Skip to content

The BYOD Control Framework

How to secure, manage, and optimise access from employees’ personal devices at scale. A practical guide for IT, infrastructure, EUC and security leaders. Take control of your endpoint environment.

Speak to an endpoint specialist

About this guide

Employees may already be accessing company email and documents from their own phones and laptops before your organisation has made a formal bring your own device (BYOD) decision. That access can exist without controls to restrict downloads or remove work data if a device is lost or an employee leaves.

The central question is whether access to company data in Microsoft 365, including Exchange Online, SharePoint Online, Teams and OneDrive, serves a business need and can be controlled. The options depend on the device, application and Microsoft licences in place.

This guide sets out Virtual Engine’s seven-stage framework, starting with a challenge to the business case for personal-device access. The stages carry your organisation’s approved decisions into configuration, validation, rollout and handover, with platform differences and employee privacy considered throughout. The self-assessment helps your IT team check what your organisation can demonstrate today.

Before the framework: make the BYOD decision

Virtual Engine’s starting recommendation is a no-access default for personal-device access to company data in Microsoft 365 across phones, tablets and laptops. Keep new access blocked while your organisation establishes whether BYOD serves a clear business need and what controls and licences the proposed design requires. Where employees already rely on their own devices, identify the teams, tasks and routes in use before applying a block, then stage the agreed change to avoid disrupting work.

Define the approved use

Approve only the access each role needs. For example, a role may need protected access to email on a personal phone while having no approved route to download files to a personal laptop.

Record the recommended approach, approved decision, owner, exceptions and review date. For access already in use, decide which routes continue with controls, move to a corporate device or managed workspace, or end. Pilot and stage the agreed change.

01. Need

What work requires access from a personal device? Could a corporate device or a managed remote workspace meet the same need?

02. Users

Which user groups need it? Consider contractors, senior leaders and temporary users on the basis of their access and risk.

03. Devices

Which platforms are in scope? A phone, tablet and personal laptop may need different policies and offer different controls.

04. Resources

Which applications and data are required? Is viewing enough, or must users edit, save, share or download?

05. Controls

What restrictions are appropriate for each device, application and action? How will work data be protected if a device is lost or access ends?

06. Approval

Who accepts the remaining risk, approves the design and owns exceptions and future reviews?

Where BYOD control starts to break down

A policy or product setting can cover one access route while another remains untested. These are the assumptions Virtual Engine examines when it establishes what personal devices can reach and do with company data.

“We have MDM, so BYOD is covered.”

Mobile device management (MDM) can apply settings to an enrolled device. It does not establish what an employee can do in every application or browser session. Check the access and data movement allowed by each approved route.

“We have blocked personal phones.”

A phone policy may work as configured while a personal laptop or Chromebook can still reach the same resource. Test the device types and applications in use before concluding that the wider access is restricted.

“Work email is on the phone, so we can remove it.”

Consider a lost personal phone. Can IT remove work data from its protected apps, and what happens to copies saved outside them? Access to email alone does not answer either question. Confirm the configuration and test the removal process.

“BYOD must apply to everyone or no one.”

A senior leader asking for access to sensitive client files on a home laptop may be better served by a corporate device. Another role may only need protected email on a personal phone. Decide by task, data and device, then document who owns any exception.

The BYOD Control Framework

Virtual Engine’s seven-stage bring your own device (BYOD) framework shows how its endpoint team works with your IT team to control access to company data in Microsoft 365.

01. Discover

Establish current access and need. Virtual Engine reviews access rules, sign-ins, device registrations, applications, device types and Microsoft licences. It investigates uncertain routes and asks what work each use supports.

02. Design

Agree the permitted use. The team recommends which users, devices, applications, data and actions to permit or restrict. Your organisation signs off the design and exceptions before configuration.

03. Build

Configure the agreed controls. After sign-off, the team configures access and application policies for the agreed design, accounting for platform and app capabilities.

04. Validate

Test the design and gain IT acceptance. Tests cover approved and blocked sign-ins, data movement and selective removal where agreed. The team records results against the design for your IT team’s acceptance before the pilot.

05. Pilot

Check real workflows. Representative employees test the approved workflows. The team refines settings before wider deployment.

06. Deploy

Stage the rollout. Tested policies roll out in stages where existing use makes a sudden change disruptive. IT and support teams prepare employee guidance.

07. Handover

Prepare support and ongoing review. Your IT team receives approved decisions, configurations and test results. Virtual Engine confirms ownership of exceptions and future reviews, transfers knowledge and checks support readiness.

What good BYOD control looks like

The choices vary by users, devices, applications, data and risk. These principles describe what your organisation should be able to demonstrate once it has decided which personal-device access to permit.

The goal is to know what is happening and make deliberate, proportionate decisions about what the organisation will allow.

Visibility

You know where personal-device access exists and what corporate services those devices can reach.

Justification

Each permitted use has a documented business need and explicit approval.

Least-privilege access

Users are granted only the access and permissions necessary to perform their role and fulfil their business requirements.

Appropriate controls

Restrictions reflect the device, platform, application and sensitivity of the information involved.

Data separation

Corporate information can be protected without unnecessarily managing or exposing an employee’s personal information.

Governance

Decisions, exceptions and responsibilities are documented, approved and reviewable.

Ongoing control

Revisit approved routes and exceptions as roles, applications, devices and business needs change.

The platform changes the answer. Those principles take different forms across platforms.

01 – Supported mobile apps

On iOS and Android, app protection can apply an app PIN or limit movement of company data. Confirm that the chosen work app supports the policy.

02 – Personal Windows laptop

A different combination of browser, access and session controls may be needed. Test what users can view, save and download.

03 – Third-party application

Assess which controls the application supports. The same business objective may require a different technical route.

Protect company data and respect the personal device

Employees must understand what IT can see, manage and remove from personal devices. These boundaries depend on the chosen platform and applications and must be clearly communicated.

With suitable app protection, IT can remove company data without wiping personal devices. Removal may be delayed until the app reopens and may include synced work contacts. Policies must be tested, as data saved outside protected apps cannot be removed.

Microsoft Entra Conditional Access can enforce sign-in requirements, while Microsoft Defender for Cloud Apps can restrict downloads in supported web sessions. Controls must account for all data access routes, licensing and application support.

01 – Mobile Device Management (MDM)

The personal device is enrolled for management. IT can apply device settings and take actions permitted by the platform and enrolment method. Explain the scope of that management before asking employees to enrol.

02 – Mobile Application Management (MAM)

Intune app protection can apply policies to company data in supported apps without enrolling the personal device in MDM. For example, a policy can require an app PIN or limit movement of work data to personal apps.

How Virtual Engine helps

A useful BYOD review brings the access routes, business reasons and design choices together. Through its Endpoint Security & Compliance service, Virtual Engine works alongside your IT team to review current access, challenge proposed uses and set out options and recommendations for sign-off.

Once the design is agreed, Virtual Engine builds and tests the relevant controls, pilots them with users and supports deployment. Handover gives internal IT the decisions, configuration details and test results needed for future reviews.

Take control of your endpoint environment

Not sure which personal devices can access company data, or whether your existing controls are working as intended?

Start by downloading our BYOD Control Framework Checklist to assess how your environment measures up, identify potential gaps and understand where improvements may be needed.

For expert guidance on strengthening your BYOD security and governance, speak to a Virtual Engine endpoint specialist.

Speak to an endpoint specialist Download now

Send us a message

Use the form below and we’ll route your enquiry to the right person.