How should an enterprise set up Intune for company and BYOD devices?

Two device populations, two management models

The setup EPC Group uses starts from ownership, because Microsoft Intune does. Intune supports mobile device management for personal devices, including personally owned phones, tablets and PCs, and for corporate-owned devices, and it offers more granular settings and stricter password options for devices classified as corporate-owned; devices that are Microsoft Entra registered are marked as personally owned (Microsoft Learn, Enrollment guide: Microsoft Intune enrollment, accessed 2026-10-20). That split drives every later decision. Corporate devices are enrolled, fully configured and held to device compliance policies. Personal devices are either enrolled with a lighter profile or left unenrolled and protected at the app layer. Microsoft Entra Conditional Access then decides, at sign-in, whether the device or the app meets the bar. EPC Group's Microsoft 365 consulting practice documents that split as a short device policy before any enrollment profile is created, so that users, HR and legal agree on which devices are managed and how.

Enrollment options by platform

Windows offers four routes: Windows automatic enrollment, Windows Autopilot, BYOD user enrollment and co-management with Configuration Manager. Autopilot is only for organization-owned devices and uses automatic enrollment, which requires Microsoft Entra ID P1 or P2 (Microsoft Learn, Enrollment guide: Enroll Windows client devices in Microsoft Intune, accessed 2026-10-20). Personal Windows devices can enroll by adding a work account, through the Company Portal app, or from a Microsoft 365 app sign-in; if both the MDM and MAM user scopes are enabled for a user, the MAM scope takes precedence and the device isn't enrolled (Microsoft Learn, Step 5 – Enroll devices in Microsoft Intune, accessed 2026-10-20).

Apple devices that the organization owns should use Automated Device Enrollment or Apple Configurator. Personal iPhones and iPads use device enrollment with the Company Portal, web-based device enrollment, or account driven user enrollment, which configures a specific set of features and organization apps, such as passcode, per-app VPN and Wi-Fi, and which Microsoft recommends combining with app protection policies. An Apple MDM push certificate is required for all of them (Microsoft Learn, Enrollment guide: Enroll Apple mobile devices in Microsoft Intune, accessed 2026-10-20). Android offers a personally owned work profile for BYOD and, for company devices, fully managed, dedicated and corporate-owned work profile modes, after the Intune account is connected to Managed Google Play (Microsoft Learn, Enrollment guide: Enroll Android devices in Microsoft Intune, accessed 2026-10-20). Android device administrator management is deprecated and no longer available for devices with Google Mobile Services (Microsoft Learn, Step 5 – Enroll devices in Microsoft Intune, accessed 2026-10-20).

Compliance policies and app protection policies

The two policy types answer different questions. A device compliance policy asks whether an enrolled device meets the security bar, and each one includes the action Mark device noncompliant with a default schedule of zero days, so Intune marks a failing device noncompliant immediately. Optional actions, such as an email to the user, a push notification, a remote lock or adding the device to the retire list, run on a schedule from 0 to 365 days, which is how a grace period is built (Microsoft Learn, Configure actions for noncompliant devices in Intune, accessed 2026-10-20). An app protection policy asks whether organization data inside an app is protected, whatever the state of the device. It can require a PIN to open an app in a work context, control sharing between apps and prevent saving organization data to personal storage, and it doesn't apply when the same app is used in a personal context. Policies can be targeted by device management state, for example a stricter policy for unenrolled devices than for managed ones (Microsoft Learn, App Protection Policies Overview, accessed 2026-10-20). Unenrolled devices have limits: apps can't be pushed to them, and certificate, Wi-Fi and VPN profiles can't be provisioned (Microsoft Learn, Step 2 - Add, Configure, and Protect Apps with Intune, accessed 2026-10-20).

Conditional Access as the enforcement point

Neither policy type blocks anything on its own; Conditional Access does. The grant controls include Require multifactor authentication, Require device to be marked as compliant, Require Microsoft Entra hybrid joined device, Require approved client app and Require app protection policy, and when several are selected the default is to require all of them unless the policy is set to require one (Microsoft Learn, Conditional Access: Grant, accessed 2026-10-20). Microsoft's compliant-device policy pattern targets all users and all resources, excludes emergency access accounts and directory synchronization accounts, starts in Report-only mode, and warns that it won't function without an Intune compliance policy; the control doesn't block Intune enrollment, so new devices can still enroll (Microsoft Learn, Require device compliance with Conditional Access, accessed 2026-10-20). EPC Group's Microsoft Entra ID practice usually deploys two policies: a compliant device for corporate platforms, and an app protection policy for iOS and Android personal devices.

Deploying and updating corporate apps

Apps reach devices through group assignments with one of four intents. Available for enrolled devices lists an app in the Company Portal; Available with or without enrollment serves users whose devices aren't enrolled; Required installs the app on devices in the group; and Uninstall removes an app that Intune previously installed. When a user or device sits in groups with conflicting intents, Intune resolves them by a published table (Microsoft Learn, Assign Apps to Groups With Microsoft Intune, accessed 2026-10-20). Intune reinstalls, updates or removes a required app within 24 hours rather than waiting for the seven-day re-evaluation cycle (Microsoft Learn, Add apps to Microsoft Intune, accessed 2026-10-20). For Apple devices, apps bought in volume through Apple Business Manager are synchronized with a location token, and new assignments default to device licensing (Microsoft Learn, How to Manage iOS and macOS Apps Purchased Through Apple Business Manager with Microsoft Intune, accessed 2026-10-20).

BYOD privacy: what IT can and cannot see

BYOD programs succeed when employees believe the privacy promise. Microsoft publishes the list. On an enrolled device the organization can never see calling and web browsing history, email and text messages, contacts, calendar, passwords, pictures, or the content of user-created documents; it can always see the device owner, name, serial number, model, manufacturer, operating system version and IMEI. On personal devices it sees only the last four digits of the phone number, can't view location, and sees the managed app inventory rather than every installed app (Microsoft Learn, What information can my organization see when I enroll my device?, accessed 2026-10-20). The Company Portal can carry a privacy statement URL and custom messages about what support can and cannot see (Microsoft Learn, How to Configure the Intune Company Portal Apps, Company Portal Website, and Intune App, accessed 2026-10-20). EPC Group publishes that text in the Company Portal before the first personal device enrolls.

Documented work

ANON-CASES: EPC Group engagement data for Intune deployments covers mid-size and large healthcare and legal organizations separating corporate-owned devices under compliance policies from personal phones under app protection policies, with Conditional Access enforcing both and a published BYOD privacy statement, delivered by the firm's Microsoft 365 consulting and Microsoft Defender practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.

Frequently Asked Questions

Talk to a senior architect

If personal phones in your organization reach email with no app protection policy, or corporate devices have no compliance policy behind Conditional Access, a 30-minute discovery call with a senior EPC Group architect sets out the enrollment profiles and policies to deploy first. See the Microsoft 365 consulting service hub for engagement structures.

Email contact@epcgroup.net or call 888-381-9725.

a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.