Years ago, I worked in the IT department at a university that brought in an MDM for accessing work email on personal devices with a policy of wiping the phone if you got your unlock code wrong 3 times. I refused to use it on my personal device and told the head of the department that it was far too risky as you could accidentally do this with the phone in your pocket. He disagreed, but less than a week later, this exact thing happened to him, got his unlock wrong 3 times, phone wiped, no backup done. He still refused to change the policy even with the inconvenience it caused him. I just laughed.

"you're welcome to try"

hands over my brain-dead flip phone with no 'app' capability

I used to have Teams and Outlook on my phone, so I was accessible for work at almost any time. I know a lot of people think that's dumb, but I was an hourly employee so I never minded the occasional work ping after hours, since I didn't mind getting paid to reply with a few sentences from my couch. It worked out well for both me and my company.

Then they decided to make MDM mandatory on your phone to access Teams and Outlook. I declined the install and removed both apps from my phone. Now I can easily miss IMs for weeks at a time if I don't open a 2nd laptop to check them. I'm more disconnected than I've ever been, which is probably better for my mental health. I don't bill as much as I used to, but that's fine for me.

I eventually caved and installed stuff on a Pixel 1.

If they wanted a phone with security updates they would have given me one.

The solution for their use should have been standard TOTP and/or yubikey. But apparently some vendor came in with a fancy PowerPoint for their proprietary project.

You're fired

That's the whole point of work profiles and company owned devices. This Joelle just has no idea what she's talking about.

You literally can't "just install an MDM" to your phone in the way that allows a company complete access to your device. Both iOS and Android require that either the device is new or the device is factory reset. Then and only then can the device have MDM enabled as a "Company Owned Device" e.g. complete access.

The other way, is through "Work Profiles", it's an isolated and sandboxed partition. The "Work side" has no access to anything on the personal side and the personal side has no access to anything on the work side. On Android the work side has its own Play Store, its own Chrome, its own apps. (In fact, if you're rooted you can hijack the work profiles feature for yourself if you want to install apps you'd rather keep isolated, like TikTok).

If I issue a wipe command to a phone with a work profile, only the work profile gets wiped and the personal side is untouched. An employer utilizing work profiles only has visibility and control within the work profile, the rest of the phone might as well not exist

Hell, Android even gives you the ability to restrict the Work Profiles to work hours so all the work apps go dormant after 5

So with MDM, the company can essentially wipe that device remotely in the case that something like that occurs. Not that it's the best option. Still think companies should just provide the hardware. But that's the protection in that case.

She was recording herself, sending the video file, then deleting the file from the phone. Our phones are configured to immediately back up, so (I am assuming) that while she put together the e-mail or text, our phone was dutifully doing its job.

May want to double check with your IT department. There's another comment in this thread going into more detail but your IT department could have it setup to install to and only wipe a sandboxed partition of your phone in a work profile not the entire device. I think my company docs or the app say full remote wipe but people confirmed it's just the sandboxed portion. That being said I personally didn't install the apps on my device.

This depends on the configuration of the MDM and the MDM vendor. For example, most MDM deployments to Android for instance conform to Android For Work, which functions in practice to a virtual machine from a user's perspective, and doesn't have access to a non workspace content. iOS has a similar functionality which, while less commonly used, is there specifically for use on personal devices to sandbox off 'work' content where pervasive features like factory resets and access to phone logs and sms records don't function, and you can't access the more advanced features without having purchased the device via a corporate account.

SimpleMDM has a credit card-less trial which you could set up to see what features exist and how they work from the vendor side. You won't have access to some of the 'supervised' features without being a business,but you can see the buttons offered when you aren't a corporate-purchased device readily enough.

For corporate owned devices, the rules are very different though.

I have a little experience with Microsoft’s intune and there are different ways to register devices. Someone feel free to correct me because I don’t feel like logging in to double check. Company owned devices have more control and can restrict apps, lock, full wipe, etc. Personal or “bring your own” devices are much less restricted. I can’t lock, wipe, or restrict apps. For the personal devices, it’s more about giving secure access to the companies resources and not really controlling the device. I work for a small business and only use this to setup access to non important documents for employees in the field so I know just enough to be dangerous.

I can’t read your emails, text messages, I can’t remote into your phone without your permission. The info we have is very limited. You know how we can see that information? If you gave us your phone and password :-)

I’m not sure what MDM you’re subjected to but I’ve been an MDM engineer for 7 years using Intune and JAMF and no, no SMS or phone records. Even the phone # is blanked out minus the last 4 digits. Yes we can wipe the devices if it’s lost\compromised but personal versus corporate owned devices are limited. I can’t see what apps you have that were personally installed. And the only info I can get are the device stats (SN, IMEI, storage, battery, memory, etc).

Please cite any one of your sources. I've managed MDM for over a decade and you're spreading misinformation.

Absolutely none of the MDM products on the market allow for the reading of personal e-mail, SMS, phone records, etc. On the contrary, almost every single one provides an information screen during the enrollment that makes it abundantly clear that they do not (and can not) access that data. Moreover, the "wipe" of data is the removal of company data. It doesn't wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.

Quick Sources for Intune and JAMF -- do your own googling for others:
https://learn.microsoft.com/...
https://www.jamf.com/...

Blaming the MDM for this is a bit off the mark. You literally get a "Digital Wellbeing" setting you can use to set hours for your work profile on Android.

I'm not saying that concerns about installing an MDM aren't good to have or consider, just that it makes no difference to your personal choice of when to be accessible to work.

An MDM work profile is much easier to set that boundary with than being logged into the apps directly.

Tell your partner you want them to try the setting.

https://support.google.com/...

You may want to pause your work profile when you're not working. For example, at the end of your workday, over the weekend, or when you're on vacation.

When your work profile is paused, work apps won't run, generate notifications, or consume data and battery life. You also won't be able to access work apps or widgets. If you try, you'll see a message asking if you want to turn your work profile on again.

You can pause a work profile on Android at any time and it won't let you open them until the user decides to run them again

Your partner doesn't disable the work profile because they don't want to, not because they can't (Or can't because of company policy/culture)

In fact, if you're rooted you can hijack work profiles for yourself if you want to install apps you'd rather keep isolated, like TikTok

You can use Shelter to enable this functionality without root.

https://f-droid.org/packages/net.typeblog.shelter/

Some companies that have it set up incorrectly use the personal profile. If you join a company and they don't have you set up on a work profile you know their it practices are not the best

Even if she is factually wrong about everything isn't it a good idea to get people to think more about what they put on their phones?

Exactly.

These services are containerised on personal devices so that its services can only be administered within the app container.

It has limited to no control over the phone itself or apps outside of its MDM container in the context of personal devices.

There's also the option for MAM apps as well which I quite like as light touch management option for ios and android. Essentially limits control to select apps and even then just the company data in those apps.

Thank you for summing this up. Such a dumb post.

How do you schedule your work profile? I searched my settings for work profile related settings and don't see anything like that. Pixel 7A

But there was no alternative clock in option if you refused or didn't have a phone?

So curious, did your job listing mention you needed to own a smartphone as a requirement? Feels like they are probably riding a line where this is made to "feel" required, but legally they are careful of their wording or they may have some issues with your local labor board.

Typically, the app needs to ask for permissions like that, though. On Android, they need to ask to become a "Device admin", and they need to specify what specifically they'll use that access for. I imagine (though I'm unsure since it's never happened to me) they need to ask to update those permissions if they want their uses to change.

Sadly you won't always have a choice. My university has disabled any non-Microsoft client support. They do this to "protect the privacy of the teachers". Currently I'm running a windows VM on my server with Outlook to forward the emails to my personal email. Which in the end is even worse for them GDPR wise

Yep. Work profile and apps are completely disparate, and it's actually kind of tough to transfer any data across the boundary even if you wanted to. Any time I need to send a picture to my work Slack I have to remind myself to use the work profile camera app.

It's the same tech that powers the Secure Folder thing in Android devices. My older S8 was on Android 8 or 9 and still had this functionality, so I'm not sure how old you'd have to go to have a less secure setup.

I think this mastodon post is inaccurate.

Surprised I had to scroll this far to find this!

There's a difference between setting up a work profile and just installing mdm on your main profile. I'd still try and stay away from it if you can