3 ms·

>There's not a way to track employee internet browsing history out of the box. Some large enterprises use MDM to deploy certificates and proxy policies that es

>There's not a way to track employee internet browsing history out of the box. Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage. Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

cj 7y ago
Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying. I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort. (This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)
- cannonedhamster 7y ago
  Not even sketchy. Monitoring how long techs take on calls is a requirement in some roles for quality assurance and training purposes. Company I worked for had GPS tracking that they used to make it show that one employee was visiting another employees wife because our home base was over street over. It was a funny prank until it wasn't. For g suite location is under Mobile management. They list it as a find my phone type of feature. There's even a picture of it on their marketing.
- helen___keller 7y ago
  I mention this because one of the top use cases for MDMs is deploying said MitM setups. It's common in certain industries, like for banks and for schools. Saying this from experience because I worked for a company that produced both an MDM product and a MitM product. For an MDM solution on iOS there's a big list of supported profiles you can deploy after the MDM profile is installed ( see https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf https://developer.apple.com/business/documentation/MDM-Proto... under "request types"). If the device belongs to the organization, you might not even know these profiles are installed, if it's a BYOD environment you know you are installing the MDM profile and if you open the settings page you can manually inspect which other sub-profiles have been installed by the MDM. But you're right the MitM itself isn't built into the MDM, because that's a totally different product category ("Secure Web Gateway"). The MitM setup only works if you have an MDM to enforce the certificates and proxy setup upon the user.
avh02 7y ago
If I remember correctly, even the isolated work profile can add certificates on android. Probably the only reason I don't use that either.

cj 7y ago

Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying. I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort. (This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

cannonedhamster 7y ago
Not even sketchy. Monitoring how long techs take on calls is a requirement in some roles for quality assurance and training purposes. Company I worked for had GPS tracking that they used to make it show that one employee was visiting another employees wife because our home base was over street over. It was a funny prank until it wasn't. For g suite location is under Mobile management. They list it as a find my phone type of feature. There's even a picture of it on their marketing.
helen___keller 7y ago
I mention this because one of the top use cases for MDMs is deploying said MitM setups. It's common in certain industries, like for banks and for schools. Saying this from experience because I worked for a company that produced both an MDM product and a MitM product. For an MDM solution on iOS there's a big list of supported profiles you can deploy after the MDM profile is installed ( see https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf https://developer.apple.com/business/documentation/MDM-Proto... under "request types"). If the device belongs to the organization, you might not even know these profiles are installed, if it's a BYOD environment you know you are installing the MDM profile and if you open the settings page you can manually inspect which other sub-profiles have been installed by the MDM. But you're right the MitM itself isn't built into the MDM, because that's a totally different product category ("Secure Web Gateway"). The MitM setup only works if you have an MDM to enforce the certificates and proxy setup upon the user.

avh02 7y ago

If I remember correctly, even the isolated work profile can add certificates on android. Probably the only reason I don't use that either.