Knowledge centre
Mobile device management for UAE businesses: BYOD, company devices and security.
MDM and MAM explained, BYOD versus company-owned devices, a practical baseline policy, lost-device steps, leavers and employee privacy.
Why phones and tablets need a policy
Most employees read company email, open documents and approve requests on a phone. That makes the phone a doorway to your data, whether the company bought it or the employee did. A lost handset with no screen lock and a signed-in mailbox is a data breach waiting to happen. Mobile device management gives the business a consistent, proportionate way to protect that data. This guide covers the concepts, the choice between personal and company devices, a sensible baseline and what to do when a device goes missing.
MDM and MAM in plain terms
Mobile device management (MDM) manages the whole device: it can enforce a screen lock, require encryption, push settings and apps, and wipe the device. Mobile application management (MAM) manages only the company apps and their data, leaving the rest of the phone alone. MAM is often the better fit for personal phones because the company can protect and remove its own data without touching photos, messages or personal apps. Many businesses use MDM for company devices and MAM for personal ones.
BYOD or company-owned devices
Neither model is automatically right. The decision turns on cost, control and privacy.
- BYOD (bring your own device) saves hardware spend and suits staff who only need email and chat. The company has less control, so protection is usually limited to the work apps.
- Company-owned devices give full control over settings, updates and removal, and suit staff handling sensitive data or working in the field. They cost more and need a supply and replacement process.
- Mixed models are common: company devices for managers and finance, BYOD with app protection for everyone else.
- Whatever you choose, write it down so staff know which applies to them.
A baseline policy that is practical
Aim for a short list of controls that nearly every device must meet.
- A screen lock with a PIN or biometric, and automatic locking after a short idle period.
- Device encryption switched on, which modern phones do by default when a lock is set.
- Operating system updates installed promptly, and devices that are too old to update blocked from company data.
- Remote wipe for company-owned devices, and selective wipe of company data for personal ones.
- Control over which apps can access company data, and company data kept inside approved apps.
- Multi-factor authentication on the account, so a stolen password is not enough. See our MFA rollout guide.
- Blocking of devices that are jailbroken or rooted, where your tooling can detect it.
Tooling, with Microsoft Intune as one example
Several products can do this job. Microsoft Intune is one example, and it is available within certain Microsoft 365 plans, so check your licences before buying anything separate. Whatever tool you pick, test it on a small group first, confirm which device types and operating systems it supports, and make sure someone owns the settings afterwards. Our Microsoft 365, Copilot and Defender page describes how device management fits with the rest of a Microsoft 365 tenant.
What to do when a device is lost
Agree the steps before anyone loses a phone, and make them easy to follow.
- Staff report the loss to IT straight away, by a route that works out of hours.
- IT locks the device, signs the user out of company accounts and revokes active sessions.
- If the device is company-owned, or the loss is serious, IT sends a remote wipe. For personal devices, only company data is removed.
- Change the user's password if there is any doubt, and check recent sign-in activity for anything unusual.
- Record the incident, and decide whether it triggers any notification duty. Take legal advice on that point; our UAE data protection guide gives background.
Leavers and offboarding
When someone leaves, remove company data from their devices on the same day access is withdrawn. Wipe a company device and recover it, or remove company apps and accounts from a personal one, and revoke any tokens or saved sign-ins. Tie this to your leaver checklist; the onboarding and offboarding checklist covers the wider steps.
Privacy and talking to employees
Employees are understandably cautious about management software on a personal phone. Explain in plain language what the company can see and what it cannot, for example that app protection does not read personal messages or browse photos. Put it in a short policy, ask staff to acknowledge it, and collect only what you need. If you are unsure what your monitoring and data-handling rules require, take legal advice before rolling anything out.
Where this fits in your wider security
Mobile controls are one part of the picture. Remote and hybrid working raises the same questions for laptops and home networks, which we cover in our guide to securing remote and hybrid work. If you want devices, identity and monitoring looked after together, see our managed cybersecurity and MDR service, or start with a free IT health check to see how your phones and laptops are managed today. Missan Global has supported UAE organisations since 2004.
Common questions
What is the difference between MDM and MAM?
MDM manages the whole device, including settings and wiping. MAM manages only the company apps and their data, which suits personal phones because the rest of the device is left alone.
Can we wipe an employee's personal phone?
Generally you should not need to. With app protection you can remove only company data. A full wipe is better kept for company-owned devices, and your policy should say so clearly.
Do we need Intune?
Not necessarily. It is one option and is included in some Microsoft 365 plans. Check your licences and your requirements, and compare options before deciding.
What if an employee loses a phone at night or at the weekend?
Give staff a reporting route that works out of hours, and make locking the device and revoking sessions the first step. The faster the sessions are revoked, the lower the exposure.
Do small businesses need mobile device management?
If staff read company email on phones, some control is wise. A small business can start with enforced screen locks, multi-factor authentication and the ability to remove company data, and grow from there.
Tell us what you need
A short note is enough. We reply within one business day.
Want your mobile devices reviewed?
Missan Global has supported UAE organisations since 2004. Tell us how staff use phones and tablets for work, and we will suggest a proportionate baseline.