Did you know, in M365 you can set rules for personal devices accessing company data?
Device falls too far behind on updates? Device goes to unauthorised country? –> Remove company data
It requires an Intune license, but that comes as part of a Business Premium license.
Once obtained you can set how personal devices access employee emails/sharepoint/teams.
There’s also benefits for the employee as the work profile cannot see the personal data plus they they pause the work profile, and even set a schedule for when it activates, to stop work notifications outside of work hours or when they’re on annual leave.
Watch it in action in the 6 minute video.
Or go to the microsoft documentation here:
https://learn.microsoft.com/en-us/intune/user-help/enrollment/work-profile-android