4 ms·

As a sidenote: If you have an Android phone and your work uses Gsuite, you may want to double check privileges you're giving your company by being signed into y

As a sidenote: If you have an Android phone and your work uses Gsuite, you may want to double check privileges you're giving your company by being signed into your Android phone. Your employer may be able to wipe your phone, track it, etc. Instead, I installed a different browser dedicated to logging into work email.

SanchoPanda 7y ago
Most of my peers have gotten around to gettng a second phone to not have to keep up on what the current rules are regarding what is and is not private on a device used for work.
- downerending 7y ago
  This is the way to go. Never do personal stuff or expect privacy on any device your employer is touching.
- londons_explore 7y ago
  I'd much rather have my work 'device' be a VM on my home phone. Sadly virtual machines on phones are prevented pretty thoroughly by the android/iOS system design, at least in any kind of efficient way. "Work profiles" don't really cut it...
distances 7y ago
Also, Google Chat doesn't have a mobile web version. If your company uses it you'll probably have to choose between allowing the company access your phone, or limiting your Chat usage to computers. For me the latter was an easy decision, also helps to draw the line between working and time off.
legitster 7y ago
In my version of Android, my work account and related privileges are cordoned off to it's own section on my phone.
- kyrra 7y ago
  Work Profiles is the feature: https://developer.android.com/work/managed-profiles https://developer.android.com/work/managed-profiles I recently had to wipe my phone and changed from full-access to work profiles and it's nice to have that clean division between my work account and personal.
Someone1234 7y ago
If your employer enrolled "your" phone in MDN/Device Management, then they can do whatever (inc. remote wipes). But more than likely it is their phone if they did that. Simply logging into GSuite doesn't allow that. Individual apps can wipe their own data, but apps don't have the arbitrary ability to wipe the entire phone. Even Google's apps. To quote the docs: > [0] Before you can wipe a user’s mobile device, you need to turn on mobile management. For details, see Set up mobile device management[1]. PS - I'm responding because this myth that simply retrieving GSuie/Office 365 email allows device wipes just won't die. That isn't how any of this works. Enterprise device management requires special device enrollment, simply signing into a random email app isn't it. [0] https://support.google.com/a/answer/7542661?hl=en https://support.google.com/a/answer/7542661?hl=en [1] https://support.google.com/a/answer/7396025?visit_id=637217898165462811-3603968334&rd=1 https://support.google.com/a/answer/7396025?visit_id=6372178...
- csours 7y ago
  My employer requires MDM before allowing email client access. They don't require it for webmail access.
  - reallydontask 7y ago
    My employer is the same, which is awesome because it means when I turn off my laptop that is the end of the day for me :)
- morbm 7y ago
  On Android, in the old days, an app could be registered as a "Device Administrator". When you set up an Exchange account on the device, the email client requested the user to activate device admin before it would sync email. If the user clicked the activate button, the email client would have permission to reset password/wipe device, etc. [0] This didn't require enrolling into any MDM software. [0] https://developer.android.com/guide/topics/admin/device-admin https://developer.android.com/guide/topics/admin/device-admi...
- benhurmarcel 7y ago
  It's quite common in my experience to require enrollment to be able to get access. And it's not always the company's device, employees can choose to enroll their own devices if they want mobile access.
saagarjha 7y ago
This also extends to iPhones, depending on the way your company's MDM is set up.
Spoom 7y ago
Having added a few work accounts to my phone over the years, the verbiage that the phone gives you is at least very specific (at least on Android) as to what power the employer has with your phone. At one point, a prior employer tried to require device management to sign into their GSuite email, and I got a prompt saying that it was required and that they could wipe my phone at will. I then removed that account from my phone and told my employer why. They backed off of that policy and later set up one less broad (i.e. they could wipe the account, but not the entire phone). Nowadays most setups allow employers to wipe the work profile but not the whole phone (and again, this is explicitly stated to the user upon adding the profile). Disclaimer: Now a Googler, opinions are my own.

SanchoPanda 7y ago

Most of my peers have gotten around to gettng a second phone to not have to keep up on what the current rules are regarding what is and is not private on a device used for work.

downerending 7y ago
This is the way to go. Never do personal stuff or expect privacy on any device your employer is touching.
londons_explore 7y ago
I'd much rather have my work 'device' be a VM on my home phone. Sadly virtual machines on phones are prevented pretty thoroughly by the android/iOS system design, at least in any kind of efficient way. "Work profiles" don't really cut it...

distances 7y ago

Also, Google Chat doesn't have a mobile web version. If your company uses it you'll probably have to choose between allowing the company access your phone, or limiting your Chat usage to computers. For me the latter was an easy decision, also helps to draw the line between working and time off.

legitster 7y ago

In my version of Android, my work account and related privileges are cordoned off to it's own section on my phone.

kyrra 7y ago
Work Profiles is the feature: https://developer.android.com/work/managed-profiles https://developer.android.com/work/managed-profiles I recently had to wipe my phone and changed from full-access to work profiles and it's nice to have that clean division between my work account and personal.

Someone1234 7y ago

If your employer enrolled "your" phone in MDN/Device Management, then they can do whatever (inc. remote wipes). But more than likely it is their phone if they did that. Simply logging into GSuite doesn't allow that. Individual apps can wipe their own data, but apps don't have the arbitrary ability to wipe the entire phone. Even Google's apps. To quote the docs: > [0] Before you can wipe a user’s mobile device, you need to turn on mobile management. For details, see Set up mobile device management[1]. PS - I'm responding because this myth that simply retrieving GSuie/Office 365 email allows device wipes just won't die. That isn't how any of this works. Enterprise device management requires special device enrollment, simply signing into a random email app isn't it. [0] https://support.google.com/a/answer/7542661?hl=en https://support.google.com/a/answer/7542661?hl=en [1] https://support.google.com/a/answer/7396025?visit_id=637217898165462811-3603968334&rd=1 https://support.google.com/a/answer/7396025?visit_id=6372178...

csours 7y ago
My employer requires MDM before allowing email client access. They don't require it for webmail access.
- reallydontask 7y ago
  My employer is the same, which is awesome because it means when I turn off my laptop that is the end of the day for me :)
morbm 7y ago
On Android, in the old days, an app could be registered as a "Device Administrator". When you set up an Exchange account on the device, the email client requested the user to activate device admin before it would sync email. If the user clicked the activate button, the email client would have permission to reset password/wipe device, etc. [0] This didn't require enrolling into any MDM software. [0] https://developer.android.com/guide/topics/admin/device-admin https://developer.android.com/guide/topics/admin/device-admi...
benhurmarcel 7y ago
It's quite common in my experience to require enrollment to be able to get access. And it's not always the company's device, employees can choose to enroll their own devices if they want mobile access.

saagarjha 7y ago

This also extends to iPhones, depending on the way your company's MDM is set up.

Spoom 7y ago

Having added a few work accounts to my phone over the years, the verbiage that the phone gives you is at least very specific (at least on Android) as to what power the employer has with your phone. At one point, a prior employer tried to require device management to sign into their GSuite email, and I got a prompt saying that it was required and that they could wipe my phone at will. I then removed that account from my phone and told my employer why. They backed off of that policy and later set up one less broad (i.e. they could wipe the account, but not the entire phone). Nowadays most setups allow employers to wipe the work profile but not the whole phone (and again, this is explicitly stated to the user upon adding the profile). Disclaimer: Now a Googler, opinions are my own.