Accessing company email from a mobile phone and now often seen as an essential requirement, particularly as many roles now involve some remote working.  As employees connect their smartphones to corporate email systems it’s essential to have clear policies in place that protect sensitive data while supporting user flexibility.

The Risk of Mobile Access

Whether it’s a company-issued device or a personal phone, mobile access introduces potential vulnerabilities:

• Data Leakage: Confidential emails and attachments stored on personal phones can be exposed through unsecure apps or lost devices.
• Offboarding Exposure: If a departing employee retains email access on their personal phone, sensitive information remains at risk.
• Device Theft: Without safeguards, a stolen phone becomes an open door to your organization’s communications.

Quarantine: Your First Line of Defense

With Microsoft 365 Exchange ActiveSync, you can implement a quarantine policy that stops unknown devices from automatically syncing:

• Devices connecting for the first time are held in quarantine.
• IT administrators receive an alert and can decide whether to approve, block, or wipe the device.
• Users receive a message informing them that access is pending approval.

This gives you control over which devices access email before any data is delivered.

Managing Personal Devices

Allowing access from personal phones isn’t inherently insecure—but it requires policy discipline:

• Enforce encryption and lock screens via Exchange policies or Microsoft Intune.
• Use Conditional Access to restrict usage to compliant devices only.
• Have a clear exit strategy for employees that includes remote access removal.

Depending on your setup, admins can:

• Remotely remove corporate email from the user’s phone (selective wipe)
• Erase the entire device (full wipe — supported only on certain platforms with user consent)

What You Can Do Today

1. Enable Quarantine in Exchange: Make sure new devices are held pending review.
2. Notify Users and Admins: Customize messages so users know what to expect and admins are prompted to act.
3. Define Personal Device Policy: Document and share your rules for bring-your-own-device access.

By proactively managing mobile email access, you reduce risk and maintain control over sensitive communications—while keeping your users productive wherever they are.