BYOD Boundaries in Practice: What the Desk Can and Cannot See

Wednesday, 12:30, in the kitchen at Stonebridge Insurance. Dani, an underwriter, has her own phone in one hand and a question she has been carrying since Monday. "My manager said that now I've got work email on this, IT can read all my messages. Can you?" Leo, who runs the desk and is holding a sandwich, knows the answer is no. He also realises, standing there, that he has never said out loud exactly what the desk can see on a personal phone. He realises that "no" on its own is not going to be enough for someone who has spent two days wondering.

BYOD boundaries in practice are the line between what the organisation can see and do on a personal phone that carries work, and what it cannot. They include the words the desk uses to explain the line to the person holding the phone. They also include the requests the line means the desk must decline. The policy itself, whether personal phones are allowed near work at all and on what terms, lives in BYOD and Personal Devices and is not redone here. This article is part of our Mobile Device Support series. It is about the practice: the kitchen conversation, the leaver's phone, and the manager who asks for something the desk cannot and should not give.

It covers the work-profile idea in plain words, then what the organisation can see, what it cannot see, and what it can do, and cannot. Next come the honest explanation to a worried user, the leaver's personal phone, and the request the desk must decline. Where the line blurs, a short war story and the BYOD explainer for users to copy finish the article.

The Work-Profile Idea in Plain Words

A work profile is a separate compartment on a personal phone that holds the work apps and their data. The simplest picture of it is a locked drawer in a room that belongs to someone else. The organisation holds the key to the drawer. It can see what is in the drawer, put things in it, take things out, and empty it altogether. It cannot see the room. The user's own apps, messages, photos and accounts are the room, and the organisation's reach stops at the edge of the drawer. That is the whole point of the arrangement. The user gets work mail on their own phone, and the organisation gets a compartment it can control without owning the phone.

There are other shapes, and the desk must know which shape its own organisation chose before it says a word in the kitchen. A personal phone enrolled whole, the way a company phone is, gives the organisation the room rather than the drawer. Most organisations should not want that on a device they do not own, nor should most users agree to it. A lighter shape manages only the work apps themselves, with no profile at all, and can see less than the drawer. The sentences in this article describe the drawer, which is the common shape for personal phones. Where the organisation chose something else, the explainer at the end says so in its first line.

Nothing in this article overrides the documentation for the management service the organisation actually runs. Read it, find the page that lists what an administrator can see on a personal device, and make the explainer say exactly that. A desk that says "nothing" when the truth is "almost nothing, and here is the almost" has told a comfortable lie. It will be found out by the first user who reads the documentation themselves. Most small-team help desks, QuerySolv included, have no device management of their own. The management profile is a separate service, and the help desk tool holds the ticket about the phone, not the phone.

What the Organisation Can See

In the common work-profile shape, the organisation can see that the phone exists and is enrolled. It can see its make, model and platform version, and the name the user gave it. It can see whether it has a passcode and whether its storage is encrypted. It can see whether the platform is out of date past whatever line the organisation drew. It can see whether the phone appears to have been altered to remove the platform's own protections. It can see whether the work profile is present and meets the rules, and which work apps are installed in the profile. It can also see when the phone last checked in with the management service. That is a compliance snapshot, taken so the organisation can decide whether the work apps may run on this phone today. It is not a feed, and it does not get more detailed by looking harder.

Some of that surprises users and should be said plainly rather than discovered. "We can see what kind of phone it is and whether it's up to date" is a sentence that reassures when the desk says it first and alarms when a user finds it in a settings screen. The table below sets the two columns side by side, in the words the desk would use to a user, for the common shape. The explainer at the end is where the organisation fills in its own.

What It Cannot See

The right-hand column is the one the user cares about, and it is honest in the common shape. Personal messages, photos, browsing, calls, contacts and personal apps are outside the drawer and invisible to the organisation. Work mail is visible, but not because of the phone. It is the organisation's mail on the organisation's servers, and it would be just as visible if the user read it on a laptop. The useful sentence for a user is that the organisation sees the work and the state of the phone, and nothing the user does as a private person. Location is the line that varies most between shapes and the one to check hardest. A company phone enrolled whole can often be located; a work profile on a personal phone usually cannot. The explainer must state the organisation's own answer rather than the common one.

Honesty here means precision. "We can't see anything" is false, because the compliance snapshot exists. "We can see everything" is false and is the sentence that was said to Dani. "We can see the work part and whether the phone is safe to put work on; we can't see your personal life on it" is true in the common shape and survives the user reading the documentation. If the organisation chose a shape that sees more, say so before the user enrols and not after. Consent given on a wrong description is not consent, and the user who finds out will tell the whole floor. The sentence "IT can see everything on your phone" has never once been said by IT.

What It Can Do, and Cannot

Seeing is one half; doing is the other, and users worry about both. In the common shape the organisation can require a passcode and encryption before the work apps run. It can require the platform to be reasonably up to date. It can put work apps into the profile and remove them. It can stop data being copied from a work app into a personal one. It can lock the work profile and remove the work profile entirely. Removal takes the work apps and their data with it and is sometimes called a selective wipe. Every one of those acts on the drawer. The organisation cannot wipe the whole phone, read or delete personal data, install anything outside the profile, or watch what the user does in the room.

One thing the organisation cannot do deserves its own sentence, because it reassures more than any other: it cannot stop the user removing the work profile themselves. The drawer is in the user's room, and the user can take it out whenever they like. The only consequence is that the work apps go with it and the desk sees a phone that is no longer enrolled. A user who knows this stops feeling that something has been done to their phone and starts feeling that they agreed to something they can undo. Tell them. It costs the organisation nothing, because a user who removes the profile has simply stopped reading work mail on that phone, which was always their choice.

The Honest Explanation to a Worried User

Three sentences, in this order: what we can see, what we cannot, and what happens at the end. "We can see that your phone exists and that the work part of it is set up safely, which means the kind of phone it is, whether it has a passcode and whether it's up to date. We can't see your messages, your photos, your browsing or anything else outside the work part, and we can't locate the phone. If you leave, or the phone is lost, we remove the work part and nothing else." The craft of saying a technical thing in three sentences is in The Three-Sentence Explanation, and this is that craft applied to the one question every BYOD user eventually asks.

Then offer the single most reassuring thing the desk can do: "would you like to see what I see?" Open the management service's page for their device and turn the screen round. The user sees a model name, a tick for the passcode, a date for the last check-in and a list of four work apps. The worry goes, because the screen is dull. Nothing the desk can say is as convincing as the dullness of that screen. Do it in the kitchen if the laptop is to hand; do it at the desk if not; do it before the user has to ask twice.

Never say "trust us", which is the sentence people say when they cannot show anything. Never say "nothing", for the reason above. Never over-promise about what the organisation will do with what it can see. "We only look at it when the work apps stop working" is a promise about behaviour. The explainer should make it in writing if the desk makes it out loud. And when the worry came from a manager who said the wrong thing, correct it gently with the user. Then send the explainer to the manager too, without blame, because managers repeat what they half-heard. This manager will be asked again by the next person in the team.

The Leaver's Personal Phone

On the leaver's last day the work profile is removed by the organisation from the management service. That is one line on the offboarding checklist and the first line that touches the phone. The disable-first order that line sits in is the subject of The Offboarding Checklist. The removal takes the work mail, the work calendar, the work files and any work apps in the profile, and leaves the room exactly as it was. The leaver keeps everything personal, which is the promise made on the day they enrolled and the one they are most relieved to see kept. Tell them in advance what will go and when, so that the disappearance of the mail app at five o'clock is expected and not alarming.

Two things catch desks out. Contacts that were synced from the work account live in the profile and go with it. A leaver who wants "their" contacts needs to hear, kindly, that the organisation's customer contacts were always the organisation's and that personal contacts were never in the profile to begin with. And the authenticator app, if it was installed on the personal side rather than in the profile, stays on the phone with the organisation's entry still in it. The entry is made useless by deregistering the phone as a second factor in the identity service, not by touching the app. That deregistration is on the same checklist. What happens to the mailbox itself, who may read it and for how long, is in The Leaver's Data and Mailbox, and the phone's part in it ends when the profile goes.

The leaver who refuses to cooperate changes nothing. The profile is removed remotely, the sessions are revoked in each service, the second factor is deregistered, and the password is reset. All of this is done from the organisation's side. There is no need for the phone to be handed over or the leaver to tap anything. The mechanics are the same as for a lost phone, and the order is set out in Lost and Stolen Devices. The only difference is the tone of the message, and even that is polite.

The Request the Desk Must Decline

The boundary exists so that the desk can say no to a short list of requests without arguing, and the list should be written down before the first one arrives. A manager asks to see what a team member has been sending from their personal phone. The organisation cannot see it, and would not go looking through the desk's tools if it could. The question belongs to HR and the owner of the policy, and the desk routes it there in writing. A manager asks for a personal phone to be located: no, in the common shape, and no through the desk in any shape. Someone asks for messages to be pulled from a leaver's personal phone before the profile goes. No, for the same reasons, and the request is logged. Someone asks for the work profile to be installed on a family member's phone so they can watch the user's calendar. No, because the profile is for the person whose account it is.

The decline is three sentences and none of them is "policy". "I can't, because the work profile doesn't give us that, and it isn't something the desk would do through its tools in any case. The person who owns that question is the HR lead, and I've sent it to her now with your reasons. In the meantime the leaver's work access is removed on the last day as usual." The shape of a no to someone with more authority than the technician is in Saying No Upward. The BYOD boundary is one of the rules that attracts those requests most, because the people asking do not know what the drawer is.

Investigations, where the organisation has a lawful reason to look at something, are run by HR, legal and the security function through their own processes and with their own evidence rules. They do not go through the desk's management console on a Wednesday afternoon because a team lead was worried. A technician who freelances an investigation, even a well-meant one, has made evidence unusable and a grievance certain. The desk's answer to "can you just have a look" is the same as its answer to every other request on this list, and it is a route, not a refusal.

Where the Line Blurs

The company phone used personally is the mirror image of this article and the one to say first. The organisation can see and wipe everything on a company phone, and the user's photos on it are at the user's risk. The handover message says that on day one and What the Desk Supports on a Phone explains it. Users who move from a company phone to a personal one, or back, carry the wrong assumptions with them, and the explainer should say which phone it is about at the top.

The drawer leaks when the user carries things out of it. A screenshot of a work message saved to personal photos is outside the organisation's sight and control. The profile may block the copying, or may not. The user should understand that the rule against it is a policy rule and not a technical certainty. A personal cloud backup of the phone should exclude the work profile's data, and in the common shape it does, but the desk checks its own documentation rather than assuming. And the messaging app the team quietly uses, installed on the personal side because it was convenient, is in the room, not the drawer. The organisation cannot see it, cannot manage it, and cannot remove it when someone leaves. That is the organisation's problem to solve by giving the team a work tool, not the user's for having been practical. (The user will be blamed first. Resist it.)

Where the line blurs, the desk's job is to describe the blur accurately rather than to pretend the line is sharp. "That's outside what we can see or manage, which means we also can't protect it; if the team needs it for work, let's get a work tool for it" is a sentence that respects the user, states the limit, and moves the problem to the place it can be fixed.

A Short War Story: The Afternoon in the Console at Kestrel Marketing

At Kestrel Marketing, a team lead called Noor asked the desk to "pull the messages" from a leaver's personal phone before his work profile was removed. She suspected Ben had taken client contacts with him. The technician, Arjun, said he would see what he could do. He spent an afternoon in the management console and found exactly what the common shape shows: a model name, a passcode tick and a list of work apps. He wrote a line in the offboarding ticket saying he had looked and found nothing. A colleague of Ben's with access to the ticket read the line and told Ben. Ben raised a grievance about being surveilled on his own phone. HR spent a week establishing that nothing had been seen because nothing could be, a finding that satisfied nobody. The cost was a week of HR, a leaver who left angry and said so, and a team lead who felt the desk had let her down. It also meant an all-staff explainer that Arjun wrote the following month and should have written the year before. A boundary you cannot explain in three sentences is one you will be asked to cross, and "I'll see what I can do" is the wrong first sentence every time.

The BYOD Explainer for Users

The explainer below is written for the user, not the desk. It is published as a knowledge base article visible to everyone rather than to agents only. It is linked from the setup guide so that it is read before the profile is accepted and not after the kitchen conversation. The first line names the shape the organisation uses and the date the page was checked against the management service's documentation. The page is only honest while that line is true. Fill in the organisation's own answers where the common shape differs, especially on location and on backups, and have the policy owner read it before it goes out.

WORK ON YOUR OWN PHONE — WHAT WE CAN AND CANNOT SEE
Our setup: a work profile (a separate work compartment on your phone)   Checked against the management service's documentation on: ________
Questions to: ______________________   Policy owner: ______________________

WHAT THE WORK PROFILE IS
  A separate compartment on your phone that holds the work apps and their data.
  We hold the key to that compartment and nothing else. You can remove it yourself at any time;
  the work apps go with it, and nothing of yours is touched.

WHAT WE CAN SEE
  [ ] That your phone is enrolled, what make and model it is, and what platform version it runs
  [ ] Whether it has a passcode and whether its storage is encrypted
  [ ] Whether it is up to date, and whether the platform's protections have been removed
  [ ] Which work apps are installed in the work profile, and when the phone last checked in
  [ ] Your work mail, calendar and files, which are on our servers whatever device you read them on

WHAT WE CANNOT SEE
  [ ] Your personal messages, in any app outside the work profile
  [ ] Your photos, videos, browsing, call history, contacts or calendar outside the work profile
  [ ] Which personal apps you have installed, or anything you do in them
  [ ] Where your phone is:  we cannot locate it  /  our setup can locate it, through: ______________

WHAT WE CAN DO
  [ ] Require a passcode and encryption before the work apps will run
  [ ] Require the phone to be reasonably up to date
  [ ] Add and remove work apps inside the work profile
  [ ] Stop work data being copied from a work app into a personal one
  [ ] Lock or remove the work profile, taking the work apps and their data with it

WHAT WE CANNOT DO
  [ ] Wipe your phone, delete your personal data, or install anything outside the work profile
  [ ] Read anything you do as a private person
  [ ] Stop you removing the work profile yourself

WHEN YOU LEAVE
  On your last day we remove the work profile from our side. Work mail, calendar, files and work contacts go.
  Everything personal stays exactly as it was.

IF YOUR PHONE IS LOST OR STOLEN
  Ring ______________ at once, any day. We remove the work profile and sign your work account out everywhere.
  Your personal data is not touched by us; use the phone's own tools for the rest.

IF YOU ARE WORRIED
  Ask the desk to show you the screen we see for your phone. It is a short and boring page.

Leo took Dani back to the desk, opened the management service's page for her phone and turned the screen round. She looked at a model name, a green tick and a list of four apps for about ten seconds and said "that's it?" That was it. He sent the explainer to her manager that afternoon, with a note that said only that a few people had asked. The manager replied to say he had not realised and would stop saying it. Dani set the work profile up on her new phone the following month without ringing anyone, which is the whole of what the desk wanted.

Frequently Asked Questions