Appearance
By Scot, 10+ years in IT support and helpdesk ·How these guides are checked
Company Portal (Microsoft Intune) lets your organization manage security policies on your device — like requiring a PIN or encrypting storage — but it does not give IT access to your personal photos, texts, or browsing history. IT can see your device name and OS version, not your personal data.
Checked against Microsoft Learn - Windows release health, Microsoft Learn - end of support and retirement and between 5 Aug 2026 and 12 Sep 2026. Nothing published in that period has been linked to this guide.
This article explains what happens when your organization manages your device through Microsoft Intune and the Company Portal app. It answers the most common question employees have: "What can IT see on my phone or computer?" Understanding what IT can and cannot access builds trust, reduces anxiety, and helps you make informed decisions about enrolling personal devices.
In this guide
Microsoft Intune is a cloud-based service that helps organizations manage the devices employees use to access company data. When your device is "managed" or "enrolled," it means your organization has applied security policies to protect company data — not to monitor your personal activity.
Device management typically happens in two scenarios:
The following information is visible to IT administrators regardless of whether the device is company-owned or personal. This section covers the device — for what your employer can see inside your Microsoft 365 account and on a company laptop, see Understanding What IT Can See on Your Work Computer.
| Information IT Can See | Why They Need It |
|---|---|
| Device name and model | To identify devices for support and inventory. |
| Operating system and version | To verify you have required security updates. |
| Device compliance status | To check if your device meets security policies (encryption, PIN, etc.). |
| Installed company apps | To verify required apps (like Teams or Outlook) are installed. |
| Serial number and device ID | For asset tracking and support troubleshooting. |
| Network (Wi-Fi) connection type | To determine if the device is on a secured network. |
This is the most important section. When you enroll a personal device, IT cannot see or access any of the following:
| Information IT Cannot See | Details |
|---|---|
| Personal emails | Your Gmail, Yahoo, or personal Outlook inbox is completely private. |
| Text messages (SMS/iMessage) | IT has no access to your text conversations. |
| Personal photos and videos | Your camera roll and personal media are never visible to IT. |
| Browsing history | What you search for or visit in your personal browser is not tracked. |
| Phone call history | IT cannot see who you call or who calls you. |
| Personal app data | Data inside your personal apps (social media, banking, health, etc.) is private. |
| GPS location (in most cases) | Your real-time location is not tracked. Some organizations may use location for lost device tracking only — but only if you explicitly enable it. |
| Contacts | Your personal address book is not accessible to IT. |
DANGER
This applies to BYOD (personal) devices enrolled with Intune. Company-owned devices may have broader management capabilities, including the ability to see installed apps, enforce stricter policies, and remotely wipe the entire device. If you are unsure which category your device falls into, ask IT to confirm how it is enrolled and to send you the device management or acceptable-use policy that applies to it — that document is what tells you exactly what is collected.
The Company Portal app is a self-service tool provided by your organization. It is available on Windows, iOS, and Android.
What you can do in Company Portal:
What Company Portal does NOT do:
If a message from IT has told you to enroll a device by a date, it is worth being plain about what that date is and what it is not.
Your organization sets a compliance policy — a list of conditions a device has to meet before it is allowed to reach company data. Every such policy marks a device non-compliant the moment it fails, and your organization can extend that into a grace period so people have time to put things right. Your deadline is the end of that grace period.
What happens at the end of it is a rule running, not a person deciding you are in trouble. Once the device is marked non-compliant, a Conditional Access rule can block it from company resources such as email and files. Nobody reviews your case that morning.
Two details are worth knowing so the warnings do not alarm you:
[email protected], and Microsoft sends them within about six hours of the device being marked non-compliant. An email from that address is genuine, not a phishing attempt.Access to work email, files and company apps on that device. That is the whole consequence, and it is a policy consequence rather than a punishment.
What does not happen: nothing is deleted, your work account is not disabled, your personal data is not touched, and the phone or laptop carries on being an ordinary personal device. You keep working on a company computer.
The one thing worth checking before the deadline is whether browser access on a computer stays open to you. Some organizations require a managed device only for the apps on a phone and leave Outlook on the web reachable from a computer. Others require a managed device everywhere. Only your IT team knows which of those your organization has set, so ask them in the words below.
If your employer owns the device, enrollment comes with it. If you own it, you are being asked to accept your employer's rules on your own property, and there are real alternatives:
outlook.office.com and use Teams in a browser, with nothing installed on your phone.What your employer is entitled to require of a device you own varies by where you work and what your contract says, so treat this as a conversation to have before the deadline rather than a rule to discover after it. Send IT something like this:
Before I enroll my personal phone by Friday, could you confirm two things?
First, if I do not enroll the phone, does browser access to Outlook and Teams on my work computer stay available?
Second, is a work-issued phone an option for my role?
Could you also send me the device management policy that would apply, so I can read what enrollment covers? If enrolling is the only route to what my job needs, I will go ahead — I would like to understand the options first.
If you have not decided which arrangement you want, Understanding BYOD Setup Choices for Your Personal Phone sets out the four your employer may be asking for and what each one costs you day to day.
If your organization requires you to enroll a personal phone or laptop, here is what typically happens:
Tip: If you are uncomfortable enrolling your personal phone, ask IT for the device management policy so you can read what enrollment actually covers, then ask whether web-only access is available instead — many organizations allow Outlook on the web and Teams in a browser with no enrollment at all. Full enrollment is one of four arrangements your employer may be asking for, and Understanding BYOD Setup Choices for Your Personal Phone compares them side by side — including keeping work off the phone entirely.
Enrollment goes wrong through bad timing more often than anything else, so pick the right half hour and have the right things to hand.
The taps take a few minutes; the waiting is what makes it half an hour. After enrollment the device spends several more minutes receiving policies and apps from your organization, and Microsoft's own walkthroughs tell you to wait at several separate points. Set aside half an hour, and do not start it five minutes before a meeting.
To confirm what kind of enrollment you ended up with, sign in to the Company Portal app or website and open Device Details — it shows the ownership type recorded for the device, which is what decides whether the personal-device limits in Section 3 apply to you.
This article covers what enrollment means. The walkthroughs cover the taps:
If you want to remove your personal device from management:
What happens when you unenroll:
Q: Can IT read my personal texts or emails? A: No. IT cannot access personal messages, emails, or any personal app data on a BYOD device.
Q: Can IT see what websites I visit? A: No. Your browsing history on your personal browser is not visible to IT. However, if you use a company VPN or a company-owned browser profile, web traffic through those tools may be logged.
Q: Can IT track my location? A: Generally, no. Location tracking is not enabled by default. If your organization uses lost device tracking, you would have been notified and asked for consent during enrollment.
Q: Will IT know if I uninstall the Company Portal? A: Yes — unenrolling removes the device from management. You will lose access to company resources on that device.
Q: Can IT wipe my entire phone? A: On a personal (BYOD) device, IT can only wipe company data — your personal photos, apps, and messages remain untouched. On a company-owned device, IT can perform a full factory reset.
TIP
If you are concerned about privacy, ask your IT department for a copy of your organization's Mobile Device Management (MDM) policy. This document details exactly what data is collected and what actions IT can take on enrolled devices.
| Symptom / Error | Potential Cause | Solution |
|---|---|---|
| "Your device is not compliant" | Device does not meet security requirements | Open Company Portal > check what requirement is not met (usually OS update or PIN). Fix the issue and sync. |
| Cannot access company email on personal phone | Device not enrolled or compliance policy blocking access | Enroll your device via Company Portal (see Section 7), or ask IT whether browser access on a computer stays open to you (see Section 6). |
| Company Portal keeps asking to re-enroll | Enrollment profile was corrupted or removed | Unenroll (Section 9), restart the device, and re-enroll from scratch. |
| Work apps stop signing in after an enrollment deadline passes | The grace period ended, the device is marked non-compliant, and a Conditional Access rule is blocking it | Enroll the device, or use a work computer while you settle the question with IT (see Section 6). Nothing on your device is deleted by the block. |
| Worried about privacy after enrollment | Uncertainty about what IT can see | Review the tables in Sections 2 and 3 above, or ask IT for the MDM policy document. |
IT Tip Tuesday
Get a short, actionable IT tip in your inbox every week.
Nothing loads from beehiiv until you click. Once it does, the form sets beehiiv's own cookies and loads beehiiv's own analytics.