Why BYOD Is an MSP Problem
When a client lets staff work from personal phones and laptops, the devices holding company data stop being devices you control. You cannot assume an RMM agent is installed, that patches are current, or that you have the right to wipe anything. BYOD does not remove the security obligation; it moves it from device management to access control and written policy, and the MSP is the one expected to make that work.
It also changes the support model. A client with BYOD will open tickets about personal hardware you do not manage, and your agreement needs to say whether that is covered, billed, or out of scope, in the same way an AYCE scope does.
What the Client Needs in Writing
Before a personal device touches company email or files, the client should have a signed policy. As the MSP you are usually the one drafting it or pushing for it. At minimum it covers:
- Which apps and data personal devices may access, and which stay on company equipment only.
- Minimum requirements such as a supported operating system, a screen lock, encryption and MFA on every account.
- Whether the device enrolls in management, and whether that management is full device or limited to a work profile or managed apps.
- What happens at termination, including selective wipe of company data and removal of access.
- Who pays for support on the device, and what the MSP will and will not touch.
Controls That Work on Devices You Do Not Own
The practical answer is to protect the data and the identity rather than the whole device. Conditional access that checks device health before granting access, app protection policies that keep company data inside managed apps, and a zero trust posture where no device is trusted by default all work without taking over someone's personal phone. For laptops, the honest position is often that personal computers get browser access only, while anything that syncs files requires company hardware with EDR installed.
Regulated clients need extra care. A practice handling patient data under HIPAA has to be able to show how protected information on personal devices is safeguarded, and the controls you choose become part of that evidence.
Pricing and Offboarding
BYOD is rarely cheaper to support. Personal devices vary more, are shared with family, and fall out of compliance more often, so price the management effort into the seat rather than treating fewer company devices as less work. Offboarding is where BYOD policies are tested: removing access for a departing employee has to happen the same day, and it depends on accounts being individual. Shared logins undo all of it, which is why shared admin accounts are the first thing to remove.
Common Questions
Can an MSP wipe an employee's personal phone?
Only with the employee's written consent, and a selective wipe of company data is the safer default. A full wipe of a personal device without clear authority invites a dispute the client will expect you to explain.
Is a work profile enough for BYOD phones?
For most small business clients, yes. Separating company apps and data from personal use gives you control over what matters without managing the whole device.
Should BYOD devices count in per device pricing?
If you manage them, count them. A personal device enrolled for company access takes support time, and leaving it off the invoice quietly erodes margin.
What if a client refuses a BYOD policy?
Document that you recommended one and what the risk is, then limit personal device access to what you can protect, such as browser only access to email.