Yes. Any mobile devices, whether owned by staff or the business, that can access business information are in scope. Email accounts (whether hosted internally or in a cloud provider such as Office365) contain a lot of important business information and are the gateway to many online services so should be carefully protected.