Mobile devices in the company: MDM, BYOD and policies

In short: Mobile device management administers smartphones and tablets centrally; BYOD allows private devices but needs clear rules for separating company and private data.

In more detail: Smartphones have access to mail, cloud and customer data. MDM/EMM protects this data without stifling use. The choice between company devices and BYOD (bring your own device) is a trade-off between costs, security, privacy and convenience.

In Depth

Models

• COBO (company owned, business only): company device for work only: highest control.
• COPE (company owned, personally enabled): company device with permitted private use.
• BYOD: private device for work: cheap, but privacy and control are difficult.
• CYOD (choose your own device): selection from a company catalogue.
• Technically: work profile (Android Enterprise work profile), managed apps (app protection), user enrolment (iOS) separate business from private.

MDM functions

• Enrolment, configuration profiles (Wi-Fi, VPN, email, certificates).
• Security policies: screen lock/PIN, encryption, minimum OS version, jailbreak/root detection, app allow/deny list.
• App distribution (store apps, internal apps), updates.
• Remote lock and wipe (complete or only company data: selective wipe), locating devices (privacy-compliant, consent/works agreement).
• Compliance check (conditional access: non-compliant devices get no company data).
• Products: Microsoft Intune, Jamf, Workspace ONE, Android Enterprise, Apple Business Manager, open source (Headwind, MicroMDM).

Privacy and law with BYOD

• Separation of private and company data (container/profile), no reading of private content.
• Consent/agreement: what may the MDM see/do (location, app list)? Works council co-determination.
• Cost reimbursement (device, tariff), maintenance/loss (liability).
• Licence/terms of use of apps.
• Loss/theft: immediate report, remote wipe (company data only with BYOD).
• Offboarding: remove company data.
• Shadow IT: avoid private messengers/clouds with company data, offer secure alternatives.

Security tips and exam

• Lock + biometrics + updates, backup (encrypted), apps only from stores, check permissions, avoid public Wi-Fi/use VPN, Bluetooth/NFC off when not needed, know phishing/SMS fraud (smishing).
• For you: private phone security (lock, updates, Find My, backup) = same principles.
• IHK exam: distinguish COPE/BYOD/COBO, name MDM functions, justify privacy risks with BYOD, sketch a policy (acceptable use policy).

See also: User account lifecycle, VPN