Mobile application management and shadow AI: protecting company data without spying on staff

IT teams are being squeezed from two directions. On one side, staff are copying client emails and documents into personal AI apps on their own phones. On the other, those same staff will push back hard on anything that looks like their employer monitoring their personal device. 

Clamp down too hard and people find workarounds. Do nothing and company data walks out of the door one paste at a time. Mobile application management (MAM) is the way through. It protects company data inside work apps, stops it moving into personal ones, including AI tools, and leaves everything else on the phone alone. This article explains how it works and how to roll it out without a privacy backlash. 

Key takeaways 

• Shadow AI is now one of the easiest ways for company data to leave the business, and personal phones are where IT has the least visibility. 
• Monitoring personal devices is the wrong answer. It damages trust and pushes behaviour underground. 
• Mobile application management protects organisational data within supported apps such as Outlook and Teams. It can work with or without device enrolment, so personal phones do not need to be managed. 
• An Intune app protection policy can stop company data being pasted or saved into unmanaged apps, including personal AI tools. 
• IT cannot see personal photos, messages or apps under MAM, and saying so clearly is what makes staff accept it. 

The shadow AI problem on personal phones 

Staff are not waiting for permission to use AI. Microsoft and LinkedIn’s Work Trend Index found that 75% of knowledge workers already use AI at work and 78% of those users bring their own AI tools. A 2026 PagerDuty survey found that 51% of UK office professionals had entered work correspondence into public AI tools, and around a third of all respondents had entered customer data. 

On a company laptop, IT has options: web filtering, data loss prevention, approved app lists. On a personal phone, a member of staff can copy a client email from Outlook, switch to a personal AI app and paste it in, all in a few seconds. Nothing alerts anyone. Once the data is there, you cannot get it back. 

Most people doing this are not being careless. They are trying to work faster. That is why the answer has to make the safe route the easy one, rather than simply saying no. 

Why monitoring is the wrong answer 

It is tempting to respond by watching personal devices more closely. In practice, that tends to backfire. Some mobile device management tools require a personal phone to be fully enrolled, giving the organisation control over the whole device. Few people are comfortable with that, and BYOD privacy concerns are one of the main reasons staff resist controls. 

The NCSC warns that a poorly designed BYOD scheme can push staff towards workarounds, which increases risk rather than reducing it. Staff who feel watched forward emails to personal accounts, take screenshots or simply stop using the protected apps. The result is less security, not more. 

The way through is to separate the data from the device. That is exactly what mobile application management does. 

What is mobile application management? 

Mobile application management protects organisational data within supported apps, rather than applying controls to the whole device. It can work with or without device enrolment: on company devices it adds an extra layer around corporate data, and on personal phones it protects data without enrolling the device at all. Policies apply only when someone is using a work account inside a supported app. When the same person uses the same phone for anything else, the policies do not apply. 

As Microsoft puts it in its app protection policies overview, Intune applies policies only in a work context, which gives you the ability to protect company data without touching personal data. That one idea is what makes BYOD and privacy compatible. 

A MAM app is simply an app that supports these protections, such as Outlook, Teams, OneDrive, Word, Excel and Edge on iOS and Android. Users download them from the normal app store and sign in with their work account. The protection follows the account, not the phone. 

What mobile application management looks like day to day 

For the person holding the phone, MAM is almost invisible. Here is how it fits into an ordinary working life. 

• Day one: they install Outlook from the app store and sign in with their work account. Conditional Access checks the app is protected, and the policy applies automatically. There is no device enrolment and no management profile. 
• Every day: opening Outlook asks for a PIN or Face ID. Copying a client email into a personal app, or an AI assistant, simply does not work. Everything else on the phone behaves exactly as before. 
• A lost phone: IT issues a selective wipe. Company data is removed from work apps the next time they connect, while holiday photos and family messages are left untouched. 
• The last day: when the person leaves, the same selective wipe removes company email and files and their access is revoked. Nobody needs to ask them to delete anything. 

How MAM keeps company data out of personal AI apps 

An Intune app protection policy can stop company data leaving work apps in the ways shadow AI relies on: 

• Copy and paste: restrict cut, copy and paste so company data can only be pasted into other managed apps. Paste it into a personal AI app and nothing arrives. 
• Saving files: block “save as” to personal storage, so documents cannot be saved somewhere a personal AI tool can pick them up. 
• Sharing: limit sending and opening company data to managed apps, so attachments cannot be shared straight into a consumer AI service. 
• Access: require a PIN or biometric to open work apps, and block jailbroken or out of date devices. 

Meanwhile, the same person can use any AI app they like for their own life. MAM does not block the app. It blocks company data from reaching it. 

Give staff an approved alternative 

Blocking data transfer works best when staff have a safe option. Approved AI tools that sign in with work accounts and support your controls give people the speed they want without the risk. A clear AI clause in your BYOD policy then explains what is allowed and why. 

What IT can and cannot see with MAM 

This is the question staff ask most, so it is worth being precise. 

The exact details depend on your setup, so check what your reports show and describe it accurately in your policy. Honesty builds far more trust than vague reassurance. 

MAM vs MDM: which is right for personal devices? 

When it comes to MAM vs MDM for personal phones, the trade-off is control against privacy. MDM could force a PIN on someone’s entire phone. MAM puts a PIN on Outlook. Both close the gap, but only one asks the user to hand over control of their device. For senior leaders who hold the most sensitive information, a company-owned phone under full MDM is often the better answer. 

Setting up an Intune app protection policy 

In Intune, MAM is configured through app protection policies for iOS and Android. Each policy has three main areas: data protection, which controls how data can move; access requirements, such as a PIN or biometric; and conditional launch, which checks the device and app before allowing access. Microsoft’s data protection framework offers three levels of settings, from basic to high, which is a sensible starting point. 

MAM without enrollment is the standard approach for personal phones. For it to stick, Intune BYOD setups pair app protection with Conditional Access, which requires an app protection policy before personal devices are let in and blocks routes that bypass it, such as unprotected browsers. App protection only works with supported apps, mainly Microsoft 365 apps and some third party apps built or wrapped for Intune, so check every business app before rollout. 

Getting these layers to fit together is where most projects succeed or fail, which is why our BYOD Control Framework treats them as one design rather than separate settings. BYOD and mobile governance is a core part of our endpoint security and compliance service, and our endpoint management team keeps app protection policies current as apps and AI tools change. Our endpoint visibility and insight service shows which accounts and apps are protected, so you can prove control without monitoring people. 

How to explain MAM to staff 

The technology is only half the job. Before rollout, tell staff in plain language: 

• IT manages company data in work apps, not your phone 
• IT cannot see your personal photos, messages, browsing or apps 
• You can use any AI app you like, but company data stays in work apps 
• If you lose your phone or leave, only company data will be removed

Clear communication and careful testing make a real difference. When Burges Salmon moved its mobile device management to Microsoft Intune, the firm said Virtual Engine’s collaborative process gave its IT team confidence that the design met all the requirements, with the least impact on its people. 

Protect company data without crossing the line 

If shadow AI on personal phones is keeping you up at night, or BYOD privacy concerns have stalled your plans, Virtual Engine can help you design mobile application management that staff accept and auditors trust. Explore The BYOD Control Framework to see how to protect company data on personal devices without overstepping.