What’s a reasonable way to manage personal phones for work?

If the phone supports a separate work profile, that’s usually the clearest boundary. Keep company apps and data inside that managed space, and make the policy explicit about what IT can see, control, and remove. The exact capabilities vary by operating system and configuration, so confirm the details for each type of phone rather than promising the same separation everywhere.

For basic email access, keep management narrow: require a supported operating system and a screen lock, and protect company accounts and data. Avoid enrolling the whole personal phone if the work need is just a few apps. Before anyone signs up, give them a plain-language list of what information IT can view and what actions it can take if the phone is lost or access ends.

The least intrusive option may be not putting management software on personal phones at all. Provide work devices for roles that need stronger controls, and let personal phones stay personal. If BYOD is required, people should know the terms in advance, including any reimbursement and what happens when they leave.

Start with the actual access need. If employees only need general internet access, network separation can limit what a personal phone reaches without managing the phone itself. If they need company files or apps, use account-level controls and a dedicated work area where the platform supports it. Those are different problems, so one broad device policy may be more intrusive than necessary.

Don’t rely on vague assurances like “IT can’t see anything personal.” Publish the specific settings and remote actions, explain whether a selective work-data wipe is available, and have a process for questions or opting out. Some employees will still prefer a company phone, and that’s a reasonable alternative rather than a technical issue to argue away.