A phone goes missing on a Friday night. On it: work email, the shared drive, the customer database app, and a saved password or two. Whether that is an inconvenience or an incident depends entirely on decisions made months earlier. Managing business mobiles properly is not complicated or expensive, and much of it you may already be paying for. Here is the short version.
The 30-second version
- The risk is the data, not the handset. The phone is replaceable; the email account is the problem.
- Basic controls do most of the work: a passcode, encryption, updates and the ability to wipe remotely.
- You may already own the tools. Device management is included in several common Microsoft 365 plans.
- Personal phones used for work need a plan too, and it should not involve wiping someone’s holiday photos.
- Write down who to ring when a phone goes missing, before it does.
On this page
What is actually at risk
A modern work phone is a key to everything, not a container for a few files. Email alone usually allows password resets for other systems, which is why a lost phone can matter far more than a lost laptop.
The good news is that the basics are genuinely effective. A phone with a passcode, up to date software and encryption enabled is a hard target. Without those, it is a filing cabinet with the key in the lock.
The five basics, in order
- A passcode or biometric on every device. Not optional, and it is the single biggest difference.
- Automatic updates turned on. Most real-world attacks use flaws that were fixed months ago.
- Encryption enabled. On modern iPhones and Android phones this is on by default once a passcode is set.
- A way to lock and wipe remotely, and somebody who knows how to use it.
- Know what is on there. Which accounts and apps a lost phone would give away.
What device management adds
Mobile device management, usually shortened to MDM, is a system that enrols the phones your business relies on so you can set rules and act on them centrally. In plain terms it lets you:
- Require a passcode and a current operating system before a phone can reach work email.
- Push the apps people need, and remove them when someone leaves.
- Separate work data from personal data on the same phone.
- Lock or wipe a device that has gone missing, or wipe only the work data.
- See which devices are enrolled, which are out of date, and which have quietly stopped checking in.
You may already own it
If you use Microsoft 365, device management is included in several of the business plans, including Business Premium. Many businesses are paying for it without knowing it exists. It is worth checking your licences before buying anything new.
Personal phones used for work
Most small businesses have at least some staff using their own phones. That is normal, and it needs a slightly different approach, because wiping a personal device is rarely reasonable or lawful.
The practical answer is to manage the work data rather than the phone. Work email and files sit inside a managed area that can be removed on its own, leaving personal photos and messages untouched. Staff should be told plainly, in writing, what the business can and cannot see or do on their device. That transparency is both fair and a data protection expectation.
It is also why company-owned phones are simpler where the role justifies them, and why SIM-only plans make company handsets more affordable than people assume.
A simple plan for a small business
- List the phones that reach work email or systems, including personal ones.
- Turn on the basics everywhere: passcode, updates, encryption.
- Check your existing licences for device management before buying a product.
- Enrol company phones, and manage work data only on personal ones.
- Write a half-page policy: what staff must do, what happens when a phone is lost, and who to ring.
- Test it once. Try a remote lock on a spare device so the first attempt is not during a real incident.
When a phone actually goes missing
- Ring us to bar the SIM, so nobody can run up calls or receive verification texts.
- Lock the device and use the built-in tracking to see if it is recoverable.
- Change passwords for anything that phone could reset, starting with email.
- Wipe it if it is not coming back, or wipe the work data on a personal phone.
- Record what happened. If personal data was exposed, decide whether it needs reporting, and take advice if you are unsure.
Not sure what your phones can access?
We supply the mobiles, and we will help you get the basics right: barring, replacements and a sensible plan for lost devices, alongside whatever device management you already own.