Mobile Device Management options included with Microsoft 365

Andrew Serene - President, IT Director

by Andrew Serene
October 2020

Office 365 includes mobile device management capabilities built right into your existing subscriptions.  Combining those capabilities with well-defined policies can result in a resilient environment that can help protect your corporate data while safeguarding employee privacy with bring-your-own-device (BYOD).  You can read more about the basic mobility and security functionality of Office 365 here, but you may determine that you do not want to subject staff to additional security measures on their personal devices.  If that is the case, we recommend you implement an app-based approach to protecting company data on remote devices.

OPTION #1 – The app-based approach to protecting company data on mobile devices

If keeping company data separated is important while allowing staff to use their personal devices as they prefer without the perception or fears of monitoring, we recommend implementing controls to prevent users from synchronizing their email with any app other than the official Microsoft Outlook app for iOS and Android. 

Limiting user access to only the Microsoft provided applications will allow you to ensure company data is protected when synchronized to the user’s device.  Forcing users to use the Microsoft Outlook app for iOS and Android to synchronize email, calendars, and contacts will provide the following benefits:


To effectively take advantage of these features, we recommend the following steps be taken:

STEP 1 - Block POP3 and IMAP access to mailboxes. 

STEP 2 – Create application consent policies to only allow trusted app access.


In addition to the Microsoft Outlook app, we recommend limiting File access to the Microsoft OneDrive, SharePoint and Teams apps for Android and iOS in addition to preventing file synchronization with other operating systems.

To effectively take advantage of these features, we recommend the following steps be taken:

OPTION #2 – Implementing Microsoft 365 mobile device management

You can also take things a step further and apply company policies to the entire device by enabling the Basic Mobility and Security features in your Microsoft 365 tenant.  These features are licensed as part of your existing subscription and do not require any additional licensing payments to Microsoft.  If you choose to go this route, Android and iOS devices must install the Microsoft inTune Company Portal before being permitted to access email and company documents.  This will allow you to enforce additional policies on the devices themselves.  These additional policies include:

While requiring the installation of the Microsoft InTune Company Portal does not give the company immediate access to a device or allow the company access to personal data, some users may have concerns about privacy and the installation of another app on their personal device.  In some cases, it may make sense to require the inTune Company Portal only for users with corporate owned and provided devices or revert all users to the app-based control mechanisms above.


Additional References:

App-Based Control Mechanisms in Microsoft 365

Basic Mobile Security in Microsoft 365

Related Articles