Mobile Device Security for Business: Protecting Work Phones

Why is mobile security so often overlooked?

Laptops and desktops get the attention — endpoint protection, patch management, encryption. Phones get far less, yet a modern smartphone holds the employee's email, authenticator apps, corporate contacts, document access, and often direct lines into finance and CRM systems. It is frequently a more sensitive device than the laptop, and far more likely to be lost or stolen.

Lost and stolen devices remain one of the most common causes of personal data breaches, a risk the National Cyber Security Centre flags repeatedly in its device guidance. A phone with no PIN, no encryption, and no remote-wipe capability is a direct liability for any UK business subject to UK GDPR. The fix is not exotic; it is management.

If your team carries company handsets, start by reading our business mobile services overview, which sets out how procurement, management and support fit together.

What threats do business mobiles actually face?

Mobile devices face a distinct threat set that desktop controls do not cover. The five that matter most for UK SMEs are physical loss, malicious apps, SMS and messaging phishing, unsecured Wi-Fi, and SIM swap fraud. Each has a practical, proportionate control — none require enterprise budgets.

• Physical loss and theft — the most common mobile incident. A handset left in a taxi or lifted from a café table is a direct data exposure unless it is encrypted and remotely wipeable.
• Malicious applications — apps sideloaded outside official stores, or legitimate-looking apps with embedded malware, can exfiltrate data, log keystrokes, or grant remote access.
• Smishing (SMS and messaging phishing) — credential-theft links delivered by text bypass email security controls entirely. Pair device controls with phishing protection across the business.
• Unsecured Wi-Fi — public networks expose any traffic not encrypted at the application layer. HTTPS covers most web traffic; poorly built apps remain the gap.
• SIM swap attacks — criminals convince a network operator to port a target's number to a SIM they control, intercepting SMS codes and defeating SMS-based MFA.

What is Mobile Device Management (MDM) and do I need it?

MDM is the foundation of a managed mobile programme. It is software that lets administrators enforce security policy across every enrolled phone and tablet — centrally, remotely, and verifiably. Any business whose staff reach corporate email or data from a phone needs some form of MDM. Without it, you cannot prove a lost device was secure.

A capable MDM platform — Microsoft Intune, Jamf, or VMware Workspace ONE — lets your IT team:

• Enforce PIN, passcode or biometric authentication
• Enable and verify full-device encryption
• Configure managed email, calendar and app access
• Apply application allow and block policies
• Remotely lock or wipe a lost, stolen, or ex-employee device
• Report on every device that drifts out of policy

Microsoft Intune is included in Microsoft 365 Business Premium — £16.90 per user per month (ex VAT, annual) — and manages both iOS and Android. For any organisation already inside Microsoft 365, Intune is usually the most cost-effective choice. See our mobile device management breakdown for how AMVIA configures it.

Corporate-owned or BYOD — which should you choose?

The choice between issuing company handsets and allowing Bring Your Own Device is part security, part culture. Corporate-owned devices can be fully managed with no compromise. BYOD cuts hardware cost but creates a hybrid device holding both personal and corporate data, which complicates security and raises legitimate privacy questions for staff.

Intune supports a middle path: a separate managed work profile on personal Android handsets, or supervised mode on corporate iOS. The work profile applies corporate policy and lets IT wipe only the corporate partition — never personal photos or messages. That respects privacy while protecting company data. Our BYOD security guide covers the policy side in detail.

How should mobile authentication be secured?

SMS codes texted to a phone beat no MFA, but they are vulnerable to SIM swap and interception. For business use, authenticator apps or hardware tokens give stronger MFA that does not depend on the phone number. Phishing-resistant MFA — FIDO2 passkeys or certificate-based auth — is the strongest option and is increasingly built into mobile operating systems.

For most UK SMEs, moving from SMS codes to Microsoft Authenticator with enforced MFA is a proportionate and significant upgrade. Deploy the same authenticator estate-wide through Microsoft Intune mobile so policy is consistent across every device, not left to individual users.

What belongs in a mobile device policy?

Technical controls work best behind a clear written policy. A good mobile policy covers acceptable use of corporate devices, the requirements for personal devices used for work, how to report a lost or stolen handset, and the basis on which IT may access or wipe a device. Staff should read and sign it before reaching corporate resources from a phone.

Policy and technology have to move together. A remote-wipe capability is only useful if employees know to report losses fast — pair the policy with a tested remote wipe and device security process so the response is immediate, not improvised.