Are users able to access email through a non-corporate (BYOD/personal) device?
A yes here is not automatically bad. An unconditional yes is, because it means corporate mail sits on devices you cannot see, patch, or wipe.
What the carrier is actually asking
The carrier is asking whether corporate mail can be reached from a device that the organisation does not manage: a personal phone, a home computer, a contractor's laptop. It is looking for whether that access is conditional, and whether data landing on those devices can be contained or removed.
Why it is underwritten
Unmanaged devices break two assumptions underwriting relies on. They may be unpatched or already compromised, and data that reaches them cannot be recovered or deleted when someone leaves. For organisations holding regulated data, the second point is the more expensive one, because it turns a departure into a potential unauthorised retention.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Entra ID makes this fully measurable, because device state is a condition in the same policy engine that governs authentication.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Entra ID | Conditional Access policies with device filters requiring compliant or hybrid-joined devices | Whether mail access requires a managed device, and for which populations |
| Entra ID | Conditional Access app control and session policies for unmanaged devices | Where unmanaged access is allowed, it is restricted to browser with download blocked rather than full client sync |
| Microsoft 365 | Intune app protection policies for Outlook mobile | Application-level protection requiring a PIN, preventing copy to unmanaged applications, and permitting selective wipe |
| Microsoft 365 | Exchange Online mobile device access rules and ActiveSync state | Legacy ActiveSync paths that bypass modern policy are disabled |
| Entra ID | Registered device inventory | The population of devices actually touching mail, which is the reality check against the policy |
Answering "yes, browser only, download blocked, application protection enforced with selective wipe" reads better to an underwriter than a bare no that a claims review might contradict by finding a single ActiveSync connection.
What a defensible yes requires
- Unmanaged access is a deliberate configuration rather than the absence of one.
- Where personal devices are allowed, application protection enforces a PIN, blocks transfer to unmanaged applications, and permits selective wipe.
- Browser access from unmanaged devices restricts download rather than permitting full sync.
- Legacy protocols that ignore device conditions are blocked.
- The device inventory is reviewed, so the actual population matches the intended policy.
How this answer goes wrong
Organisations answer no because there is no formal bring-your-own-device programme, while nothing in the tenant prevents an employee installing Outlook on a personal phone and signing in. Absence of a policy is not a control. The tenant either enforces a device condition or it does not, and it is easy to check which.
Frequently asked
Is allowing personal devices a problem for underwriting?
Not by itself. Nearly every organisation allows some unmanaged access. What matters is whether it is conditional and whether data on those devices can be removed.
Does app protection without full device management count?
Yes, and it is often the right design. Application-level protection containerises corporate data without managing the personal device, and it supports selective wipe on departure.
What about contractors?
Contractors are the population where this most often breaks down, because they arrive with their own equipment. Treat them as a named group in the policy rather than as an exception.
How does this connect to leaver processes?
Directly. If mail reached an unmanaged device and no application protection was in place, deprovisioning the account does not retrieve the data already synchronised.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture