MDM vs MAM for BYOD comes down to who owns the phone. On staff-owned phones, Intune MAM is usually the better fit: app protection policies keep work data inside Outlook, Teams and OneDrive without enrolling the device. MDM controls the whole device, so it suits phones, tablets and laptops the business owns. Key IT recommends Microsoft 365 Business Premium, which licenses both, plus the Conditional Access that enforces them.
What is the difference between MDM and MAM in Intune?
Mobile device management (MDM) means a phone, tablet or laptop is enrolled in Microsoft Intune and the business controls the device itself: settings, apps and, if it goes missing, a remote wipe. Mobile application management (MAM) leaves the device with its owner and manages only the company data inside apps. Intune delivers MAM through app protection policies, which Microsoft's app protection overview says work with or without enrolment and apply only when an app is used with a work account.
Microsoft's device guidance for Business Premium always recommends MDM for company-owned devices and says personal devices can use either. A middle path also exists: Apple's account-driven User Enrollment and the Android work profile create a separate work area that Intune manages, leaving the personal side to the owner.
How do MDM, personal enrolment and MAM compare?
| Question | MDM (full enrolment) | Personal enrolment (iPhone User Enrollment, Android work profile) | MAM (app protection, no enrolment) |
|---|---|---|---|
| What Intune controls | The whole device: settings, apps and compliance checks | A separate work volume (iPhone) or work profile (Android); the personal side is left alone | Work data inside protected apps such as Outlook, Teams, Word and OneDrive |
| Best fit | Phones, tablets and laptops the business buys | Staff phones that need office Wi-Fi, a VPN or work apps pushed to them | Staff phones used for email, Teams and files |
| Lost phone or departing staff member | Full factory reset, or retire to remove company data | Removing management erases the work side; personal photos and apps stay | Selective wipe removes work data from the apps; the apps themselves stay |
| What IT can see | On a company-owned phone: the full phone number, every installed app and a lost device's location | Model, serial number, operating system, the last four digits of the phone number and work apps; iPhone User Enrollment doesn't collect the serial number, IMEI or phone number | No device enrolment; policies act only on the work account inside protected apps |
| Wi-Fi, VPN and certificates | Yes | Yes, within the work side (on iPhone, VPN is per-app only) | No; Microsoft notes these aren't provisioned without enrolment |
What can the business see on a staff member's phone?
Less than many people assume. On any device enrolled in Intune, Microsoft's enrolment privacy page says the organisation can never see calling or browsing history, email and texts, contacts, calendars, passwords, photos or the content of documents a person creates. On a personal device it sees details like the model and serial number, only the last four digits of the phone number, no location, and the managed work apps, though Microsoft notes some configurations show more than the work apps. With Apple User Enrollment, Intune doesn't collect the serial number, IMEI, UDID or phone number at all.
MAM goes furthest: nothing is enrolled, and a personal account signed in to the same app is left untouched. Whichever route you take, put it in writing first; a one-page BYOD agreement covering what IT can see, what it can remove and what happens when someone leaves answers the questions staff will ask anyway.
What licences do you need for Intune MDM or MAM?
An Intune licence is needed for every user or device that benefits from the service, per Microsoft's Intune licensing page. Microsoft also advises pairing app protection with Conditional Access so policies are enforced, and Conditional Access comes with Microsoft Entra ID P1. Here is where each option sits, per Microsoft's Microsoft 365 for business security overview and Basic Mobility and Security comparison.
| Licence | Device management | App protection (MAM) | Conditional Access |
|---|---|---|---|
| Business Basic or Business Standard | Basic Mobility and Security, a limited, free subset of Intune | Not included | Not included (security defaults only) |
| Business Premium | Intune Plan 1 | Included | Included, through Entra ID P1 |
| Standalone Intune Plan 1 | Intune Plan 1 | Included | Needs Entra ID P1 as well |
Microsoft's Intune pricing page lists standalone Plan 1 at US$8 per user per month (a US list price) and notes it is included in Microsoft 365 E3 and E5. The Business plans cover up to 300 users. On Business Standard, price Intune plus Entra ID P1 against moving to Premium, which adds Defender for Business too; our side-by-side of Business Basic, Standard and Premium shows the gap.
Which should your business use? A decision guide by scenario
Staff check email, Teams and files on their own phones
Use MAM, enforced by Conditional Access. It suits a professional services firm whose consultants want client email on their own phones without handing the device to IT. Microsoft's suggested Business Premium settings block work data from iCloud backups, keep it within policy-managed apps and allow saved copies only in OneDrive and SharePoint.
The business owns the phones or tablets
Use MDM, so the device can be configured, locked or reset. A real estate agency might run both: agency tablets for open-home sign-ins under MDM, agents' own phones under MAM, with Intune applying a stricter app policy to the unenrolled phones.
Staff need Wi-Fi, a VPN or a business app on a personal phone
Use personal enrolment, and expect more set-up. Apple's account-driven User Enrollment needs iOS or iPadOS 15 or later, Managed Apple IDs (or federated sign-in through Apple Business) and a service-discovery file on your sign-in domain; the Android work profile needs a managed Google Play connection.
Contractors, casuals and short-term staff
Use MAM. When the engagement ends, a selective wipe removes work data from their apps, and there is no device to unenrol.
Staff work on personal laptops
App protection on Windows is still in preview and limited to Microsoft Edge, according to Microsoft's Conditional Access documentation. A cloud desktop through Azure Virtual Desktop can keep business files in Azure rather than on the laptop itself.
How does BYOD relate to the Essential Eight?
Three of the eight controls have a clear BYOD angle. On 15 October 2026 ASD published a successor, ASD Essentials, yet iTnews reports the Essential Eight remains on ASD's website alongside it for now (see what ASD Essentials changes, or our plain-English Essential Eight guide).
Multi-factor authentication
The phone is usually the second factor; Business Premium requires MFA with an authenticator app by default, and Microsoft's Essential Eight MFA guidance explains that codes typed in by hand can be phished, which is why Maturity Levels Two and Three call for cryptographic, phishing-resistant sign-in.
Patching operating systems
Under MAM, staff own their phone's updates, but app protection policies can warn or block when a phone's operating system is older than the minimum you set.
Regular backups
App protection can steer saved work files into OneDrive and SharePoint instead of the phone, where Key IT's Microsoft 365 service keeps a separate, immutable copy.
Several of the other controls are computer-centred. Microsoft's own Essential Eight application control guide is built on Windows tools such as AppLocker and Windows Defender Application Control, and its Office macro and user application hardening guides target Microsoft 365 Apps and browsers on Windows. For BYOD, the bigger Essential Eight question is usually personal laptops, not phones.
How do you set up MAM for staff-owned phones?
Write the rules first
Decide who may use a personal phone and for which apps.
Stop personal phones from enrolling
Microsoft notes that personal devices you protect with MAM can't also be enrolled, so block personal enrolment with device platform restrictions.
Create app protection policies for iPhone and Android
Target Microsoft's core apps; Microsoft describes its middle, enhanced protection level as applicable to most mobile users.
Enforce it with Conditional Access
Require an app protection policy for iOS and Android sign-ins, and block unknown platforms. Microsoft set 30 June 2026 as the retirement date for the older "Require approved client app" control, and its migration guidance says new policies should use only the app protection requirement.
Tell staff what to install
On Android, the Company Portal app must be on the phone to receive policies, and the phone registers with Microsoft Entra ID, even though it isn't enrolled. On iPhone, Microsoft Authenticator is the broker app Conditional Access relies on.
Plan the exit
Make a selective wipe part of offboarding, alongside disabling the account.
On Business Premium, Key IT's Microsoft 365 service enrols your laptops in Intune and hardens the tenant with MFA and Conditional Access, the same place a staff-phone policy is enforced, while managed cybersecurity adds Key IT's 24/7 SOC monitoring on top.
Frequently asked questions
Can my employer see my photos and messages if my phone is enrolled in Intune?
No. Microsoft states that an organisation can never see calling or browsing history, email and texts, contacts, calendars, passwords, photos or document content on an enrolled device. On a personal device it sees details such as the model and work apps, but not location. With MAM, nothing is enrolled at all.
Is MAM included in Microsoft 365 Business Standard?
No. Business Basic and Business Standard include Basic Mobility and Security, a limited MDM option without app protection policies, and neither includes Conditional Access. Business Premium includes Intune Plan 1 and Entra ID P1, which cover both. Key IT recommends Business Premium for most businesses because it bundles the device-management and security features small teams actually use.
Can IT wipe a staff member's personal phone?
Not under MAM. A selective wipe removes work data from protected apps and leaves everything personal in place; Microsoft notes a factory reset isn't possible with MAM. With Apple User Enrollment or an Android work profile, removing management erases only the work side. A full factory reset needs full MDM enrolment, which is why it belongs on business-owned devices.
Does MAM protect every app on the phone?
No. App protection policies only work in apps built with Microsoft's Intune SDK or wrapped with its App Wrapping Tool, such as Outlook, Teams and OneDrive. If staff rely on an industry app, such as a property CRM, check Microsoft's protected apps list or ask the vendor. If it isn't covered, personal enrolment can install it inside the separate work area instead, so it goes when the work side is removed.
Is MAM enough for the Essential Eight?
Not on its own. On phones, MAM and Conditional Access help with multi-factor authentication, current operating systems and backed-up work files. Application control and Office macro settings are aimed at computers, so laptops and servers still need their own work. Key IT measures where your business stands against the Essential Eight and plans the gaps.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review