Skip to main content
iPhone and iPad management, India

The phones reading your company email are the least managed devices you own. Most of them are not even yours.

There is usually a thoughtful plan for the laptop fleet and almost nothing written down about handsets, which is strange when you consider that the handset holds an identical mailbox, identical documents and an identical chat archive, gets carried between cities most weeks, and in the majority of cases was bought by the person carrying it. Doing this properly comes down to one ability: taking company material off hardware that is not yours while leaving everything personal exactly where it is. Delivered remotely from Gachibowli, Hyderabad, to organisations across India.

Book a mobile estate reviewSee the enrolment options
iPhone and iPad management for Indian organisations
  • Work onlyCompany data removable without a full wipe
  • BYOD honestPersonal content genuinely stays private
  • Same dayLeaver access revoked without cooperation
  • 30minManaged-client response SLA
What mobile management covers

Eight things that matter on a phone and never come up on a laptop.

Four properties separate a handset from a laptop. It is intimate, it goes everywhere, it never disconnects, and the person holding it probably paid for it. Every one of those changes what your management ought to be doing. Take a laptop policy and apply it wholesale to phones and staff will resent it and route round it. Build for the device as it actually is and people accept the result, because the line you have drawn is defensible.

Two genuinely different enrolment models

Hardware the business bought can be supervised and managed end to end, with settings, applications and restrictions all answering to you. Hardware an employee bought belongs on the account-driven route instead, where the work account and work applications are governed and the remainder of the device is left entirely alone. Choosing wrongly between those two is the error we see most often in Indian estates, because corporate-grade controls applied to somebody own handset are both invasive and, when it comes to it, impossible to actually enforce.

Removing company data without wiping the phone

If you take one thing from this page, take this one, because it is what pays for the entire programme. Somebody hands in their notice, or leaves a handset in a taxi, and you pull the work account, the work applications and everything attached to them. Their family photographs, their messages, their own accounts: all still there, all untouched. Without management in place you have exactly two options, a polite request or a full erase you have no business performing on equipment you did not buy.

Being straight about what the employer can see

Configure a personal handset correctly and there is a short, specific list of what the business can observe: the applications it pushed out, the model of device, and which release it is running. Photographs, private messages, browsing, anything installed for personal use, none of that is visible. Write that list down and circulate it before a single person enrols. The rollouts that die on the vine are, with remarkable consistency, the ones where nobody ever described the boundary.

A security baseline that is actually enforced

Four requirements: a passcode set, encryption active, a supported release installed, and the ability to lock or find the handset. They read as elementary and they are missed constantly. An unlocked personal phone carrying your mailbox is a data breach waiting to be left on the back seat of an auto. What enforcement means here is that the work account simply stops connecting once the device drops below the line, as opposed to a policy document expressing a hope.

Apps deployed without personal Apple Accounts

Business applications get pushed out and configured by you, licensed to you, and pulled back when somebody moves on. Asking an employee to install a work tool under their own account is not a reasonable request, because the licence then sits with them, and declining is a perfectly defensible position for them to take. Licensing everything to the organisation makes the whole argument go away before it starts.

Single-app and kiosk iPads

One application, nothing else, on hardware sitting at a billing counter, a reception sign-in desk, a warehouse picking station, a feedback kiosk or a clinic queue board. Leaving that application needs a code. When a unit dies you courier out a spare that is already configured and the site is running again the next morning. Across Indian retail chains and multi-city operations, this is where the iPad genuinely earns its place.

Compliance connected to access

This is the decision about which handsets are permitted anywhere near your mailbox and your documents in the first place. Within Microsoft 365 the compliance state of a device feeds directly into your access policies, meaning a jailbroken, out-of-date or entirely unmanaged phone gets turned away instead of appearing in a report. Make that connection and mobile management stops being an inventory exercise and becomes an actual security boundary.

Lost and stolen as a process, not a panic

Somebody leaves a handset in a cab at nine on a Friday night. What should happen next is written down already: try to find it, lock it, take a view on removing the company material, and kill the sessions it is holding. None of those steps are technically demanding. What determines whether it works is having settled beforehand who has authority to approve what outside office hours, given that outside office hours is precisely when phones go missing.

The conversation that decides adoption

Staff resist mobile management because nobody tells them the truth about it.

The stalled BYOD programmes we get called into have a shared history. Management announced that handsets would be enrolled, offered no detail whatsoever, and everybody filled the silence with the worst thing they could imagine. What works instead is brief and truthful.

  • Set out, in writing and before anybody enrols, precisely what becomes visible. On a properly configured personal enrolment that means: applications the business deployed, the model, the installed release, and whether the handset clears the security bar. It does not mean photographs, private messages, browsing history, or an inventory of what else the person has installed.
  • Then set out what the business is able to do. Pull the work account and its data, yes. Erase the entire handset, no, and it should not hold that power over property it did not purchase. Should your intended configuration hand the employer that capability on personal devices, revisit the configuration rather than keeping quiet about it.
  • Offer a genuine alternative wherever the budget allows. Handing a company phone to anyone who would rather keep work off their own device removes the objection completely. Where you cannot afford that across the board, extend it at minimum to the roles handling your most sensitive material.
  • Fit all of it onto a single page somebody will read, instead of twelve pages nobody opens. What gets managed, what can be seen, what happens on your last day, and whom to ask. With Indian professionals changing employers as readily as they do, having written it down is also what protects the business when a relationship ends badly.
Ask us for the one-page version
Why bring us in

Four things that decide whether mobile management sticks.

Nothing about the engineering here is hard. These projects live or die on two things instead: how the change is put to the people it affects, and whether the enrolment model you picked matches who actually paid for the hardware.

We write the staff communication, not just the configuration

You get a single page covering what gets managed, the exact limits of what an employer can observe, what occurs when somebody leaves, and where to take questions. That document, more than any configuration decision, determines whether people enrol without being chased. Flawless deployments have died for want of it, and thoroughly ordinary ones have succeeded because somebody bothered.

We match the model to who owns the device

Equipment the business bought is managed completely, which is entirely appropriate for business property. A handset somebody bought themselves goes on the enrolment route that reaches work data and nothing beyond it, because anything more invasive gets refused outright or quietly circumvented. Drawing that boundary correctly is the bulk of the work.

We connect compliance to access, so the control is real

A line in a report announcing that a handset is non-compliant accomplishes precisely nothing on its own. Across Microsoft 365 estates we feed device state into your access policies, so a phone sitting below the bar is denied the mailbox rather than logged on a dashboard nobody has opened this quarter. That is what separates a mobile policy from a mobile control.

Remote-first from Hyderabad, reachable when it matters

The work runs remotely out of Gachibowli in Hyderabad and reaches organisations anywhere in India, for the straightforward reason that handset management happens in a console and a policy document rather than at somebody desk. Managed clients hold a 30 minutes response SLA, and we settle beforehand who is entitled to authorise wiping company material from a missing device, so nobody spends midnight trying to reach a decision maker.

Where this applies

Six Indian situations and what each one needs.

What is correct for a field sales force carrying their own handsets bears very little resemblance to what is correct for a hospital passing iPads between shifts. Below are the patterns we build for most frequently.

A sales or field team on personal phones

Your mailbox, your customer contact list and your price sheets, all sitting on handsets the business never bought, carried around by people who move between employers freely in a market that competes hard for them. The account-driven model fits: work material comes off at departure, personal content is never involved, and a written explanation makes the whole thing acceptable to the person being asked. What you are actually protecting against is your client list walking out with a salesperson, and this is the control that does it.

Retail or hospitality running iPads at the counter

Point of sale, guest sign-in, menus, feedback terminals. Every one of those should be bought by the business, supervised, and pinned to one application so it cannot quietly turn into something else over a few months. Once that is true, replacing a failed unit is a parcel rather than a journey, and that single fact is what lets a three-person IT team run hardware across forty outlets.

A firm handling regulated or client data

Banking, law firms, consultancies and capability centres all have to show three things: that hardware carrying client information is under management, that access can be withdrawn, and that losing a handset is not automatically a reportable event. Where the material is genuinely sensitive our recommendation is usually to simply buy the phones, because company ownership disposes of every ambiguous question at once.

A clinic, hospital or diagnostics group

Patient records arriving on handsets, iPads handed from one clinician to the next as shifts change, and a duty of confidentiality with no room in it for approximations. Shared hardware deserves extra thought here, because a communal login wipes out attribution entirely, and attribution is the very first thing a clinical review or a DPDP breach enquiry is going to ask you for.

A business with high staff turnover

Services firms, BPO floors, logistics operators, retail, quick commerce: anywhere the roster changes every month and offboarding happens through a conversation rather than a checklist. All the value here sits in the leaver step, pulling company access off a handset the same day, requiring nothing to be handed back and no cooperation from anybody. Skip it and access quietly piles up in a way no one is counting.

Executives and founders

Whoever holds the most valuable material on their handset is, almost by rule, the least managed person in the building, because policy travels downward and nobody enjoys sending it up. Buying them a properly managed iPhone is the tidy answer, and it is received far better when it arrives framed as something the company is providing rather than something being imposed. Where exposure is genuinely high, going beyond the standard baseline is a separate discussion worth having.

The leaver test

Somebody resigns on Monday and hands back nothing. What happens?

No policy document will tell you as much about where you stand as this single scenario will. And in a job market where notice periods get argued over and people occasionally simply stop coming in, it is not a thought experiment. Work through it against your own situation while you read the table.
Feature
Managed
Email account only
Unmanaged
Company mailbox removed from the phone
ImmediatelyEventuallyOnly if they cooperate
Documents cached on the device removed
Partly
Work chat history removed
Work apps removed
Personal content untouched
App licences recovered
Not applicable
You can evidence the data was removed
Partly
Requires the person to cooperate
SomewhatEntirely
Works if they have already joined a competitor
Partly
Time to complete
MinutesHours to daysNever, in practice
Choosing the enrolment model

Company-owned, personal with User Enrolment, or unmanaged.

Column three is where most Indian organisations find themselves, none of them having chosen it. For the bulk of staff handsets the middle column is the correct home, while column one is right for hardware the business purchased and for anything a customer will touch.
Company-ownedPersonal, User EnrolmentUnmanaged
Organisation controls the whole deviceYesNoNo
Work data removable on its ownYesYesNo
Personal content visible to the employerPossible, be carefulNoNo
Passcode and encryption enforcedYesYesHoped for
Apps deployed and licensed by the organisationYesYesNo
Access blocked if the device is non-compliantYesYesNo
Suitable for kiosk or single-app useYesNoNo
Staff generally accept itYes, company propertyYes, if explainedNot applicable
Leaver handled the same dayYesYesAsk and hope
Right for senior people with sensitive materialBestAcceptableNo
Where most Indian staff phones sit todayRarelySometimesThe default
How a deployment runs

Five steps, and the announcement comes before the technology.

Sequencing counts for more on this kind of project than on any other, because what you are asking for is permission to manage something people regard as theirs. Enrol everybody and explain yourself afterwards and you will spend the following two quarters earning back trust you did not need to lose.
  1. 1

    Count the phones that actually hold company data

    Week 1

    The answer is already sitting in your mail platform, which has been recording every device that connects for years. Expect the total to exceed your estimate, and expect it to include former colleagues. That same number is what wins the internal argument, since a risk expressed as a specific count gets funded where a risk expressed as a concern gets postponed.

  2. 2

    Decide the ownership model per group, in writing

    Week 1-2

    Three buckets: roles that receive a company handset, roles that use their own under the account-driven model, and roles that genuinely need nothing more than browser access from a desktop. There is real money attached to where each role lands, which makes it a decision for the business to take rather than something IT ends up defaulting into.

  3. 3

    Write the one-page explanation and circulate it

    Week 2

    Four things on one page: what gets managed, the limits of employer visibility, what happens on your last day, and who takes questions. It goes out before a single enrolment request does. Of every step described here this is the one clients most want to skip, and it is the one that determines whether any of the others land.

  4. 4

    Enrol in waves, starting with patient volunteers

    Week 3-5

    Start with people who volunteered, because they will tolerate the rough edges and report them: a prompt whose wording confuses everyone, an application that needs one extra setting, somebody still running a release from three years ago. After that it goes team by team instead of company-wide on a Tuesday morning, which keeps your support desk from meeting the entire organisation simultaneously.

  5. 5

    Connect compliance to access, then run it

    Continuous

    With enrolment settled, devices below the bar start getting turned away instead of listed somewhere, and that switch is what turns the whole exercise into a control. From there it becomes routine work: people joining, people leaving, handsets being replaced, releases kept current, and a written procedure for anything that goes missing after hours. Managed clients carry a 30 minutes response SLA across all of it.

Straight answers

What people ask, including the questions your staff will ask.

On a correctly configured personal-device enrolment, no. The organisation manages the work account and the work apps it deployed, and it can see the device model, the OS version and whether the device meets the security baseline. It cannot see personal messages, personal photos, browsing history, or what other apps you installed. This is a technical boundary built into the platform, not a policy promise. If an employer asks to enrol a personal phone in a way that grants more than this, that is worth questioning, and we tell our clients the same.

Under User Enrolment on a personal device, it can remove the work account, the work apps and the data associated with them. Your photos, personal messages and personal accounts remain. A full device wipe is a capability that belongs on company-owned hardware, and configuring it on a device the employee bought is something we advise against. When somebody leaves, the work half disappears and the phone stays theirs, which is the outcome both sides actually want.

Email is precisely the reason to have it. A mailbox holds contracts, client correspondence, invoices, payment instructions, personal data about staff and customers, and the password resets for other systems. It is often the single most sensitive collection of information in the business, sitting on personal devices you cannot control. The test is simple: if somebody resigned tomorrow and stopped answering calls, could you remove your mailbox from their phone? If not, that is the exposure.

Company-owned devices can be supervised, which lets the organisation control the whole device: configuration, applications, restrictions, and a full wipe if needed. That is appropriate because the device is company property. Account-driven User Enrolment is for personally owned phones and deliberately manages only the work portion, keeping a strict separation from personal use. Applying the first model to personal devices is the classic mistake, and it produces resistance and workarounds rather than security.

You can make company access conditional on enrolment, which is different from forcing it and is what we recommend. The fair version: if you want company email on your own phone, it needs to meet the baseline and be enrolled; if you would rather not, here is a company phone or web access on a computer instead. A genuine alternative changes the character of the request entirely and removes most of the objections that otherwise stall a rollout.

On a managed device you remove company access remotely and it takes effect the next time the phone connects, without needing the person to cooperate or even respond. In the Indian market, where departures during a notice-period dispute can be sudden and devices are rarely handed back, this matters. On an unmanaged phone the practical position is that your data stays there indefinitely, and your only recourse is asking somebody who has no reason to answer.

Yes, and if you are on Business Premium, E3 or E5 you already have Intune included, which manages iPhones and iPads properly. The strongest part of the combination is conditional access: device compliance is connected to whether the phone can reach your mailbox and files at all, so a non-compliant device is refused rather than reported. For most Indian businesses this is the answer, because it costs nothing additional and covers Windows and Android too.

Yes, and for customer-facing deployments you should. A supervised, company-owned iPad can be locked to one application so it cannot be exited without a code, which is what makes it usable as a billing counter, sign-in desk, menu or survey device. Without this, a public-facing iPad becomes a general browsing device within about a week. It also lets you replace a failed unit by couriering a configured spare instead of sending an engineer across the city.

On a managed device you can attempt to locate it, lock it, display a message and remove company data, and a company-owned supervised device supports stronger measures including Lost Mode. What makes the difference is not the technology but the agreed process, because phones are lost in the evening and on weekends. Decide in advance who authorises removal of company data, how they are reached out of hours, and what the person who lost it should do first, which is report it rather than chase it.

Negligibly. Management on iOS and iPadOS is handled by the operating system rather than by a background app constantly running, so users do not notice an impact on battery or performance. Say this explicitly in your staff communication, because it is a common assumption and an easy objection to remove early. What people do notice is a badly built profile that blocks something they use, which is a testing problem, not a platform one.

Managing a device means processing personal data about the person using it, which brings the Digital Personal Data Protection Act 2023 into scope. The practical requirements are proportionate: collect only what the security purpose needs, tell people clearly what you collect and why, keep it only while they work for you, and be able to explain it if asked. The one-page staff communication we insist on serves this purpose too. The same management layer also supports the reasonable security safeguards the Act expects around company-held personal data on mobile devices.

The technical configuration for a typical Indian business is a matter of days. The rollout takes a few weeks for a hundred staff, because it moves at the pace of people rather than technology: volunteers first, then department by department. Company-owned devices go faster because there is no adoption conversation. Commercially the work is scoped per engagement, driven by device count and ownership mix; there is no rate card because estates differ too much for one to be honest. Enquiries get a reply within 4 business hours.
Mobile estate health check

Fifteen questions about the phones with your data on them.

Group one puts a number on an exposure nobody has ever sized. Group two is the controls themselves. Group three covers the people and the law, and under the DPDP Act that third group is where mobile programmes come unstuck far more often than they do on anything technical.

Quantify the exposure

  • How many phones currently have company email on them?
    Most organisations cannot answer this, which is itself the answer.
  • How many of those does the company own?
    Usually far fewer than the number holding company data.
  • Could you remove company data from a personal phone today?
    If not, every leaver takes your mailbox with them.
  • Do you know which are running an unsupported iOS version?
    Old phones stay in circulation long after updates stop.
  • Has anyone left in the past year with access still on their phone?
    Check rather than assume. Disabling web login is not the same thing.

The controls

  • Is a passcode actually enforced, or merely requested?
    A phone with no passcode and a company mailbox is an open door.
  • Is device compliance connected to access?
    A non-compliance report changes nothing on its own.
  • Are work apps deployed by the organisation, not installed personally?
    Licence ownership and removability both depend on this.
  • Can a lost device be located and locked out of hours?
    Including late on a Friday, which is when it happens.
  • Are customer-facing iPads locked to a single app?
    Otherwise they become a browsing device within a week.

The human and legal side

  • Is there a one-page policy staff have actually read?
    Twelve pages nobody opens is the same as nothing.
  • Have you told people in writing what the employer can and cannot see?
    The single biggest determinant of BYOD adoption.
  • Is enrolment on a personal device genuinely voluntary?
    With a real alternative such as a company phone or web-only access.
  • Do you know your DPDP Act obligations for what you collect?
    Managing a device means processing personal data about its user.
  • Is there an agreed out-of-hours process for a lost device?
    Who authorises, who acts, and how fast.
Related reading

The pages around this one.

Apple device management India

The hub: how iPhone, iPad and Mac management fits together for an Indian organisation, and where to start.

Learn more

Zero-touch Apple deployment

Getting company-owned devices supervised and configured before anyone touches them, starting at the purchase order.

Learn more

Microsoft Intune

What Intune covers across iPhone, iPad, Android, Mac and Windows, and how to check whether your Microsoft 365 plan already includes it.

Learn more
References

Official documentation

Next step

Start by counting how many phones have your email on them.

Your mail platform already knows. The number is usually higher than expected and usually includes people who left. We will help you produce it, work out which of those devices the company owns, and give you a straight recommendation on what to do about the rest. Initial reply within 4 business hours.

Book a mobile estate reviewExplore Apple device management