Would work phones actually fix access from personal phones while abroad?

You’re right about the gap. If personal phones remain allowed by your access policies, handing out work phones doesn’t close that route. You would need a policy that distinguishes managed from unmanaged devices, or an app protection policy that limits what company data can do on personal phones.

Those are different choices. Device management can enforce broader settings on company-owned phones. App protection can protect work data within supported apps on personal devices, often without managing the whole personal device. Check which controls your organization actually has configured before treating either as a complete fix.

Think of location and device posture as separate gates. Location rules say where a sign-in is allowed from. A managed-device requirement says what kind of device may sign in. MFA adds another check, but it doesn’t turn an unmanaged phone into a managed one.

For laptops, a managed-device requirement and an always-on VPN may be part of the setup. Mobile access needs its own decision: managed company phone only, or personal devices with app protection and clear limits. Test the policies against each access path, including web access, rather than assuming the laptop rules cover mobile apps too.

A company phone can add security tools such as encryption enforcement, remote lock or wipe, and controls over work apps. That gives it value, but only if access is actually limited to that phone or the work data is otherwise protected on personal devices. Issuing equipment by itself doesn’t change who can sign in.

There’s a usability cost to blocking personal devices, so it’s worth deciding what staff need for their roles and communicating the change before enforcing it. A work profile or app-level controls may be a middle ground, depending on your systems and policies.

Also worth asking whether people should be working during vacation at all. If the arrangement is allowed, make it a defined exception with approved dates and locations, and be clear about what access is permitted. If it isn’t allowed, the cleanest control may be to deny access rather than build a special path around the normal rules.

For higher-risk travel, an organization might choose tighter restrictions or a limited-purpose device. That’s a policy decision, not something location checks alone settle.