The phone is the only device that gets left on a train
A laptop sits on a desk and travels in a bag. A phone goes everywhere, lies on a café table and holds work mail alongside holiday photos. That makes managing one a different trade from managing a workplace. This page says what we set on such a device, in what order, and where our boundary sits: at the subscription.
Why a phone cannot be managed like a laptop
Four properties a laptop does not have, all four of which call for a different approach.
- It gets lostThis is the only business device that routinely leaves the building and sometimes does not come back. Without management a lost phone is a lost mailbox; with management it is a device that gets locked and wiped remotely, and otherwise an annoying evening.
- Work and private both live on itA phone holds work mail next to private messages, and on a personal phone you may not simply wipe everything. With a work profile the work side sits apart: that can be wiped without touching the rest. That is not a nicety but the reason wiping a personal device is permitted at all.
- It is not replaced until it breaksA phone that still works stays in use, even when the manufacturer stopped sending security updates two years ago. You cannot see that on the device and it only shows up when something goes wrong. Management turns that end date into a list instead of a surprise.
- It comes out of the box at somebody’s homeA phone is rarely unboxed at the office. Without enrolment arranged up front it arrives unconfigured and somebody still has to set it up by hand, per device, over the phone.
Four steps, and the first decides the rest
The order is not free: whatever is not arranged at step one becomes manual work per device later.
Enrol at the source
At purchase the serial number is tied to your organisation, through Android Enterprise or Apple Business Manager. The device then reports in by itself the first time it is switched on and pulls down its configuration. The box can go straight to the employee and nobody has to touch it.
Put the work profile in place
Work apps and work data go into a separate profile, kept apart from what the user does on the device themselves. On a company-owned device that can sit tighter than on a personal one, and we settle that difference up front rather than case by case.
Set the policy
Screen lock, encryption, mandatory updates, which apps are allowed and which are not, and whether anything may be paired with an unmanaged device. One policy per type of user, rolled out from management, not twenty devices each doing something different.
Arrange who presses the button on a Sunday
Locking and wiping remotely is the easy half. The other half is agreeing who may do it, who is reachable and how long it takes. Without that agreement the button exists and nobody is standing beside it.
Devices, configuration and management, not the subscription
The boundary goes at the top here and not in a footnote, because it decides who you need for what.
- The devices and what goes around themBusiness phones and tablets, with the cases and screen protection to match. From HMD, Fairphone, Nokia, Samsung and Apple for the office, and from Sonim, Zebra, Honeywell, Datalogic and Newland where the device has to survive a warehouse or a building site.
- Setting up the management platformMicrosoft Intune, Android Enterprise or Apple Business Manager, tied to the accounts you already have. If something is already running we take that over rather than putting something beside it; two management platforms across one device fleet is the source of faults nobody can explain.
- The device through its lifeEnrolment at purchase, moving the profile across at replacement, blocking and wiping when somebody leaves, and disposing of or reselling the device at the end. The eSIM profile you receive from your provider we put onto the device, and we move it across when the device is replaced.
- Where our boundary sitsWe do not supply mobile subscriptions. Your contract, your SIM and your numbers stay with your provider and we do not get involved with them, tariffs and bundles included. We manage the devices hanging off them. That has an upside: when you pick a provider we are not a party to it and have no interest in the outcome.
What goes with this
Phone management is one corner of managing every device.
Questions we get about this
The ones that come up most, answered briefly.
Do you also supply the mobile subscriptions?
No. Your contract, your SIM cards and your numbers stay with your provider, and we do not get involved with tariffs or bundles. We manage the devices hanging off them: enrolling, configuring, securing and disposing of them at the end. So when you pick a provider we are not a party to it.
Can you wipe an employee’s personal phone?
Only the work side. With a work profile the work apps and work data sit apart from the rest of the device; that part can be wiped without touching photos, messages or personal apps. On a company-owned device the policy can sit tighter, and we settle that difference up front.
Does somebody have to work through the box before a phone works?
Not if the device was tied to your organisation at purchase. It then reports in by itself the first time it is switched on and pulls down its configuration, and the box can go straight to the employee. If that is not arranged up front, it is manual work per device.
First know what is out there
Say how many devices there are, whether they belong to the company or the employee and whether any management is already on them. From that follows what there is to arrange and what comes first.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.