Managing staff laptops and phones: Intune, BYOD and lost devices for SA small businesses and councils

Every laptop and phone that opens work email or files is part of your organisation’s security, whether you bought it or a staff member did. In many South Australian small businesses, not-for-profits and councils, devices were set up one at a time, nobody is quite sure which ones are encrypted, and a lost phone means a worried phone call rather than a clear process. Device management fixes that. This guide explains, in plain words, how to manage company laptops, how to handle staff using their own phones, and what to do when a device goes missing. It is general guidance, not legal advice.

What device management actually does

A device management tool lets you set up, secure and check staff devices centrally instead of by hand. For most organisations on Microsoft 365 that tool is Microsoft Intune, which is included in Microsoft 365 Business Premium and in many enterprise plans. Other tools exist for Apple-only or mixed fleets, and the principles below apply to them too. Done well, device management lets you:

• Set up new devices consistently, with your standard apps, settings and security from the first sign-in.
• Keep devices patched, with operating system and application updates applied on a schedule you control.
• Encrypt every laptop, using BitLocker on Windows and FileVault on Mac, with recovery keys stored centrally rather than on a sticky note.
• Check compliance before access, so only devices that are encrypted, up to date and protected can open work email and files.
• Protect work data on personal phones without taking control of the whole phone.
• Lock or wipe a lost device, or remove only the work data when someone leaves.

Company laptops: enrol them properly

Laptops that hold work files should be owned and fully managed by the organisation. A sensible baseline is:

• Zero-touch setup. Windows Autopilot for Windows PCs, and Apple Business Manager with automated enrolment for Macs, let a new device arrive in its box, connect to the internet and set itself up with your policies when the staff member signs in. Ask your reseller to register new devices to your organisation when you buy them.
• Disk encryption on, recovery keys escrowed. A lost encrypted laptop is an inconvenience. A lost unencrypted laptop holding customer or resident records can be a privacy incident.
• Automatic updates with deadlines. Update rings for Windows and managed updates for macOS, so devices are not left months behind. Windows 10 reached end of support in October 2025, so any remaining Windows 10 PCs need replacing, upgrading or enrolling in paid extended security updates.
• Endpoint protection and a firewall, centrally reported, so you can see which devices have an issue.
• No local administrator rights for everyday use. Staff sign in as standard users, and admin rights are granted only when needed.
• A screen lock and sign-in with Windows Hello or Touch ID, so the device is not usable by whoever picks it up.

These settings line up with several of the ACSC Essential Eight mitigation strategies, including patching applications and operating systems, restricting administrative privileges and hardening user applications. Our guide to the Essential Eight for SA SMEs doing government work explains how they fit together.

Staff phones and BYOD

Phones are where most organisations need a clear decision, because many staff use their own phone for work email and Teams. There are two main approaches:

Approach	How it works	Best for
Company-owned, fully managed	The organisation owns the phone and enrols it (Apple automated enrolment or Android Enterprise fully managed). It can set apps, restrictions and passcode rules, and wipe the whole device.	Roles handling sensitive information, shared or field devices, and staff who would rather not mix work and personal use.
Personal phone with app protection	The phone is not enrolled. Intune app protection policies protect work data inside Outlook, Teams, OneDrive and other managed apps: a PIN on the work apps, no copying work data into personal apps, and the ability to remove only the work data.	Most office staff using their own phone for email, chat and files.

A middle option on Android is a work profile, which keeps work apps in a separate, managed space on a personal phone. Whichever approach you choose, Conditional Access in Microsoft Entra ID can require either a compliant device or an approved app with app protection before email and files open. Our article on Zero Trust and Conditional Access covers how those rules are designed and tested.

Write a short, fair BYOD policy

Staff are far more comfortable with app protection when they know exactly what the organisation can and cannot do. A one-page policy should cover:

1. Which devices and operating system versions may be used for work, and which apps.
2. What the organisation can see and control. With app protection only, it manages the work apps and their data, not personal photos, messages or browsing.
3. What happens if the phone is lost, and that only work data is removed when someone leaves.
4. The staff member’s responsibilities: a screen lock, keeping the phone updated, and reporting a loss quickly.
5. Whether any allowance is paid for work use of a personal phone.
6. Who to contact for help, and how the policy is reviewed.

The Australian Signals Directorate publishes guidance on enterprise mobility and BYOD on cyber.gov.au, which is a useful reference when writing the policy. Check employment and privacy points with your HR or legal adviser.

When a device is lost or stolen

Agree the steps before you need them, and keep them somewhere staff can find them:

1. Report it straight away, to a named person or shared mailbox, any time of day.
2. Revoke sessions and reset the password for the user’s Microsoft 365 account, and check recent sign-ins.
3. Lock or wipe the device. Remotely lock or wipe a company device, or remove the work data from a personal phone with a selective wipe.
4. Check what was on it. Encryption status and the apps in use tell you whether personal information may have been exposed.
5. Assess privacy obligations. If personal information may have been accessed, follow your data breach response plan. Our guide to the Privacy Act and notifiable data breaches explains the assessment, and our cyber incident response plan guide covers who does what.
6. Record it and replace the device, then close the incident.

Joiners, leavers and shared devices

Device management works best as part of the staff lifecycle. A new starter receives a device that sets itself up on first sign-in, and a leaver’s company device is collected, wiped and reassigned while work data is removed from their personal phone. Our staff onboarding and offboarding IT checklist includes those steps. Shared devices, such as front counter PCs, depot tablets or field inspection phones, can be set up in a shared or kiosk mode with only the apps that job needs.

A practical 90-day plan

1. Weeks 1 to 2: inventory. List every device that accesses work data, who uses it, who owns it, its operating system and whether it is encrypted.
2. Weeks 3 to 4: decide and document. Choose the approach for laptops and phones, write the BYOD policy and agree the lost device steps.
3. Weeks 5 to 8: pilot. Enrol a small group of laptops, apply app protection to their phones and turn on Conditional Access in report-only mode to see what would be blocked.
4. Weeks 9 to 12: roll out and enforce. Enrol the remaining devices in batches, then switch the access rules on, with a clear support path for anyone who gets stuck.

Questions to ask your IT provider

1. Which of our devices are enrolled in device management, and which are not?
2. Are all our laptops encrypted, and where are the recovery keys kept?
3. How quickly are operating system and app updates applied, and how do we see which devices are behind?
4. Can a personal phone open work email without any protection today?
5. What happens, step by step, if a staff member loses their phone tonight?
6. Do any staff use a local administrator account for everyday work?

This article reflects common practice and published guidance as at late 2026. Microsoft licensing, Intune features and Apple and Android enrolment options change, so check current details with your provider before making changes.

Talk to an Adelaide team

If you are not sure which of your devices are managed or encrypted, talk to us about a device management review or call 0402 401 584. We can quote a short review that inventories your laptops and phones, checks encryption, updates and access rules, and gives you a BYOD policy and a rollout plan. You can also read about our managed IT and cyber security and training and team consultations services, or explore the secure Microsoft 365 workplace reference architecture in our Learn section.