Business email, Teams messages, OneDrive files, CRM data — all accessible from staff smartphones that in most small businesses are completely unmanaged. No security policy. No remote wipe capability. No visibility when a device is lost, stolen, or compromised.
Ask most NZ small business owners whether their staff phones are managed, and the typical answer is: "No — they're personal devices." Follow up with: "Do staff access business email and files from those devices?" The answer is almost always yes. This combination — business data accessible on devices with no security controls — is one of the most common security gaps in NZ SMBs.
What Happens When a Staff Member Leaves — or Their Phone Is Stolen
A staff member resigns. They leave on good terms, hand in their laptop, and you disable their user account. But their personal phone — still logged into the company email app, Teams, and OneDrive — retains cached copies of business emails, files, and conversations. Without mobile device management, you have no way to remotely wipe that business data from their personal device.
The same issue applies to lost or stolen devices. A phone left in a taxi with no screen lock PIN, no encryption, and full access to business email is a data breach — customer information, financial data, confidential communications — all accessible to whoever finds it.
Managing Personal Devices Without Invasiveness
The reason most businesses don't manage staff personal devices is the concern that "managing" means controlling personal photos, apps, and data. This is a misunderstanding of what modern MDM tools do.
Microsoft Intune's Mobile Application Management (MAM) without enrollment — sometimes called "MAM-WE" — applies security controls specifically to business apps (Outlook, Teams, OneDrive) on personal devices without touching anything personal. The controls include: requiring a PIN to open business apps (separate from the phone's PIN), preventing copy-paste of business data into personal apps, requiring device encryption, and enabling selective wipe of business data without affecting personal content.
When a staff member leaves or a device is lost, the IT admin remotely wipes only the business data from the managed apps — emails, cached files, Teams messages — while leaving personal photos, apps, and data completely untouched.
What Optimyze Deploys for Mobile Security
For all managed IT clients, Optimyze configures Microsoft Intune App Protection Policies covering iOS and Android devices. Staff are directed to install the Intune Company Portal app and the managed versions of Outlook and Teams. The configuration process takes five minutes on a personal device. From that point, business data on the device is protected, and IT has remote wipe capability over business content if needed.
For company-owned devices, full device management is configured — including device encryption enforcement, screen lock requirements, and OS version compliance policies that block access to business resources if the device is running an outdated or compromised operating system.
A phone with unmanaged access to business email and files is a business endpoint without business security. Intune MAM brings the necessary controls to personal devices without the privacy concerns that make staff resistant to full device management.
