An insurance agent leaves your agency, but work email was available on their personal phone. Can you remove that information without erasing family photos and personal messages?
Microsoft Intune app protection can support selective removal of company data from supported apps. The important question is whether the agency configured that protection before the departure. Buying a license afterward does not establish that an existing copy of a mailbox was protected.
Start with the account, app and ownership
Record which agency account was used, whether the phone belongs to the employee and which app received work email. Outlook on an iPhone, an Android mail app and a browser session are different access paths. Do not assume one control covers them all.
Have the authorized administrator coordinate account access changes with the approved departure time. Preserve business records according to the agency's established requirements before deleting accounts or removing licenses. App cleanup is one part of offboarding, alongside access to carrier portals, shared files and other business systems.
Where Intune app protection fits
Intune app protection policies can protect organization data in supported apps, including appropriate Outlook mobile configurations, without necessarily enrolling the entire personal phone in device management. Your administrator must verify the app, account type, licensing and policy assignment for the actual environment.
A useful pilot checks the employee experience as well as the controls: can a test user read approved work email, understand the work-app PIN and complete normal tasks? Explain the agency's privacy and removal policy before asking staff to use personal phones.
Selective app wipe is different from a phone reset
Microsoft's selective-wipe documentation describes removing company app data while preserving personal data. On Android and iOS, app protection policies must be deployed to enable this capability. An administrator should identify the protected app and user before selecting the action.
This is not a reason to issue a full-device wipe against an employee-owned phone. Confirm ownership, authorization and the intended scope rather than selecting an action by its name alone.
A submitted request is not a completed removal
The protected app must run for removal to occur. Microsoft provides pending, failed and successful request states. An offline phone or an app that is never opened can leave an unresolved task.
Assign someone to review the result and record outstanding exceptions. Do not report that the phone is clean merely because a request was submitted. Account access controls and local data removal solve different parts of the problem.
Know what the control cannot retrieve
Selective removal does not establish that every copy of client information has disappeared. Previously exported files, screenshots or data sent elsewhere require separate assessment. Microsoft specifically notes that Outlook contacts copied onward from the native address book to another external source cannot be wiped through this action.
If the phone used an unprotected app, escalate that gap to the administrator. Avoid promising a retrospective cleanup that the available tools cannot verify.
Build a repeatable agency offboarding check
Identify the agency account, personal devices and approved apps.
Coordinate access changes and record preservation with the authorized owner.
Confirm protection was applied before requesting app-data removal.
Review completion status and document exceptions.
Test the process with a harmless account before the next real departure.
A short test can expose missing assignments or unclear responsibilities before client work depends on the process. Keep test messages fictitious and exclude credentials and policyholder information from support inquiries.
Plan the setup before the next staff change
FMA helps Maryland professional offices scope Intune and device-management work, including ownership requirements, pilot testing and documented onboarding and offboarding workflows.
Discuss a Project with your agency's device mix, email platform and current offboarding process. Based in Columbia, FMA serves Maryland businesses with remote support nationwide. Scope and cost are agreed before paid work begins. A managed IT contract is not required.
