What access does my company have to my personal iPhone?

[adrianlondon]

Also suggest cutting out Reddit since it's full of degenerates.

Everywhere is full of degenerates.

 

[bollman]

It looks fairly benign on what it is collecting. But basically when you install an MDM profile you might as well consider the phone the companies phone.

They could require an updated MDM profile that accesses more information, they could wipe your device either accidentally for maliciously - or if they get compromised a hacker could wipe all their connected devices.

Basically I would not accept this kind of thing on a personal device and require the company to provide me with a phone they own and only use it for official company business.

Also suggest cutting out Reddit since it's full of degenerates.

No, they can’t
For more access the device needs to be ”supervised” and that can ONLY happen if the device is registrered for ADE (requires proof-of-purchase for the org) and reinstalled via ADE.
Usually everyone on MacRumors trusts Apple 110% but not in this case? 🤔

 

[Jackbequickly]

It is a bit late to be worrying about this as they have access to everything.

 

[Reverend Benny]

No, they can’t
For more access the device needs to be ”supervised” and that can ONLY happen if the device is registrered for ADE (requires proof-of-purchase for the org) and reinstalled via ADE.
Usually everyone on MacRumors trusts Apple 110% but not in this case? 🤔

Guessing now but it might be that Macrumors readers don't see it as "trust Apple", its prob more a "I don't trust my company" thing.

 

[dominiongamma]

I would just leave my phone at home before I let any employer install their software on my phone. I can’t believe people let companies take control of their phones

 

[MauiPa]

Last place I worked gave employees a monthly stipend for their phones so they could be reachable at home. When company took away stipend for non-executive employees- we rebelled. No one would allow their phones to be used for work purposes. I mean everyone stopped allowing it

Talk about a cheap stupid policy backfiring! Haven’t executives heard that expression “loyalty is a two-way street”? Or are they all just stupid?

 

[ghostface147]

Are they paying for your phone? No? **** them.

 

[mattoruu]

I would just leave my phone at home before I let any employer install their software on my phone. I can’t believe people let companies take control of their phones

Are they paying for your phone? No? Fu¢k them.

Seemingly the OP wants to use their personal phone for work and doesn’t want to use a second work phone.

I could be mistaken about that (it wasn’t directly said), but that’s how I read the OP’s first sentence.

 

[ghostface147]

Seemingly the OP wants to use their personal phone for work and doesn’t want to use a second work phone.

I could be mistaken about that (it wasn’t directly said), but that’s how I read the OP’s first sentence.

You’re right, he doesn’t want two phones. But if he’s hell bent on not using two phones, he has to deal with what his company installs.

 

[AppleTO]

Installing a BYOD MDM profile only allows the company to control company apps, not the entire phone. Access to company apps could be blocked if the OS version is out of date, for example. For full control, a device has to be company owned and in a “Supervised” state. This would never be the case for an employee owned phone. Apple has designed this system to protect the employee’s personal data if they so choose to use their personal device.

 

[Shirasaki]

No, they can’t
For more access the device needs to be ”supervised” and that can ONLY happen if the device is registrered for ADE (requires proof-of-purchase for the org) and reinstalled via ADE.
Usually everyone on MacRumors trusts Apple 110% but not in this case? 🤔

Apple isn’t any different in terms of its fundamental property compared to other companies: for profit and maximise profit. I do trust Apple a little bit more compared to Google but not by a wide margin. It’s like 40% vs 40.5%.

As for ADE, I bet most who visits Apple Store at some point notices some of their heavily managed devices compared to demo devices. Almost everything can get locked down. It would be amazing if some of those managing capabilities are available to more advanced users and more IT admins.

 

[Smigit]

1. Is this normal? My old company didn’t make us install this and we were still able to access our Outlook and Teams account

It is normal, but not a given.

MS Outlook and Teams have pretty robust capabilities to integrate with InTune and apply security at the application level. Admin can enforce MFA and the like for the application and being that you will be using a work account, controls on password and other access policies such as location based can be enforced. If your business is just offering these apps, you may not need a device to be fully MDM managed.

Many apps don’t support such controls by an MDM, so to ensure the integrity of data additional control may be needed to manage the device to enforce PIN policies and the like for a device. It may also be desirable in situations where you want to support things such as pushing certificate based network config and the like to a BYOD device. Enforcing security updates is also another consideration.

Whether the full MDM is necessary or not depends on what services are being offered and the assurance the company is after.

 

[mansplains]

Wow, it is quite obvious that noone here actually works with MDM. And what is even more interesting is that noone here trusts Apple!
MDM is developed by Apple, with privacy in mind. There is NO PERSONAL DATA that can be accessed via MDM. No way, won't happen, not a chance! By design!
What the organisation can see is exactly what is stated in the screenshots. And that data is not something Microsoft (or any other MDM solution) can change. That is exactly what Apple allows the owner of the MDM server to see, nothing more and there is NO WAY to access any other data.
And, to make it even better: you organisation has proper BYOD configuration: on the screen shot of what they can see, look at "if configured by your organisation" is only applicable to devices installed via ADE, which is ony devices bought by the organisation and installed via ADE.

Remember: this is NOT something your company can alter. You get what Apple decides is non-invasive.

I was surprised to see most comments as well. A simple download of Apple Configurator shows everything possible with MDM, it's not as crazy as other users are making it sound.

2. What access to my iPhone does my company have with this installed? Can they see my iMessages, text messages, calls, photos, locations, Apps I’m using (can they see what I’m looking at on Reddit) and what my browsing history is on Safari? Can they also lock my phone, kick me off and delete everything?

This is literally answered in your first, second, and fifth screenshots. What makes you think we wanna read them if you won't? I don't know about you, but I read what's in front of me if I'm concerned about it.

I personally don't use corporate MDM on personal devices. My last company required all onsite devices be "in compliance", so I set up MDM on a phone I left at home, and continued using my phone at work as normal. This was generally to listen to media while I work. I didn't need access to company information on my phone. I'm not sharing my phone with work.

 

[ghsDUDE]

Very normal in corporate environments or any company w/ knowledgable IT and Security groups.

The answer is YES to all the above depending on your company's BYOD (Bring Your Own Device) policies. You agree to these policies by installing the MDM profiles on your device. If you have concerns, perhaps you should review your company policies instead of asking random forum users.

Depends. What computing activities do you perform on your device? Activities you do not wish anyone to know about?

Personally I wouldn’t trust any iPhone that had a MDM installed on it from any company. The phone is now there’s- so to speak.
We’ve been shown over and over and over and over and over again that tech companies for the most part can not be trusted.
How much convincing does a person need?

I would remove that app and the associated MDM profile. It is a bad idea to give the company access on your private phone. If you want access to company information, get a company phone.

I manage mobile devices using Intune at work....and here's my 5 cent.

1. Yes and no, it all depends on how they have set it up. If they are strict and want to make sure devices are compliant they might use this way of making sure of it. A more "lightweight" option is prob what you experiences in the past. Even if you dont onboard/enroll a private device you can set certain requirements such as iOS version, that no jailbroken devices can logon etc.

2. They can reset your phone, absolutely, its part of why they want you to do this. They will be able to see apps (and draw conclusions from what apps you have installed). If they require you to install Defender they can see most of the network activity that goes on on the phone too.

3. I don't think you should be concerned, but I always say, keep your company and private life separate. For many reasons. If you feel that you don't want to share your private life with your company, offboard your phone and ask your IT-dept to delete the profile and get a company phone.

I manage Intune for 20,000 iPhones. I can export all SMS, email, password key chains, browsing history, see your WeedMaps account, and have your location data, your pictures, screenshots, Bumble profile and texts. Pretty much everything. Take that Intune off your phone. Use a browser. Or live a good life without weed and internet chicks.

Installing that profile allows your company to fully manage your device. That said, I’ve seen profiles that exert more control over what you can and can’t do; this profile looks more lightweight.

Regardless, I would never allow any of my personal devices to be enrolled on a corporate MDM. If this is a requirement, as others have suggested, get a separate iPhone with a separate Apple ID or have the company provide a phone they pay for.

In your particular case it was likely possible that your company could have gone the Mobile Application Management (MAM) route with Intune. Sometimes this is referred to MAM-WE where the WE means “without enrollment in MDM.” With that type of setup the company controls corporate data in applications like Outlook and Teams but nothing else. Remote wiping is limited to the corporate data, not the entire phone.

Source: I’m the Intune admin for my company and set this up for our end users last year, including myself. I can’t see anyone’s personal data, their device phone numbers, etc. I can’t locate their devices, I can’t wipe anything but our company data, I don’t know anyone’s Apple ID. And…I don’t want to. It’s creepy to allow company control over personal devices. Intune’s MAM is a good solution for BYOD.

Note: in Intune it’s possible to use MDM *with* MAM for more control over application permissions, but that’s not what we do.

There's many ifs and buts to this, it all depends on how its setup and if the company require more things on the device to be able to access company services.

I would say that most companies don't want to gather more data than whats needed, and for companies, at least in the EU, you don't want to have peoples private data within your company.
The same goes for people that use their company phones for private use, but people choose to ignore looking into why its a bad idea.

If the OP's company would have required the users to install MS defender, then I would have said that sure, they will most likely be analyzing traffic. But even if that would be the case, to dig into what people do browse requires resources and there's generally no reason for doing to.

But....even if traffic isn't analyzed or the company is gathering info, theres still reason to think twice before installing private apps on a company phone or using a private phone the way the OP does.

Apps that are installed gives a good idea on who you are, are you using tinder or grindr? Well then we know your sexual preference.
You installed an app to know when you are ovulating, then you know that someone soon might have kids etc.

Wow, it is quite obvious that noone here actually works with MDM. And what is even more interesting is that noone here trusts Apple!
MDM is developed by Apple, with privacy in mind. There is NO PERSONAL DATA that can be accessed via MDM. No way, won't happen, not a chance! By design!
What the organisation can see is exactly what is stated in the screenshots. And that data is not something Microsoft (or any other MDM solution) can change. That is exactly what Apple allows the owner of the MDM server to see, nothing more and there is NO WAY to access any other data.
And, to make it even better: you organisation has proper BYOD configuration: on the screen shot of what they can see, look at "if configured by your organisation" is only applicable to devices installed via ADE, which is ony devices bought by the organisation and installed via ADE.

Remember: this is NOT something your company can alter. You get what Apple decides is non-invasive.

It is normal, but not a given.

MS Outlook and Teams have pretty robust capabilities to integrate with InTune and apply security at the application level. Admin can enforce MFA and the like for the application and being that you will be using a work account, controls on password and other access policies such as location based can be enforced. If your business is just offering these apps, you may not need a device to be fully MDM managed.

Many apps don’t support such controls by an MDM, so to ensure the integrity of data additional control may be needed to manage the device to enforce PIN policies and the like for a device. It may also be desirable in situations where you want to support things such as pushing certificate based network config and the like to a BYOD device. Enforcing security updates is also another consideration.

Whether the full MDM is necessary or not depends on what services are being offered and the assurance the company is after.

I was surprised to see most comments as well. A simple download of Apple Configurator shows everything possible with MDM, it's not as crazy as other users are making it sound.

This is literally answered in your first, second, and fifth screenshots. What makes you think we wanna read them if you won't? I don't know about you, but I read what's in front of me if I'm concerned about it.

I personally don't use corporate MDM on personal devices. My last company required all onsite devices be "in compliance", so I set up MDM on a phone I left at home, and continued using my phone at work as normal. This was generally to listen to media while I work. I didn't need access to company information on my phone. I'm not sharing my phone with work.

Ok, so after more thought I decided to delete it off my phone. I removed the Management Profile from my phone, did a complete factory reset and set me iPhone up as new. Here’s a screenshot of what it shows now…

1. Is it safe to assume my company no longer has access to my device?

2. Is it possible my company got all the information off my phone in a day? I’m not sure if it starts tracking from the minute it’s installed or backdates everything so it has the entire phone history?

Thanks for the advice and feedback.

 

[JamesMay82]

Another vote for taking it off! Mainly because cos most of us get inappropriate jokes sent to us via what’s app or iMessage and could easily be spied on etc.

Also the work life balance is a thing of beauty when you can fully switch off. My wife works 70 hour weeks and is glued to her phone.. she just said how good it is being fully switched off and in relax mode

 

[mansplains]

Ok, so after more thought I decided to delete it off my phone. I removed the Management Profile from my phone, did a complete factory reset and set me iPhone up as new. Here’s a screenshot of what it shows now…

View attachment 2403149

1. Is it safe to assume my company no longer has access to my device?

2. Is it possible my company got all the information off my phone in a day? I’m not sure if it starts tracking from the minute it’s installed or backdates everything so it has the entire phone history?

Thanks for the advice and feedback.

The factory reset may have been overkill. Your company no longer has access to the device. The answer to your second question would depend on whether your company retains logs, and what their policies are for data deletion. Unless you're a suspicious employee (and in such case, why would they keep you if it's bad enough) I doubt your company was jumping at the sight of your device enrollment. It looks like you removed the screenshots from your original post. It's possible your company scraped all of the data present in those disclaimers, but it's unlikely. If anything, they received device identifiers, and saw your traffic from the day in question.

 

[bollman]

Ok, so after more thought I decided to delete it off my phone. I removed the Management Profile from my phone, did a complete factory reset and set me iPhone up as new. Here’s a screenshot of what it shows now…

View attachment 2403149

1. Is it safe to assume my company no longer has access to my device?

2. Is it possible my company got all the information off my phone in a day? I’m not sure if it starts tracking from the minute it’s installed or backdates everything so it has the entire phone history?

Thanks for the advice and feedback.

What you accepted according to your screenshots are now in the company MDM.
Incredible that people don’t trust Apple on this one. MDM is built from the ground up for just these BYOD situations. Actually, when you apply a BYOD MDM profile the phone is ”split in two” to make sure the ”company” has no access to the private parts.

 

[2Xtreme21]

What info can your organization see when you enroll your device?

Describes the information on your enrolled device that's visible to your organization.

learn.microsoft.com

Lot of fear-mongering in this thread.

 

[TVreporter]

I’d never allow any company to install something on my own phone.

Ask for a work phone. Or go without

 

[Unregistered 4U]

My company posed me with the same question. Take this phone that we’ll pay for the phone and the service for it, plus you can use it for tethering when working OR Give us full access to your personal device.

I chose the former. Even if MY company means no harm, my phone and it’s data could be a part of a legal proceeding brought by some OTHER company that’s just going on a fishing expedition.

EDIT:
And I should add that, even if there’s nothing considered illegal or relevant to the case, just having that information public would be annoying at least.

 

[bollman]

It👏does👏not👏work👏that👏way👏! Stop spreading misinformation.

The ONLY way to gain "full access" (and even that is quite limited with regards to MDM) to an iPhone/iPad is via "Supervised mode".
And your employer CANNOT get your phone into supervised mode unless you hand them your phone and they enroll it in ADE and does a complete wipe/reinstall.

Just by enrolling in an MDM does NOT enable your employer to vacuum your phone for info. There is NO WAY to get any "data" (user data, that is) from an enrolled iPhone, not even in "supervised mode".
There is a clearly defined set of information that the phone can report back to the MDM. This is clearly published here:

GitHub - apple/device-management: Device management schema data for MDM.

Device management schema data for MDM. Contribute to apple/device-management development by creating an account on GitHub.

github.com

The way MDM works is that the MDM quries one of the keys and get a result back, if allowed (check the keys at GitHub,. if it states: "supervised: true" then that info can only be retrieved from a phone in supervised mode). You cannot run scripts, you cannot run programs and get the output.

 

[mattoruu]

Ok, so after more thought I decided to delete it off my phone. I removed the Management Profile from my phone, did a complete factory reset and set me iPhone up as new. Here’s a screenshot of what it shows now…

View attachment 2403149

1. Is it safe to assume my company no longer has access to my device?

2. Is it possible my company got all the information off my phone in a day? I’m not sure if it starts tracking from the minute it’s installed or backdates everything so it has the entire phone history?

Thanks for the advice and feedback.

I would recommend asking the person in charge of this at your company. It’s perfectly-fine to have questions and to ask the relevant person at your company who has the answers.

The people you are asking now… we are just some random people on the internet. We could be giving you some good information. But we also could be giving you some bad misinformation.

 

[bollman]

You are right. It is better to get the info from the source:

User Enrollment and MDM

User Enrollment is designed for BYOD—or bring-your-own-device deployments—where the user, not the organization, owns the device.

support.apple.com

 

[Shirasaki]

I’d never allow any company to install something on my own phone.

Ask for a work phone. Or go without

Yeah. The threat of ability to factory reset is just too scary to ignore.
Even if the company can’t get my personal data, I don’t want my phone to be wiped out without notice either.

 

[Bearxor]

Very normal in corporate environments or any company w/ knowledgable IT and Security groups.

The answer is YES to all the above depending on your company's BYOD (Bring Your Own Device) policies. You agree to these policies by installing the MDM profiles on your device. If you have concerns, perhaps you should review your company policies instead of asking random forum users.

Depends. What computing activities do you perform on your device? Activities you do not wish anyone to know about?

Wow, I thought you were ChatGPT with how confidently wrong you answered that question.