You’re in a restaurant. The food is taking a while and your three-year-old is playing up. So you unlock your phone, find a cartoon and hand it over without even thinking about putting the company’s data at risk.

Your phone is still signed in to Outlook, Teams and SharePoint. For the next ten minutes, a toddler has access to your client emails, company chats and shared files. That’s why Outlook and data security matter to every business where people use their own phones for work.

What’s the risk to business emails? Outlook and data security explained

The main risk is simple. Once a phone is unlocked, Outlook trusts whoever is holding it. There’s no password and no second check.

In a few minutes, a curious child can:

• Send a half-written draft to a client
• Reply All to a long email chain with a string of random letters
• Delete or archive important emails
• Start a Teams call with a colleague or client
• Share a SharePoint file with someone in your contacts

For a business, the consequences are real:

• UK GDPR. Sending a client’s personal data to the wrong person can count as a personal data breach, even when it’s an accident. You then have 72 hours to decide whether to report it to the ICO.
• Client trust. An odd email from your account can look like a phishing attempt, or just unprofessional.
• Scale. The same risk applies to every member of your team with Outlook or Teams on a personal phone.

Good Outlook and data security means planning for the moment your phone is in someone else’s hands, whether that’s a toddler, a partner or a thief.

MFA and Cyber Essentials

Multi-factor authentication (MFA) means a password on its own isn’t enough to sign in to Microsoft 365. For a lost or stolen phone, it’s the most effective single step you can take for Outlook and data security.

Since April 2026, Cyber Essentials requires MFA for every user of your cloud services, including Microsoft 365. Directors and owners are included. Microsoft Authenticator also uses number matching, so a sign-in can only be approved by typing in a code shown on the login screen.

Cyber Essentials also covers personal phones. If a phone can open business email or files, it’s in scope.

That phone needs:

• A screen lock, using a PIN, password, fingerprint or face
• An operating system that still receives security updates
• Critical and high-risk updates applied within 14 days
• Apps installed from the official app stores only
• MFA on every work account

For more on what’s changed and which level suits your business, read our guide: Cyber Essentials vs Cyber Essentials Plus.

Security practice for using your own phone for work

Using your own phone for work is normal, and it doesn’t have to put your business at risk. These six habits keep Outlook and data security under control while your personal phone stays personal.

• Lock your work apps separately. On an iPhone running iOS 18 or later, press and hold the Outlook icon and choose Require Face ID. Do the same for Teams, OneDrive and SharePoint. On Android, use a secure folder or private space.
• Use Guided Access or app pinning. Before you hand your phone over, lock it inside one app. On iPhone, turn on Guided Access in Settings > Accessibility. On Android, turn on app pinning, usually under Settings > Security.
• Give children their own device. An old tablet with no work accounts on it is the simplest fix. If you hand down an old work phone, sign out of every work account and reset it first.
• Use app protection. Microsoft Intune app protection is the easiest way to manage Outlook and data security on personal phones. It puts a PIN or Face ID on work apps, stops work data being copied into personal apps, and wipes only the work data from a lost phone. Your personal photos and messages stay private.
• Keep your phone up to date. Turn on automatic updates for the phone and its apps, and replace any phone that no longer gets security updates.
• Report a lost phone straight away. Your IT support can sign it out of Microsoft 365 and remove work data remotely.

A few minutes of setup on each phone makes a real difference to your Outlook and data security, and to your clients’ trust.

How Absolute Technology can help

We’re a local IT company based in Chandler’s Ford, helping businesses across Hampshire keep their data safe on every device their team uses. We can help with:

• A phone and tablet check, so you know exactly which devices can reach your email, Teams and files, including personal ones.
• App protection in Microsoft 365, so Outlook and Teams need their own PIN or Face ID, and work data can be wiped from a lost phone without touching anything personal.
• MFA for every user, set up so it’s quick for your team to use day to day.
• Keeping devices up to date through our managed IT support.
• A one-page mobile phone policy your team will actually read, covering what’s allowed and who to tell if something goes wrong.
• Cyber Essentials and Cyber Essentials Plus certification, from readiness check to certificate.

Call us on 0345 225 1047 or book a meeting with Martin.