What Can My Employer See With Intune? Personal vs Work Devices

With Intune, your employer sees details about the device, not what is on it. Microsoft's Intune privacy page lists what an organization can always see: the device owner, name, serial number, model, manufacturer, operating system and IMEI. It also sees the work apps it manages. It lists what an organization can never see: calling and web browsing history, email and text messages, contacts, calendar, passwords, pictures, and the content of your documents. That holds on your own phone and on a company-owned one.

What changes on a company-owned device is the rest: IT sees every installed app, the full phone number, and the location of a lost device. On a company Windows PC it can also query file names, running processes and the registry. Other tools that run next to Intune, such as a company VPN or Microsoft Defender, can see more than Intune does.

The broader phone question is in can my employer see what I do on my phone.

What Intune shows your employer

This table follows Microsoft Learn's page "What info can your organization see when you enroll your device" (updated April 2026).

Two lines matter most for the common questions. Can Company Portal see my photos? No, on any device. Can Intune see my texts? No, on any device. Microsoft adds that some setups let an organization see more than the managed app list on a personal device, and tells you to ask your IT admin.

Personal device or company-owned: check which one you are

The ownership type decides which column applies to you. To see it:

• Open the Company Portal app, or the Company Portal website.
• Go to Devices and pick your device.
• Look at Ownership in the device details: Personal or Corporate.

How you enrolled usually tells you too. If you installed Company Portal on your own phone to get Outlook and Teams, it is personal. On iPhone that is often User Enrollment, and on Android it creates a work profile with a briefcase badge on work apps. If the phone or laptop came from your company, or set itself up with company screens when you first turned it on, it is corporate.

What IT can do to the device, not only see

Seeing and doing are different. On an enrolled device, IT can:

• • Push settings and apps. A passcode rule, a Wi-Fi profile, a VPN, required work apps. On Windows, the same channel can set a screen lock after a number of minutes; see computer locks after 15 minutes.
• • Remove work data. On a personal device, a retire or selective wipe removes the work apps, work email and the work profile, and leaves your photos and personal apps.
• • Wipe the whole device. Only on company-owned devices, typically when one is lost or when you leave.
• • Block access. A device that fails a compliance rule, such as an old OS version, loses access to work email and Teams until you fix it.

App protection policies, which some companies use without enrolling the device at all, only reach data inside work apps such as Outlook and Teams. They can stop you copying work text into a personal app, and wipe the work account from those apps.

What Intune does not show, but other tools can

"Intune cannot see my browsing history" is true of Intune. It is not the whole picture on a work device, because IT often installs more through Intune:

• Microsoft Defender for Endpoint on company devices logs network connections and web threats for security teams.

• A company VPN or cloud proxy sees the sites you visit while it is on, and with HTTPS inspection, full pages. See can my employer see my browsing history.

• Edge or Chrome policies apply to the work profile and can report on it.

• Employee monitoring agents record apps, sites and screenshots. How to spot one is in how to tell if you are being monitored at work.

On a personal phone with only Company Portal and work apps, none of these reach your personal apps. A private or Incognito window on a company laptop does not hide from them; see can my employer see my Incognito history.

Keep personal data personal on an Intune device

• Keep personal browsing, photos and messages out of work apps. Intune's reach is the work side.

• On Android, use apps without the briefcase badge for personal things. The work profile is a separate space.

• Do not sign in to personal accounts inside work apps such as Outlook, and do not put personal files in the work OneDrive.

• If your company offers it, choose app protection without enrollment for a personal phone. It manages Outlook and Teams, not the device.

• For a company laptop, assume more is visible; see can my employer monitor my personal computer for what changes when the computer is yours.

FAQ

Can Intune see my browsing history? No. Microsoft lists web browsing history among the things your organization can never see through Intune. A company VPN, proxy or Defender on a work device is a separate tool and can log sites.

Can Company Portal see my photos? No. Pictures, including the camera roll, are on Microsoft's "can never see" list.

Can Intune see my texts or WhatsApp messages? No. Email and text messages are on the same list, and personal apps are outside what Intune manages.

Can Intune track my location? Not on a personal device. On a company-owned device, IT can locate it only when it is lost, and an iPhone in Lost Mode locks and shows a message when that happens.

Can Intune wipe my personal phone? It can remove the work apps, work data and work profile. On a personal iPhone with User Enrollment or an Android phone with a work profile, that is all IT can remove. A full wipe is meant for company-owned devices.

Can IT see my screen with Intune? Not by itself. Intune's Remote Help lets a support person view or control a screen during a session that you accept.