Home/Questions/Access control and privilege/Email on personal devices
Access control and privilege

Are users able to access email through a non-corporate (BYOD/personal) device?

A yes here is not automatically bad. An unconditional yes is, because it means corporate mail sits on devices you cannot see, patch, or wipe.

Verifiable from your tenant

What the carrier is actually asking

The carrier is asking whether corporate mail can be reached from a device that the organisation does not manage: a personal phone, a home computer, a contractor's laptop. It is looking for whether that access is conditional, and whether data landing on those devices can be contained or removed.

Why it is underwritten

Unmanaged devices break two assumptions underwriting relies on. They may be unpatched or already compromised, and data that reaches them cannot be recovered or deleted when someone leaves. For organisations holding regulated data, the second point is the more expensive one, because it turns a departure into a potential unauthorised retention.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Entra ID makes this fully measurable, because device state is a condition in the same policy engine that governs authentication.

PlatformWhere the setting livesWhat has to be true
Entra IDConditional Access policies with device filters requiring compliant or hybrid-joined devicesWhether mail access requires a managed device, and for which populations
Entra IDConditional Access app control and session policies for unmanaged devicesWhere unmanaged access is allowed, it is restricted to browser with download blocked rather than full client sync
Microsoft 365Intune app protection policies for Outlook mobileApplication-level protection requiring a PIN, preventing copy to unmanaged applications, and permitting selective wipe
Microsoft 365Exchange Online mobile device access rules and ActiveSync stateLegacy ActiveSync paths that bypass modern policy are disabled
Entra IDRegistered device inventoryThe population of devices actually touching mail, which is the reality check against the policy
Conditional yes beats bare no

Answering "yes, browser only, download blocked, application protection enforced with selective wipe" reads better to an underwriter than a bare no that a claims review might contradict by finding a single ActiveSync connection.

What a defensible yes requires

  • Unmanaged access is a deliberate configuration rather than the absence of one.
  • Where personal devices are allowed, application protection enforces a PIN, blocks transfer to unmanaged applications, and permits selective wipe.
  • Browser access from unmanaged devices restricts download rather than permitting full sync.
  • Legacy protocols that ignore device conditions are blocked.
  • The device inventory is reviewed, so the actual population matches the intended policy.

How this answer goes wrong

Organisations answer no because there is no formal bring-your-own-device programme, while nothing in the tenant prevents an employee installing Outlook on a personal phone and signing in. Absence of a policy is not a control. The tenant either enforces a device condition or it does not, and it is easy to check which.

Frequently asked

Is allowing personal devices a problem for underwriting?

Not by itself. Nearly every organisation allows some unmanaged access. What matters is whether it is conditional and whether data on those devices can be removed.

Does app protection without full device management count?

Yes, and it is often the right design. Application-level protection containerises corporate data without managing the personal device, and it supports selective wipe on departure.

What about contractors?

Contractors are the population where this most often breaks down, because they arrive with their own equipment. Treat them as a named group in the policy rather than as an exception.

How does this connect to leaver processes?

Directly. If mail reached an unmanaged device and no application protection was in place, deprovisioning the account does not retrieve the data already synchronised.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture