BYOD App Policy: Which Personal Apps to Allow on Work Phones
A BYOD app policy has two halves. On the phones people own, you protect work data and leave personal apps alone. On phones the organization owns, you decide which personal apps are allowed at all.
This guide covers both, with the enrollment options that make each half work on iPhone and Android.
Work side
- Managed work apps
- Work email, files and chat
- Copy, paste and save rules
- Wipe of work data only
Personal side
- Personal apps and accounts
- Photos and messages
- Browsing and location
- Owner decides, always
MDM vs MAM for BYOD: the four options
There are four ways to bring a phone into scope. They differ in what IT controls and what the owner gives up, and they are not mutually exclusive across your fleet.
| Question | App protection only (MAM) | Android work profile on a personal phone | Apple User Enrollment | Full device enrollment |
|---|---|---|---|---|
| Who it suits | Personal phones that only need email, Teams and files | Personal Android phones that need work apps | Personal iPhones and iPads that need work apps, Wi-Fi or certificates | Company owned phones |
| Device enrolled? | No | Yes, work profile only | Yes, separate managed volume | Yes, whole device |
| Controls work data in apps | Yes | Yes | Yes | Yes |
| Can deploy work apps | No, users get apps from the store | Yes, into the work profile | Yes, into the managed volume | Yes |
| Sees personal app list | No | No, work profile apps only | No, managed volume only | Company owned: yes |
| Can block personal apps | No | No | No | Yes, supervised iOS and managed Android |
| Remove work data | Selective wipe of app data | Remove the work profile | Retire the enrollment | Retire or full wipe |
In Microsoft Intune, Apple User Enrollment through the Company Portal is deprecated for new devices. Account-driven User Enrollment, started from Settings, VPN and Device Management, needs iOS or iPadOS 15 or later.
What IT can and cannot see on a personal phone
This is the question employees ask first, so answer it in the policy itself. The lists below hold for app protection, Android work profile and Apple User Enrollment.
IT can see
- Which managed work apps are installed, and their versions
- Device model and operating system version
- Whether work policies are applied and compliant
- Work data inside managed apps, as it does on any work system
- On Android work profiles, system apps tied to the work profile
IT cannot see
- Personal apps, or the list of them
- Personal photos, messages, email or browsing
- On Apple User Enrollment: serial number, UDID, IMEI or phone number
- On Android 11 and later, work apps cannot read personal SMS or MMS
- Anything on the device after the work profile or enrollment is removed
Full device enrollment of a personal phone changes these answers, which is one reason to keep it for company owned devices. The shadow IT guide lists what Intune's app inventory collects for each enrollment type.
BYOD app restrictions on iPhone and Android
These are the controls that matter for apps on personal devices. Setting names are from Microsoft Intune. Other MDMs offer similar options, so check the current admin console for exact names.
iOS app protection policy for BYOD
Works on unenrolled iPhones and iPads with apps that support it, such as Outlook, Teams and the Microsoft 365 apps.
- Require a PIN or Face ID to open work data
- Restrict cut, copy and paste to managed apps
- Block saving copies of org data to personal storage
- Block managed apps on jailbroken devices
Android work profile controls
The work profile is a separate space with its own apps, marked with a briefcase icon and shown in a Work tab.
- Copy and paste between work and personal profiles: Block
- Data sharing between work and personal profiles: device default blocks work to personal
- Approve only the work apps the person needs
Apple User Enrollment limits
Work apps and data go on a separate managed volume. Supervision is not available.
- Per-app VPN only, no device-wide VPN
- No app block list and no app age rating limit
- Admin actions: retire, delete, remote lock and sync
On Android, app protection also needs the Company Portal app on the device, and Microsoft 365 apps need the device registered in Microsoft Entra ID. Guides: work profile app controls and blocking apps in Intune.
BYOD scenarios: which option fits
Five common situations and the setup that usually fits each one. Use them as a starting point for your own role map.
| Scenario | Recommended setup | Personal apps | Why |
|---|---|---|---|
| Teacher reading school email on a personal iPhone | App protection on Outlook and Teams | Untouched | No enrollment needed for mail and chat, and no device data shared. |
| Frontline worker with a personal Android phone | Android work profile with two or three work apps | Untouched | Work apps are delivered and wiped cleanly when the person leaves. |
| Contractor on a short project | App protection only, with a fixed end date | Untouched | Access ends with the account, nothing to unenroll. |
| Manager with a company iPhone | Automated Device Enrollment, supervised | Allowed except tier 3 | The organization owns the device and its risk. |
| Staff carrying one company Android phone | Company owned with work profile | Allowed in the personal profile, tier 3 removed | Separation for the person, control for the organization. |
A three tier BYOD app policy
Sort every app into one of three tiers. The tiers apply differently to personal and company owned phones, and that difference is the whole policy.
Required work apps
Installed and managed by IT, with app protection on.
- Email and calendar
- Chat and meetings
- Files and the approved AI assistant
Personal apps, owner's choice
On personal phones IT never touches these. On company phones they are allowed unless they fall in tier 3.
- Weather, maps, banking
- Personal social media on personal phones
Blocked on company phones
Blocked by category on supervised iPhones and managed Android devices only.
- VPN and proxy apps, remote access tools
- Gambling, dating and adult apps
- Apps banned by law or contract for your sector
Apps to block on work phones
For company owned phones, here is how organizations commonly treat the apps people ask about most. "Owner's choice" means the app is never IT's decision on a personal phone.
| App | iOS bundle ID | Android package | Company phone | Personal phone |
|---|---|---|---|---|
| TikTok | com.zhiliaoapp.musically | com.zhiliaoapp.musically | Often blocked and must be blocked on many government devices | Owner's choice |
| YouTube | com.google.ios.youtube | com.google.android.youtube | Review often allowed for training videos | Owner's choice |
com.burbn.instagram | com.instagram.android | Review allow for marketing teams | Owner's choice | |
| Snapchat | com.toyopagroup.picaboo | com.snapchat.android | Often blocked | Owner's choice |
net.whatsapp.WhatsApp | com.whatsapp | Review records rules apply to work chats | Owner's choice | |
| ChatGPT | com.openai.chat | com.openai.chatgpt | Review allow one approved assistant | Owner's choice, but keep work data out |
| Microsoft Teams | com.microsoft.skype.teams | com.microsoft.teams | Required | Managed app with app protection |
Government device rules for TikTok and similar apps are on the government device app bans page, and single app guides are on block TikTok and block the YouTube app.
Block personal apps on a work phone: iPhone and Android
When the organization owns the phone, blocking personal apps is normal and expected. How you do it depends on how the phone was enrolled.
Company iPhone
Enroll through Apple Business Manager or Apple School Manager so the phone is supervised.
- Add tier 3 bundle IDs to the blocked apps list in a restrictions profile
- Set a maximum app age rating
- Deliver work apps through volume purchasing instead of personal Apple Accounts
Fully managed Android
The whole phone is a work device with one managed Play store.
- Set "Allow access to all apps in Google Play store" to Block
- Approve the work apps and any personal apps you allow
- Apps installed from elsewhere are removed
Company owned with work profile
The phone is company owned, but has a personal profile for reasonable personal use.
- Keep the full Play store open on the personal side if you wish
- Assign tier 3 apps with an uninstall intent
- Those apps then cannot be used in the personal profile either
Ready lists for tier 3 start with the VPN and proxy apps list and the gambling apps list. For buying and assigning work apps, see Apple Business Manager apps.
"TikTok on work phone not working": why it happens
Help desks hear the same questions about Instagram, Snapchat and TikTok on work phones. The cause is nearly always one of these four.
The app is blocked on a company phone
On a supervised iPhone the app is hidden and cannot open. On managed Android it is missing from the store or uninstalled.
The store only shows approved apps
Fully managed Android phones can be limited to apps IT approved, so personal apps never appear.
The company network filters it
On office Wi-Fi or a company VPN, the app may load but fail to connect. On mobile data it may work.
It is installed in the work profile
A work profile copy of a personal app is a separate install. Use the personal copy for personal accounts.
BYOD app policy: sample clauses
Short clauses you can adapt. Have them reviewed for your country and sector before you publish them.
Scope
This policy covers personal phones and tablets used to access work email, files or apps, and company owned phones issued to staff.
Personal apps on personal devices
We do not view, install, remove or restrict personal apps on your own device. Our controls apply only to the work apps we manage.
Work data
Work data may only be opened, saved or shared in approved work apps. Copying work data into personal apps is blocked where the device allows it.
Company owned devices
On company owned devices, apps in the blocked categories listed in the appendix cannot be installed. Other apps may be installed for reasonable personal use.
Leaving the organization
When you leave, we remove the work profile or enrollment and the work data in managed apps. Personal data on your own device is not affected.
Requests
To request a new work app, use the app request form. We aim to reply within one business day.
Schools adapting this for staff and students can start from the student device acceptable use policy.
Rolling out a BYOD app policy in six steps
Most BYOD projects fail on communication, not configuration. This order puts the privacy answer in front of people before they are asked to enroll.
1. Map roles to devices
Which roles need only email and chat, which need work apps, and which get a company phone.
2. Pick one option per group
App protection for most, work profile or User Enrollment for app users, full enrollment for company phones.
3. Configure app protection first
It covers every group and works before any device is enrolled.
4. Publish the "can and cannot see" lists
Put them in the policy and in the enrollment screens, in plain words.
5. Pilot with one team
Collect the questions they ask, then fix the wording before a wider rollout.
6. Review tier 3 each month
New VPN, AI and gambling apps appear constantly. Import updated category lists rather than editing IDs.
Stipends, carrier bundles and BYOD
Paying for the line does not change what IT may control on the phone. App rules follow the enrollment type and who owns the device, not who pays the monthly bill.
Stipend or reimbursement
The phone is still personal. Use app protection or a work profile, and leave personal apps alone.
Company pays for the device
Consider making it company owned and enrolling it fully, with tier 3 apps blocked.
What to tell employees before they enroll
A one page note sent before enrollment answers most worries. Keep it to these five points.
Five points for the note
- Which option your role uses, and why
- Exactly what IT can and cannot see
- Which work apps will appear on the phone
- What happens to work data when you leave
- Who to ask, and how to request a new work app
Questions to expect
- Can you read my messages? No.
- Can you see my location? Not on a personal phone setup like these.
- Can you wipe my phone? Only work data.
- Will my apps be blocked? Not on your own phone.
- Can I say no? Then use a company device or web access.
BYOD apps: questions
MDM vs MAM for BYOD: which should I use?
For most personal phones, MAM is enough: app protection policies keep work data inside managed apps without enrolling the device. Add an Android work profile or Apple User Enrollment when you also need work apps, Wi-Fi or certificates. Full enrollment belongs on company owned phones.
Can I block personal apps on a BYOD phone?
Not on the personal side. An Android work profile controls only work apps, and Apple's bundle ID block list and app rating limit are not available on User Enrollment. On a personally owned phone, protect work data in managed apps instead. Blocking personal apps is for company owned phones.
Why is TikTok, Instagram or Snapchat not working on my work phone?
On a company owned phone, your employer has most likely blocked the app or the store, or filters it on the company network. On a personal phone with a work profile, the personal copy keeps working, while a work profile copy is a separate install. Ask IT what the policy allows.
What can my employer see on my personal phone?
With an Android work profile or Apple User Enrollment, IT sees the work apps and work data it manages, not your personal apps, photos, messages or browsing. Apple User Enrollment does not share the serial number or phone number either.
How do I choose MDM software for BYOD?
Look for capabilities rather than a brand: app protection without enrollment, Android work profile and Apple account-driven User Enrollment. Microsoft Intune, Jamf Pro, Omnissa Workspace ONE, Google Admin console and other major MDMs support some or all of these, so check current documentation.
Can I use YouTube on a work phone?
It depends on who owns the phone. On a personal phone, YouTube is your own app and IT does not control it. On a company phone, many organizations allow YouTube for training videos while others block it, so check your acceptable use policy or ask IT.
Block tier 3 apps on company phones by category
VPN, remote access, gambling, dating and more, as bundle ID and package lists and import files for Intune and Jamf, updated monthly.
Microsoft Intune, Microsoft Teams, Microsoft 365, Outlook and Microsoft Entra ID are trademarks of Microsoft Corporation. iPhone, iPad and Face ID are trademarks of Apple Inc. Android and Google Admin console are trademarks of Google LLC.
TikTok, YouTube, Instagram, Snapchat, WhatsApp, ChatGPT, Jamf Pro and Omnissa Workspace ONE are trademarks of their respective owners. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.