The four Intune models to distinguish before discussing BYOD

The useful distinction is not simply between “personal” and “corporate”: it separates unmanaged access, MAM without enrolment, personal enrolment and management of an organisation-owned device. These models do not offer the same visibility, controls or user experience.

1. Unmanaged personal device

The user accesses resources through a browser or application without an Intune policy. This model may suit a public resource or a very limited requirement, but it provides no consistent mechanism to separate data, enforce a minimum version, remove business information or block certain operations. Multi-factor authentication remains necessary, but it does not control what happens to the data after sign-in.

2. MAM without device enrolment

Mobile application management, or MAM, applies policies to business applications and data without enrolling the device in full management. Microsoft documents this scenario as MAM for unenrolled devices. With compatible applications, the organisation can require an app passcode, restrict transfers to personal applications, control local saving and selectively remove business data.

3. Enrolled personal device

BYOD enrolment adds a level of device management or a separate work environment. Android Enterprise can create a distinct work profile; Apple provides enrolment modes suited to user-owned devices; Windows, macOS and Linux have their own scenarios. This model becomes useful when certificates, Wi-Fi or VPN configurations, applications need to be deployed, or when a broader security posture needs to be checked before access is granted.

4. Corporate device

Equipment purchased, prepared and managed by the organisation provides the highest level of standardisation. Depending on the platform, this may include Windows Autopilot, Apple Automated Device Enrollment, Android Enterprise in fully managed mode, COPE or dedicated devices. The organisation can enforce more policies, automate provisioning, maintain a more complete inventory and perform a wipe or reassignment according to its lifecycle.

This level of control is preferable for primary workstations, sensitive data, regulated roles, privileged users, complex local applications, shared devices or field equipment. The GVISION page dedicated to Microsoft Intune deployment and management remains the commercial page; this guide is intended to help choose the model before sizing the project.

BYOD, MAM, enrolment or corporate device: complete comparison

No model is the winner in every case: the level of management should remain proportionate to sensitivity, required functions and support responsibility.

Decide according to risk, not technological preference

The best starting point is a matrix combining data sensitivity, type of action, exposure, privileges, offline requirements and support capability. Device ownership then becomes a consequence of that requirement.

Start with the data. Occasional access to internal announcements does not carry the same risk as a medical record, administrator access, technical plans, school information, a customer portfolio or a payment system. Also consider what the user can do: read, modify, download, export, print, share or synchronise in bulk. Simple access can become a complete data extraction if the application allows it.

Platform differences change the choice

Never automatically transpose an iPhone policy to Android, Windows or macOS: each platform provides its own separation, enrolment and management modes.

iOS and iPadOS

For limited mobile BYOD use, app protection policies can avoid full enrolment. If the organisation needs to manage more settings, Apple User Enrollment is designed for personal devices with enhanced separation. An organisation-owned device integrated with Apple Business Manager or Apple School Manager and automatically enrolled provides supervision and more extensive controls. Always test the experience with the versions and applications actually in use.

Android Enterprise

The work profile on a personal device creates a visible separation between work and personal applications. Microsoft specifies that personal apps and data remain in another part of the device and are not affected by Intune. For organisation-owned equipment, options include fully managed devices, corporate-owned devices with a work profile and dedicated devices without a user. The Microsoft Android enrolment guide details the use cases and prerequisites for these modes.

Windows

A personal Windows PC requires particular caution. App protection policies without enrolment on Windows have a more limited scope than on iOS and Android; Microsoft documents, in particular, controls related to Edge in preview for certain scenarios. A primary workstation that runs local applications, handles offline files or requires encryption, patching and privilege controls will often justify an enrolled corporate device prepared with Autopilot.

BYOD, privacy and employment law in Belgium

A Belgian BYOD policy must protect organisational data while limiting and explaining the control exercised over the personal device. Technology does not remove the obligations relating to information, proportionality and governance.

The’Belgian Data Protection Authority explains that employers must ensure the protection of business data stored on a personal device, but cannot indiscriminately control all information on the device. It emphasises the isolation of business and personal data. This position favours the least intrusive level of control that meets the actual risk.

Write a clear policy before enrolment. It should cover eligible people and devices, authorised applications, IT visibility, mandatory settings, possible actions in the event of loss, selective removal, termination, support, any potential costs, minimum updates, personal backups and the complaint or query process. Involve HR, security, the DPO, legal and employee representatives where appropriate.

Microsoft publishes a page on data visibility after enrolment : the organisation cannot see call or browsing history, messages, contacts, calendars, passwords, photos or documents created by the user. Other device attributes may be visible, and the scope depends on ownership and mode. Incorporate this information into a notice specific to your configuration rather than vaguely stating that “IT cannot see anything”.

Connecting Intune, Entra ID and Conditional Access without blocking the organisation

Intune defines protection or compliance; Microsoft Entra Conditional Access then decides whether the context meets the access conditions. The two components must be designed and tested together.

For mobile BYOD using MAM, a policy can require a protected application to access Microsoft 365. Microsoft specifies that protection policies apply to compatible applications and that iOS and Android devices must first be registered with Entra ID for certain controls. For an enrolled device, another rule may require it to be marked as compliant. Conditions must take into account the relevant platforms, applications, accounts, locations and sign-in risks.

Avoid “all users, all applications, enabled immediately”. Microsoft recommends report-only mode before activating Conditional Access policies. Create a representative pilot group, exclude emergency access accounts according to a documented procedure and test both positive and negative scenarios: compliant device, outdated device, unsupported application, private browser, lost phone and new operating system version.

The GVISION page on Microsoft Entra and access management complements the Intune approach: device posture is only valuable if it actually influences access, and an access rule must provide for recovery. Document the dependencies between group, device filter, compliance policy, application policy and Conditional Access rule so that a denial can be understood without trial and error.

Deploy a mixed policy in eight steps

A good deployment starts small, documents decisions and expands controls after validating the user experience and support.

1. Take stock of uses. Catalogue user populations, devices, platforms, applications, data, offline access and current exceptions.
2. Classify risks. Assess sensitivity, privileges, volume, impact of a breach, sector-specific obligations and continuity requirements.
3. Choose a model by profile. Define MAM, personal enrolment, COPE or corporate device; explicitly prohibit incompatible scenarios.
4. Write the policy. Describe visibility, responsibilities, support, loss, removal, offboarding, updates and personal-use rules.
5. Configure the basics. Create application, compliance and enrolment policies, groups, filters, restrictions and administrative roles.
6. Test Conditional Access. Use report-only mode, validate emergency accounts and observe which applications are actually blocked.
7. Pilot with real business users. Include multiple platforms, profiles, network conditions and offboarding cases; measure tickets and enrolment time.
8. Expand and review. Roll out in waves, publish guides, train support and review thresholds after every major platform change.

Four Belgian scenarios for turning policy into decisions

The models become clear when you start from the actual work and the organisation’s responsibility.

Firm with mobile employees

Partners and employees access their calendars, email and Microsoft 365 files on their phones. MAM without enrolment can protect compatible applications and allow selective removal. Primary computers remain organisation-provided and managed because they store files, use local software and require full support. Administrators receive a stricter profile and a dedicated device.

School or non-profit organisation with volunteers and external contributors

Temporary staff need Teams and a document workspace without always requiring an organisation-provided device. The organisation can limit BYOD to protected applications, disable sensitive downloads and remove access at the end of the assignment. Shared classroom, reception or administrative workstations remain organisation-owned devices, managed according to their shared use.

Multi-site group and field teams

Corporate smartphones with a work profile or full management make it easier to distribute applications, certificates, Wi-Fi and VPN. For an employee who only checks a notification on a personal device, MAM may be sufficient. Dedicated devices used for inventory or signing should use an appropriate userless mode, with updates and replacement organised.

Healthcare provider or public service

Sensitivity, traceability and continuity often lead to organisation-provided devices being preferred for core tasks. Limited BYOD may remain possible for certain non-clinical communication flows, provided it is separated, tested and approved by governance. Lack of budget does not turn a personal device into a compliant solution; the access scope may need to be reduced or a virtual desktop provided.

Common mistakes in an Intune BYOD project

Most failures result from a uniform policy, late communication or Conditional Access being enabled before testing.

• Confusing MAM and MDM: users receive a promise of privacy that does not match the configured mode.
• Allowing everything after MFA: identity is better protected, but data may remain copied or synchronised without safeguards.
• Enrolling all personal devices: support and governance become disproportionate for a simple email requirement.
• Using a single profile: administrators, field workers, external users and standard roles do not have the same level of risk.
• Forgetting incompatible applications: the policy protects Outlook but leaves another application able to bypass the flow.
• Enabling Conditional Access without report-only mode: an incomplete setting blocks users, support staff and sometimes administrators.
• Ignoring offboarding: no procedure removes business data when an employee leaves or changes device.
• Promising that IT cannot see anything: the notice must describe visible attributes and vary according to the mode.
• Failing to fund support: the diversity of personal devices generates unanticipated support tickets.
• Treating BYOD as an automatic cost saving: licences, support, risks and operational time must be included.