Enabling secure, productive work on personal devices

At Databricks IT, our vision is to empower people to work from anywhere without putting company data at risk. On mobile devices, the focus has shifted from merely checking email to getting real work done. People use Slack, approve requests, and access internal apps on their personal phones, and they expect it just to “work”. Additionally, the proliferation of AI Agents and tools like Genie, Omnigent, and Claude Code has shifted the way people work, with a growing desire to move desktop sessions to phones on the go to avoid losing deep work and context. Mobile BYOD makes that harder, because work and personal life share the same device. A personal phone is different from a company laptop. We, as in Databricks, do not own it, certain access cannot be restricted, and we have no right to view its contents. The challenge we set out to solve was simple to state and hard to do: protect corporate data on devices we don't own, without ever intruding on user privacy.

This post walks through how we approach mobile security internally. Instead of focusing on just one product, our approach consists of four layers, each serving a specific purpose: device management, authentication, zero trust, and application management.

Before securing a phone, we must establish a trusted method for installing apps, configuration profiles, certificates, and security policies. This is achieved through Mobile Device Management (MDM), the foundational layer on which all other components rely.