---
title: "Enabling secure, productive work on personal devices"
description: "Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie."
---

# Enabling secure, productive work on personal devices

[Databricks](https://yomu.fyi/company/databricks) · Steven Angle, Brian Schaffner · Sep 18, 2026

**Type:** Explainer

## Summary

Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.

## Context

The central challenge is protecting corporate data on personal phones without inspecting private content or imposing controls appropriate only to company-owned devices. The model addresses mobile BYOD, where employees increasingly use work applications and mobile versions of desktop workflows.

## Approach / What changed

The approach uses four layers: Account-Driven User Enrollment or Android Work Profile for work-personal separation; identity and context-aware authentication using strong passwordless MFA, managed-device status, and a trusted tunnel; ZTNA with per-app VPN and continuous device-posture checks; and managed applications with configurations, tenant controls, secure browsers, and sensitivity-based app tiering. Privacy policies are documented and communicated before enrollment.

## Takeaways

- Account-Driven User Enrollment on iOS manages work components without full control of a personal phone, while Android Work Profile provides comparable separation of work and personal data.
- ZTNA supplements login checks with continuous posture evaluation, using a per-app VPN and default-deny access to block traffic when a device becomes vulnerable or compromised.
- Application controls vary by capability: managed configurations, tenant restrictions, or secure tunnel requirements can contain data, but unsupported apps cannot reliably be distinguished from unmanaged downloads.

## FAQ

### How does the design keep work data separate from personal phone activity?

iOS Account-Driven User Enrollment creates a separate, encrypted workspace linked to a managed corporate identity, while Android uses Work Profile. A per-app VPN routes work traffic through a secure tunnel and keeps personal traffic separate.

### What happens if a managed phone becomes vulnerable or compromised?

ZTNA evaluates device posture continuously rather than only during login. If policy identifies a vulnerable or compromised operating system, it can block the device's work traffic automatically.

### Can every mobile app be fully controlled on a personal device?

No. Reliable enforcement depends on the app or service supporting managed configuration, enterprise controls, or network restrictions. Apps without those capabilities are tiered by sensitivity, and web apps may be routed through an enterprise-managed browser.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Privacy](https://yomu.fyi/topic/privacy), [Security](https://yomu.fyi/topic/security)

- Source: [Databricks](https://www.databricks.com/blog/enabling-secure-productive-work-personal-devices)
- Source URL: https://www.databricks.com/blog/enabling-secure-productive-work-personal-devices
- Ingested by Yomu: 2026-09-18T18:00:12.289Z

[Read original post](https://www.databricks.com/blog/enabling-secure-productive-work-personal-devices)