Tools
BYOD or managed devices: the honest cost comparison
Personal devices look cheaper because the hardware is free. The costs are real, they are just somewhere else on the balance sheet.
Microsoft
The comparison people actually make
Buying a laptop costs money. Letting somebody use their own does not. That is the whole argument, and it ignores that the security controls available on a device you do not own are a fraction of those available on one you do.
The honest comparison is not hardware cost. It is what each model lets you enforce, and what you give up.
| Managed | BYOD with MAM | |
|---|---|---|
| Full disk encryption | ||
| OS version minimum | ||
| Endpoint detection and response | ||
| Prevent copy to personal apps | ||
| Selective wipe of company data | ||
| Local admin removal | ||
| Conditional Access on device compliance |
MAM means mobile application management, protecting the app and its data without managing the device.
Where BYOD is genuinely the right answer
Mobile phones, for most organisations. App protection policies give you the controls that matter on a phone without the intrusion of full device management, and the alternative is issuing a second handset that people carry reluctantly.
Contractors and short engagements, where the device provisioning cost exceeds the engagement value and access can be scoped narrowly.
Where it is usually wrong is a full-time employee's primary computer. That is the device where the controls you cannot apply are the ones that matter most.
The verdict
Managed computers, app protection on personal phones
It puts full control where the risk concentrates and accepts a lighter touch where the intrusion would be disproportionate and the exposure smaller.
Do not run BYOD on primary computers to save hardware budget. The saving is real and it is smaller than one incident on an unencrypted, unmonitored, locally-administered machine.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.