Your IT team sends an email on a Tuesday afternoon. Install Company Portal on your phone, it says. It will take five minutes. So you install it. Then you sit there looking at your phone, thinking about the photos on it, the text messages, the browsing history, the personal email, and you wonder about Intune privacy concerns and what is visible to your boss or Microsoft.
That reaction is normal and it is reasonable. We deploy Microsoft Intune for small business teams every month, and the same question reaches us within a day of every rollout, usually from someone who feels a bit awkward asking it. There is nothing awkward about it. It is your phone. You are allowed to want a straight answer.
Here is the straight answer, taken from Microsoft’s own documentation rather than from anyone’s reassurance.
The Short Answer: No, Your Employer Cannot Read Your Personal Content
Intune is a device management tool. It checks whether a device meets the security rules a business has set, and it manages work data on that device. It is not a surveillance tool, and it does not give your employer a window into your personal life.
Microsoft states plainly that your organization can never see your calling and web browsing history, your email and text messages, your contacts, your calendar, your passwords, your pictures including the camera roll, or the content of documents you create (Microsoft Learn, 2026) https://learn.microsoft.com/en-us/mem/intune/user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune
Not “should not”. Not “will not without permission”. Cannot. Those categories are not exposed to the administrator at all.
What Your Employer Can Never See
This list does not change based on settings, licence, or how strict your company is. It is a hard limit in the product.
- Calling and web browsing history
- Email and text messages
- Contacts
- Calendar
- Passwords
- Pictures, including the photos app and camera roll
- The content of documents you create
Your holiday photos, your family group chat, and the site you visited at midnight are not visible to anyone at work. There is no toggle an administrator can flip to change that.
What Your Employer Can Always See
This is the part people expect to be sinister and it turns out to be an inventory list.
- Device owner
- Device name
- Device serial number
- Device model, for example iPhone 15 or Google Pixel
- Device manufacturer
- Operating system and version
- Device IMEI
That is what a business needs to answer basic questions. Is this device running a supported operating system. Has it been updated. Is it the device we think it is. None of it says anything about you.
Where It Depends: Who Owns the Device
This is the distinction that matters most, and it is the one nobody explains at rollout. A personal phone you brought from home is treated differently from a laptop the company bought and handed to you.
On a personal device, Microsoft documents the limits as follows. Your phone number shows only the last four digits. Your location cannot be seen, because personal devices cannot be located. App inventory is limited to managed work apps, so the personal apps on your phone stay out of view (Microsoft Learn, 2026).
On a company-owned device the picture changes, and we would rather tell you than let you find out later. Location can be visible. The full phone number is visible. The full app inventory is visible. On company-owned Windows computers specifically, an administrator can also see hardware details, certificates, file paths, user and group information, the registry, event logs, and running processes.
That is a meaningful difference, and it is a fair one. A laptop the business bought, owns, and is legally responsible for sits under a different expectation than the phone in your pocket. If you are unsure which category your device falls into, ask. It is a one sentence answer and any competent IT team will give it to you.
Why Your Employer Is Doing This at All
Almost nobody deploys device management because they are curious about their staff. They deploy it because of one of three pressures, and it is usually the third.
Passwords stopped being enough. Most break-ins we get called into started with a working set of stolen credentials, not with a virus. The attacker signs in as a real person, from a real password, and traditional two factor authentication does not always stop them. Checking whether the device is known and healthy is one of the few things that does.
Devices leave. Phones get lost in taxis. People change jobs. Without device management, the work email and client files on that phone leave with it and there is no way to remove them. With it, the work data can be wiped while your personal data is left untouched.
Someone asked for proof. This is the common one now. A large client sends a security questionnaire, or an insurer asks what controls are in place, and the questions are no longer about policies. They are about evidence. Device management produces that evidence. Your employer is often not choosing this so much as being required to, in order to keep a contract that pays your salary.
If You Are Still Uncomfortable, Here Is What To Do
Ask three questions. Any organized IT team answers all three quickly, and the answers tell you a great deal.
- Is this device registered as personal or company-owned?
- If my phone is wiped, does it remove everything or only work data?
- Where is the written policy that says what the company does with this?
There is also a simpler route many people do not realise exists. If the only work thing on your personal phone is email, ask whether you can keep work off your phone entirely and use it on your work computer instead. Some businesses say yes without hesitation. It is worth asking before you assume the answer is no.
If You Are the Business Owner Rolling This Out
Staff resistance is the most common delay in an Intune deployment, and it is almost always caused by silence rather than by the tool. The rollout email says install this, and it does not say what the company can and cannot see. People fill that gap with the worst thing they can imagine.
Send the can and cannot lists before you send the enrolment link. Say clearly which devices are personal and which are company-owned. Put it in writing, once, and the objections mostly do not arrive. We now do this as a standard step for every client rollout, because we learned the hard way that answering the question after it is asked costs three times as much time as answering it first.
If you are deciding whether to manage staff devices at all, our guide on staff using personal devices for work covers the risks and the practical options. If you are already in Microsoft 365 and want the controls configured properly, that work sits in our Microsoft 365 security services.
Common Questions About Intune and Company Portal
Does Intune spy on you?
No. Microsoft documents that an organization can never see your calling and web browsing history, email and text messages, contacts, calendar, passwords, pictures or the content of your documents. Intune checks device security settings and manages work data. It does not read personal content, and there is no administrator setting that changes this.
Is the Company Portal app safe to install on a personal phone?
Yes. Company Portal is Microsoft’s own app and it is the interface for Intune on mobile devices. On a personal device it can see the last four digits of your phone number, basic device details such as model and operating system version, and the inventory of managed work apps. It cannot see your location, your personal apps, your messages or your photos.
Can my employer track my location through Intune?
Not on a personal device. Microsoft states that personal devices cannot be located. Location is visible on company-owned devices only. If you are unsure how your device is registered, ask your IT team to confirm whether it is enrolled as personal or corporate.
If my employer wipes my phone, do I lose my personal photos?
It depends on which type of wipe is used. A selective wipe removes company data and leaves personal data in place, and this is the normal choice for a personal device. A full factory reset removes everything, and it is normally reserved for company-owned devices. Ask your IT team which one applies to your device and get the answer in writing.
Can my employer see what apps I have on my personal phone?
Only the managed work apps. Microsoft limits app inventory on personal devices to the managed app inventory, so personal apps stay out of view. On company-owned devices the full app inventory is visible, with the exception of Android work profile devices, where only work profile apps are shown.
The Point of All This
Device management exists so that a business can trust the devices reaching its data, without reading anyone’s messages. Those two things are not in conflict, and the confusion mostly comes from nobody explaining the difference at the point where people are asked to install something.
If you are setting this up for your team and you want it configured so that it protects the business without upsetting anyone, we do this work every month. Call us at (416) 292-3300 to book a free discovery call, and we will walk through what it looks like for your setup.
