Question

A financial services firm allows employees to access Outlook and Teams on personal iOS and Android devices without enrolling them in MDM. Compliance requires that when an employee leaves the company or reports a lost device, all corporate email and files inside those apps can be removed without touching the user's personal photos, contacts, or apps. The security architect must design a solution that meets this requirement with the least administrative overhead. Which approach should the architect recommend?

Accepted Answer

Deploy Intune App Protection Policies (MAM without enrollment) and use selective wipe to issue a per-app 'wipe' action against the managed apps.

Answer

Require full Intune MDM enrollment of the personal devices and perform a device 'Retire' action to remove company data.

Answer

Configure a Conditional Access policy that blocks the departed user's account and rely on token revocation to clear cached data.

Answer

Use Microsoft Purview DLP endpoint policies to detect and delete corporate content stored on the personal devices.