You have hired remote staff, possibly offshore contractors or a distributed team, and some of them work on their own laptops and phones. Shipping company devices to every country is slow and expensive, but letting client data sit on personal machines keeps your security lead awake. The question is how to protect company data when you do not own the device.
The practical answer: stop trying to secure the whole personal device and secure the company’s data and access instead. Give remote staff a managed virtual desktop or browser-based access for sensitive work, protect company apps on personal phones with app-level policies, require strong authentication and device health checks before access, and block downloads, printing and copying of sensitive data to personal storage. Issue company devices for roles with privileged access or regulated data.
Why personal devices are a different problem
You cannot fully control what else is installed, who else uses the device, whether it is patched, or what happens when the person leaves. NIST’s guide to enterprise telework, remote access and BYOD security (SP 800-46 Revision 2) recommends that all components, including organisation-issued and bring-your-own devices, be secured against expected threats, and that organisations plan remote access security based on threat models. For personal devices, the realistic goal is to keep company data inside a controlled boundary.
Three ways to draw the boundary
| Approach | How it works | Best for |
|---|---|---|
| Virtual desktop | Work happens in a hosted desktop; data stays in your environment | Access to sensitive systems, client data, regulated work |
| Browser-based access with controls | SaaS apps accessed through policies that limit downloads, copy and print | Mostly SaaS work, lighter tasks |
| App-level protection on phones | Company email and files in managed apps with their own PIN, encryption and copy restrictions | Email, chat and documents on personal mobiles |
For mobile, Microsoft documents that Intune app protection policies can protect company data at the app level on personal devices that are not enrolled in device management, for example requiring a PIN to open corporate email or preventing copy and paste into personal apps.
Controls that apply to every approach
- Phishing-resistant or strong multifactor authentication for every account.
- Conditional access that checks device and session risk before granting access.
- Least privilege: staff reach only the systems and data their role needs.
- Data loss prevention rules blocking downloads, uploads to personal cloud storage and printing of sensitive data.
- Session logging and alerts for unusual activity.
- Fast offboarding: access revoked the same day someone leaves, with company data wiped from managed apps.
When to issue a company device anyway
- Administrators, developers with production access, and security staff.
- Roles handling health, financial or government data with strict requirements.
- Client contracts that require company-managed endpoints.
- Work that needs local tools that cannot run in a virtual desktop.
Be clear with staff
People are more likely to accept controls on personal devices when they understand what the company can and cannot see. Publish a short policy explaining what is managed (company apps and data), what is not (personal photos, messages, browsing), and what happens at offboarding. Local privacy and employment laws may affect monitoring, so check before deploying.
A hypothetical example: a US company with a 30-person remote support team in the Philippines and India moves customer data access into virtual desktops, protects email and chat on personal phones with app policies, and issues laptops only to team leads with administrative access. Client audits pass without buying 30 laptops.
If your remote team sits far from where desktops are hosted, see how to reduce latency for offshore users on US virtual desktops, and for risk framing, modelling the access, not the geography.
Remote teams without leaky endpoints
Protecting data on devices you do not own is achievable with the right boundary and controls. AB7 Solutions’ cybersecurity and managed services teams design and implement remote access security, including virtual desktop deployments, Microsoft 365 conditional access and app protection policies, data loss prevention, MFA and offboarding processes, and our remote workforce teams operate within those controls. If company-issued devices are the simpler answer for your roles, we will tell you.
Tell us how many remote staff you have, what data they handle and which systems they use, and we will suggest the right access model.
Email: ab@ab7solutions.com | director@ab7solutions.com
Phone: +91 9878067778 | +1 321 341 7733
Website: www.ab7solutions.com
Sources: NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security; Microsoft Learn, Intune app protection policies.