is it safe to let employees use their own phones for email?
It can be, with protections in place: a screen lock, encryption, up-to-date software, multi-factor authentication and, ideally, a managed email app that keeps work data separate from personal apps and can be wiped if needed.
Can we require updates on personal devices?
You can set minimum requirements, such as a recent operating system version, as a condition for accessing work apps. Tools such as Microsoft Intune can block access for devices that do not meet them. You cannot force updates on a device you do not manage.
What happens to company data when someone leaves?
With app protection policies, an administrator can wipe the company data from managed apps without touching personal data. Without them, you rely on the person to delete it, which is not reliable.
Is it cheaper to allow personal devices?
Often yes for phones, less clearly for computers. Add the cost of protection tools, support and the risk of a data loss before you decide, and compare with the cost of company-managed devices.
Do we need a written BYOD policy?
Yes. A one-page policy that people sign makes expectations clear and gives you a basis for acting if something goes wrong.
