# Options for letting staff use personal devices for work systems

Device management (MDM), app management (MAM), a virtual desktop, a managed browser, or sign-in that hides the password. They differ in what they control.

Updated: October 16, 2026

When staff use their own devices (bring your own device, or BYOD) for work systems, a company has five options. The systems can be cloud apps or ones you host yourself. Mobile device management (MDM) manages the whole device. Mobile app management (MAM) manages only the work apps. A virtual desktop (VDI) streams a remote desktop to the device. A managed browser applies company rules inside the browser. A fifth option checks who the person is and signs them in without showing the password. What sets them apart is the thing the company controls: the device, the apps, the screen, the browser or the sign-in.

## Why personal devices are hard to secure

NIST SP 800-46, NIST's guide to telework and personal-device security, says a BYOD device is controlled by its owner, who is fully responsible for securing it. It tells organizations to assume that telework devices will fall into the hands of someone trying to recover data from them, and that they'll pick up malware.

NIST doesn't ban personal devices. It asks each organization to decide, based on risk, how much access each type of device gets. Its example is tiered access. Company computers reach many resources and personal computers a limited set. Personal phones reach just a couple of low-risk services, such as webmail. NIST also says your telework policy should state which remote access methods you allow and which devices may use each.

NIST sorts remote access into four types. In tunneling (a VPN), the device joins the company network. A portal is a server that runs the apps and sends the device screens or web pages; virtual desktops belong here. Remote desktop access lets someone control their own office computer from home. With direct application access, the device connects straight to one app, such as webmail in a browser. A cloud app used in a browser works this way.

## The five options

| Option | What the company controls | What goes on the personal device | Where the work data sits | Closest NIST type |
| --- | --- | --- | --- | --- |
| MDM (device management) | The whole device: settings, security and apps | The device is enrolled | On the device, which can be wiped if lost or stolen | None; a device control used with any type |
| MAM (app management) | Work apps and the data inside them | Supported apps; no enrollment | Inside the managed apps, which can be cleared of company data | None; an app control |
| Virtual desktop | Desktops and apps running in the cloud | A remote desktop app, or just a browser | On the server; the device mostly shows the screen | Portal |
| Managed browser | Browser settings, extensions and what data can leave | An enrolled browser, or a separate work browser or extension | In the browser and on the device, as your rules allow | Direct application access |
| Sign-in that hides the password (Junify) | Who may use which account, a record of each use, the sign-in window, and downloads per account | A Chrome extension on the computer and a phone app for verifying | In an incognito window, cleared on close; downloaded files stay unless blocked | Direct application access |

### MDM and MAM

Microsoft's Intune documentation separates the two. With MDM, the device is enrolled and Intune manages all of it, including settings, security and apps, and a lost or stolen device can be wiped. With MAM, Intune controls just the work apps and the company data in them. Microsoft calls MAM typical for personal devices. When the person leaves, you can remove company data and leave their personal content alone.

Microsoft's overview of app protection policies, the rules MAM pushes to apps, says they work without enrolling the device. They apply only to apps built to support them, such as the Microsoft 365 apps. Each user needs a Microsoft Entra ID account and an Intune license.

### Virtual desktop

Azure Virtual Desktop runs Windows desktops and apps on Microsoft's cloud. People connect through the Windows App, the Remote Desktop client or a web browser. NIST counts virtual desktops among portals. The apps and data stay on the server, which sends the device screen images. When the session ends, the virtual desktop is thrown away, so the next user starts clean. NIST says this helps with personal devices, which are less likely to meet a company's security rules. It also notes that portals can be set up to allow downloads to the device.

### Managed browser

Google says Chrome Enterprise Core manages Chrome browsers from the Admin console at no additional cost. Chrome Enterprise Premium, its paid tier, adds controls over copy and paste, uploads, downloads and printing. Island offers a full Chromium-based browser and an extension for an existing browser. It lists controls over printing, downloads, screenshots, and copy and paste. [What is a secure browser (enterprise browser)?](/guides/access-basics/what-is-secure-browser) explains the category, and [Types of tools for managing SaaS accounts, and how they differ](/guides/access-basics/comparison-of-access-management-tool-categories) sets it beside the other tool types.

Using a cloud app this way is what NIST calls direct application access. NIST notes that many organizations allow direct access only to a few widely used, lower-risk apps, such as email.

### Sign-in that hides the password

This option doesn't manage anything inside the device. It checks who the person is before sign-in and fills in the password without showing it. Identity providers such as Okta and Microsoft Entra ID offer password fill-in of this kind. It requires each person to have an account there. Microsoft, for example, says people need an organizational account in Entra ID to use My Apps.

When a tool like this opens the sign-in in an incognito window, browsing history and cookies clear once every incognito window closes. Chrome's help says downloaded files stay on the device even then, so check whether the tool can block downloads. [How to get SSO-like sign-in for SaaS apps without SAML](/guides/access-basics/sso-like-operation-for-non-saml-saas) compares the ways to do this.

## How to choose

Start with what you want the company to control. If work data has to live on the device, use MDM. If it can stay inside a few work apps, MAM is enough. If nothing should stay on the device, a virtual desktop keeps the work on the server. If the work is all in cloud apps, a managed browser covers it. For shared accounts among those apps, adding the fifth option records who used each one.

A managed browser and a sign-in tool that blocks downloads overlap, since both can stop downloads in the browser. A managed browser covers every site in it. The sign-in tool covers only the windows it opens, but it records who used each shared account. You can run both.

Some cases favor the others. If people need installed desktop software, a virtual desktop fits better than any browser option. If you want copy, paste and printing controls across every site, choose a managed browser. And if work data must be stored on the device, MDM is the one that can wipe it.

You can combine options. Microsoft gives the example of one employee with two devices. The phone the company issued gets both MDM and app protection policies, and the employee's own tablet gets app protection policies alone. NIST's tiered access is the same idea: more control, more access.

## What device controls don't record

None of the first four options can show who used a shared account. The service's own log records the shared account's name, so five people look like one. [Managing shared accounts](/guides/shared-accounts) covers how to handle them. If your staff open clinical systems on their own devices, [Can staff use personal devices to access clinical systems?](/guides/healthcare-access/byod-for-clinical-systems) covers what HIPAA asks for.


## Frequently asked questions

**Do personal devices have to be enrolled in MDM before they can be used for work?**

Not for every option. Microsoft says Intune app protection policies work without enrolling the device. NIST leaves the choice to each organization's risk decisions and suggests giving less-controlled devices less access.

**What's the difference between MAM and MDM?**

MDM enrolls the device and manages all of it, so a lost or stolen device can be wiped. MAM manages only the work apps and their data, so you can remove company data without touching personal content.

**Does a virtual desktop leave nothing on a personal device?**

The work runs on a server and the device mostly shows the screen. NIST notes that virtual desktops, like other portals, can be set up to let people download files to the device.

**How do we know who used a shared account from a personal device?**

Device and browser management don't tell you. The service's log shows only the shared account's name, so you need a step before sign-in that checks who the person is and records it.

## Sources

- [NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security (July 2016)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-46r2.pdf)
- [Microsoft Learn: What is Microsoft Intune?](https://learn.microsoft.com/en-us/intune/fundamentals/what-is-intune)
- [Microsoft Learn: App protection policies overview, Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/protection/overview)
- [Microsoft Learn: What is Azure Virtual Desktop?](https://learn.microsoft.com/en-us/azure/virtual-desktop/overview)
- [Chrome Enterprise and Education Help: Chrome Enterprise Core](https://support.google.com/chrome/a/answer/9116814?hl=en)
- [Google: Chrome Enterprise Premium](https://chromeenterprise.google/products/chrome-enterprise-premium/)
- [Island: The Enterprise Browser (product page)](https://www.island.io/product)
- [Microsoft Learn: My Apps portal overview, Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/myapps-overview)
- [Google Chrome Help: Browse in Incognito mode](https://support.google.com/chrome/answer/95464?hl=en)
- [Junify: Product](https://www.junify.com/product)

## How Junify handles this

**Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.

**With Junify** With Junify, you don't have to enroll a personal computer in device management just so someone can use a shared account. The computer needs only the Junify Chrome extension. People confirm who they are on their own phone each time, so each use is recorded by person. The password Junify fills in isn't left on the computer, downloads can be blocked per account, and uploads are detected and reported to admins.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=access-basics&slug=byod-options-mdm-vdi-browser)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
- [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
- [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.