Who actually needs a company phone?

“They’ve already got a phone” is a reasonable starting point. It does not settle whether that phone is suitable for the work.

A permanent site manager may need reliable access to several business applications throughout the day. A specialist subcontractor may need a particular set of documents for six weeks. A visiting consultant may need to review one item and send a response.

Issuing the same device arrangement to all three can create unnecessary cost or unnecessary work. Allowing everyone to use whatever they have brings a different set of decisions about support, information and responsibility.

The useful starting point is the job: which applications and information does the person need, who controls access, and what needs to happen when that work changes?

Three options to compare

A company-managed phone, controlled personal-device access and restricted access can all be appropriate. Choose an arrangement you can support and explain, including its limits.

“Restricted” is a design choice, not a product name. It might mean access to a specific folder, a limited application role or an invitation with an agreed end date. Browser use alone does not guarantee that downloads are prevented. Check the capabilities of the service and the configuration you actually use.

A permanent site manager

This and the following scenarios are illustrative, not customer case studies.

A permanent site manager needs daily Teams and SharePoint access, project applications, photographs and calls. The business also needs a clear replacement route when a device fails.

A managed company phone may be sensible where the role depends on a consistent device and support arrangement. Confirm the applications, working conditions and connectivity needs before choosing the handset and SIM. Ask what happens during a fault, who approves replacements and how spare or returned devices are handled.

Control still needs designing. Owning the handset does not automatically determine who can access a client’s portal, how a project application stores information or whether a particular download is appropriate.

A specialist joining for six weeks

A specialist subcontractor already has a phone supplied by their employer. They need access to a defined project folder and a client application for the duration of a package of work.

First establish which organisation provides each account and who can approve or withdraw access. Check the client application’s requirements. Decide whether limited access meets the task before considering another device.

The subcontractor’s employer may manage the phone. Your organisation should not assume it can enrol that device, install controls or remove information from it. If the proposed access cannot meet the work and information requirements, agree a different arrangement with the relevant owners.

Microsoft’s external-access guidance makes clear that B2B collaboration has specific control limitations, including the unsupported app-protection grant in its comparison. A guest-user arrangement needs its own design check. Microsoft external-access guidance.

A consultant visiting occasionally

A consultant needs to review a small set of information, add comments and return findings. Continuous access to the wider project workspace may add little value.

A limited application role or access to a specific location could be proportionate if the service supports it and the task can be completed properly. Confirm whether viewing is enough, whether the person needs to download or work offline, and where their response must be retained.

Name the business approver and the person who reviews or ends access. “Temporary” should mean an agreed process with an end point, rather than an invitation everybody hopes to remember later.

What controlled personal-device access involves

For suitable employee arrangements, Microsoft Intune app protection can apply controls to supported work applications without enrolling the whole device. The supported platform, application, licensing and policy configuration matter. Test the actual work, including moving information between apps, rather than assuming one policy covers every application in use. Microsoft app protection overview.

Explain the arrangement to the employee before asking them to use a personal device. State which work applications are covered, what the organisation manages, what support is available and what happens if the phone is lost or the person leaves. Refer them to the relevant management and privacy information for the chosen setup. Avoid broad assurances about what IT can or cannot see without checking that setup.

Consider the ordinary experience too. Can the person sign in reliably, find the right project and complete the work with the proposed restrictions? An arrangement that blocks a required task needs redesigning or an approved alternative. Treat that as part of the access decision, rather than leaving the user and service desk to negotiate it later.

Compare the whole cost

For each role, compare the costs the business will actually incur: device and SIM, relevant licences, provisioning, support, replacement and administration as people move between projects. Some will be fixed, others will depend on usage and your service agreement.

Personal devices do not remove every IT cost. Equally, an expensive handset does not establish that its access arrangement is well governed. Use the company’s own prices and support records; generic savings estimates will not tell you which option is best for a particular role.

Include the cost of an unusable arrangement. If a restriction prevents an essential project task, record that requirement and resolve it before treating the cheapest quoted option as the answer.

Be precise about removing work information

Ending access and removing data are different actions. Intune selective wipe can remove organisational data from supported protected apps, subject to the deployment and the action completing. It is not a universal remote eraser for a personal phone or every separately retained copy. Keep the action status and any remaining limitation visible. Microsoft selective-wipe guidance.

At a project transfer or departure, check the relevant accounts, permissions, work applications and device arrangement. A client-managed portal may require its administrator to act. The business also needs to decide which records must be retained and who takes over ongoing work.

Those responsibilities belong in the original access decision. They are harder to recover from an old email chain when the work has already finished.

Questions to settle before agreeing the setup

Use these fields with the project owner and the person responsible for IT. Record unknowns as actions, not assumptions.

Start with one role where a decision is actually needed. Complete the fields, test the required tasks and agree the arrangement with the relevant owners. Extend the approach to other roles once it works in practice.