Databricks IT aims to let people work from anywhere without risking company data, noting mobile use has shifted from checking email to real work such as Slack, approvals, and internal apps on personal phones, while AI Agents and tools like Genie, Omnigent, and Claude Code increase the desire to move desktop sessions to phones. Mobile BYOD complicates this because work and personal life share one device; Databricks does not own personal phones, cannot restrict certain access, and has no right to view their contents. The challenge is protecting corporate data on devices it does not own without intruding on privacy. Its internal mobile security approach has four layers: device management, authentication, zero trust, and application management. For device management, it uses Mobile Device Management (MDM) as the foundational layer, choosing Account-Driven User Enrollment (ADUE) on iOS for bring your own device and avoiding full device management on personal phones; user enrollment manages only work-related components, never the device itself. Enrollment creates a separate, encrypted workspace for work data linked to a managed corporate identity, while personal apps, photos, and messages remain private and inaccessible. On Android, the Work Profile offers comparable separation. MDM is a starting point, not the finish line; identity and access determine access, with authentication and context-aware signals acting as gatekeeper for every company resource through the identity provider, and no request granted on identity alone.