6 ms·

Does Amazon provide company phones or just install an MDM profile on your personal phone? I have TikTok installed on my phone, and if my employer said I had to

Does Amazon provide company phones or just install an MDM profile on your personal phone? I have TikTok installed on my phone, and if my employer said I had to remove it to access my work email, I'd ask them to buy me a work phone. It seems a bit ridiculous that they'd want to control what apps you download on your personal device without providing an alternative.

ziddoap 6y ago
I'll admit I don't know the specifics beyond what was tweeted. I'm with you though... If an employer wants to manage my device, they can provide the device.
- jkaplowitz 6y ago
  When I worked at Google over 5 years ago, mobile device options for accessing company accounts were a company-provided and company-owned device with a company-paid phone bill, a personal device with company-provided mobile device management (and sometimes cell phone bill expensing if you for example had on-call duties), a personal device with only limited browser-based work account access, and no account access via mobile. The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.
  - jeffbee 6y ago
    The third option - accessing only browser sites - is under appreciated. I never needed to install Google's MDM on my mobile devices, I just used mobile web gmail and so forth. It's great, honestly, and the mobile web Calendar has the advantage that it doesn't destroy your battery life like the Calendar app will. I even saw a guy using the code review site on his mobile, on BART. That was dumb from the standpoint of infosec, usability, and mental health, but shows how much is possible in the browser.
    - ghaff 6y ago
      Part of me thinks that MDM on employee phones has become a something of a checkbox item because customers ask for it but it's not clear to what extent it really protects sensitive customer data (which is what they're concerned about).
      - jeffbee 6y ago
        It is literally a checkbox item for PCI DSS.
        prteja11 6y ago
        Can you share the requirement from PCI DSS? [it's not]
        jeffbee 6y ago
        Like most normal people I have no idea what PCI DSS requires. All I know is what the PCI compliance inquisitor says it says, or really what my risk management guy says the compliance guy says it says. And what’s the difference? If he says he says it says we have to have MDM on BYOD, it’s not like I’m going to write a first-principles rebuttal.
    - mikepurvis 6y ago
      Having the code review app available outside of the corp network / VPN is pretty unusual, at least for shops who aren't just using SaaS services that are available publicly anyway (github, gitlab.com, etc).
      - jeffbee 6y ago
        You must have missed their "zero trust" initiative. """BeyondCorp began as an internal Google initiative to enable every employee to work from untrusted networks without the use of a VPN.""" https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
  - Spoom 6y ago
    Nowadays, at least on Android (though I think iOS has something similar now?), one can have a work profile, and the employer can only control activity in / monitor / wipe that profile. Most employers have switched to that for personal devices. Disclaimer: Googler, opinions my own.
- aboringusername 6y ago
  With all the security implications there could be, I would just refuse to use or own a smartphone in any capacity if it's related to work, unless there was no camera, mic, or GPS sensor (or they could provide hardware switches). Seriously, they could be logging your exact location, remotely activating the camera or doing any number of disgusting things. Requiring the use of a spy should not be a factor in an employment setting, of course we're seeing this is the case and it is very offputting. Thankfully not something I need to worry about though.
  - Xylakant 6y ago
    Apples iOS MDM framework is exemplary in that regard. Access to the camera is not possible. Access to GPS is only possible if the device is marked as lost, which will visibly change the lock screen. Even when lost mode is deactivated, GPS access that happened during lost mode is highly visibly marked on the lock screen. Installing an app that relays GPS and camera may be possible, but permissions need to be granted by the user explicitly- the MDM server cannot grant those permissions.
    - GekkePrutser 6y ago
      I don't think Apple is the best at this. Yes they limit the things you mention, but they don't limit visibility to things like the app list... This can already be quite revealing in some cases. Google has in my opinion the better approach with work profile. Only give the MDM control and visibility over the work area and nothing else. Apple has started heading into this direction with User Enrolment but it's not sufficient for most companies as it only allows built-in apps to be used for both work and personal data. And it requires Apple account federation which is problematic.
  - smabie 6y ago
    You don't have a work laptop?
haalia 6y ago
Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.
- filoleg 6y ago
  > Does Amazon provide company phones or just install an MDM profile on your personal phone? > Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise. Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately. So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured). However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this. There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time. But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.
  - haalia 6y ago
    Yes, you're correct, and I didn't mean to imply that MSFT forces employees to install their MDM on personal devices. It was optional for me as well, with a large full-disclosure prompt stating that they can remotely wipe your device if you proceed with mobile setup.
unethical_ban 6y ago
At my company, you have to provide your own device, but the phone number/plan is either (a) paid for by the company, or (b) you get a $40/mo stipend for cell service. It turns out that I can use our 2FA app without MDM, on my personal. And nowadays, I rarely use slack or email from mobile, and I don't get calls. I am pretty strong in the "don't put company stuff on personal devices" camp. Even if they don't control your phone by policy, they do technically. They put root certs on the device, and though they can't see individual app data (depending on config) they can see a list of installed apps, and enforce certain baselines.
ta20200710 6y ago
Amazon has MDM (Airwatch). AFAIK there are not generally company phones or phone plans. Monthly limit on reimbursement for phone business expenditures in the US is $50, although I think you can also expense the device itself.
dickjocke 6y ago
No Amazon generally does not provide you a company phone, at least not when I was there.
nixass 6y ago
If your job requires it, you will get it. It's been like that for a while now
yumraj 6y ago
No, they are controlling the environment under which their company emails can be accessed. If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device. Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.
- chooseaname 6y ago
  If any company expects me to access my work email while mobile, they have to provide a phone. I never mix work and personal. I've also never had a company say no to that.
  - cheonic729 6y ago
    > If any company expects me to access my work email while mobile, they have to provide a phone. No they don't. If you don't like it, switch employers.
    - Assumer 6y ago
      Pretty sure that's what he's saying. The company gets to choose between dropping the requirement, providing a phone or hiring/retraining.
    - sdoering 6y ago
      Depends on the jurisdiction. In Germany they do. Labor rights explicitly says that your employer needs to provide the means for you to do your work. And that includes mobile phones if they want you to access your work email (or whatever) from a mobile device.
      - GekkePrutser 6y ago
        Yes they do... The problem is some users in Germany actually prefer to use their personal one so they don't have to carry two.. But due to this mindset they can't. I don't think the German approach is always the best.
spelunker 6y ago
There's also no requirement to have your business email on your phone, at least in my organization in Amazon. I'm happy to leave it off and not worry about any issues like this. Of course I do have other apps directly related to work... I guess those aren't an issue if I had TikTok?
- foolfoolz 6y ago
  i haven’t had work email on my phone in 7 years. it has not impacted my career negatively
  - smabie 6y ago
    How do you know?
Sodman 6y ago
Most companies I've worked for wouldn't provide a work phone and there's no explicit expectation that you read or answer work e-mails on your phone. But like everything else, if you don't read/reply to work e-mails on your phone, and your colleagues do, good luck getting that promotion/raise/bonus.

ziddoap 6y ago

I'll admit I don't know the specifics beyond what was tweeted. I'm with you though... If an employer wants to manage my device, they can provide the device.

jkaplowitz 6y ago
When I worked at Google over 5 years ago, mobile device options for accessing company accounts were a company-provided and company-owned device with a company-paid phone bill, a personal device with company-provided mobile device management (and sometimes cell phone bill expensing if you for example had on-call duties), a personal device with only limited browser-based work account access, and no account access via mobile. The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.
- jeffbee 6y ago
  The third option - accessing only browser sites - is under appreciated. I never needed to install Google's MDM on my mobile devices, I just used mobile web gmail and so forth. It's great, honestly, and the mobile web Calendar has the advantage that it doesn't destroy your battery life like the Calendar app will. I even saw a guy using the code review site on his mobile, on BART. That was dumb from the standpoint of infosec, usability, and mental health, but shows how much is possible in the browser.
  - ghaff 6y ago
    Part of me thinks that MDM on employee phones has become a something of a checkbox item because customers ask for it but it's not clear to what extent it really protects sensitive customer data (which is what they're concerned about).
    - jeffbee 6y ago
      It is literally a checkbox item for PCI DSS.
      - prteja11 6y ago
        Can you share the requirement from PCI DSS? [it's not]
        jeffbee 6y ago
        Like most normal people I have no idea what PCI DSS requires. All I know is what the PCI compliance inquisitor says it says, or really what my risk management guy says the compliance guy says it says. And what’s the difference? If he says he says it says we have to have MDM on BYOD, it’s not like I’m going to write a first-principles rebuttal.
  - mikepurvis 6y ago
    Having the code review app available outside of the corp network / VPN is pretty unusual, at least for shops who aren't just using SaaS services that are available publicly anyway (github, gitlab.com, etc).
    - jeffbee 6y ago
      You must have missed their "zero trust" initiative. """BeyondCorp began as an internal Google initiative to enable every employee to work from untrusted networks without the use of a VPN.""" https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
- Spoom 6y ago
  Nowadays, at least on Android (though I think iOS has something similar now?), one can have a work profile, and the employer can only control activity in / monitor / wipe that profile. Most employers have switched to that for personal devices. Disclaimer: Googler, opinions my own.
aboringusername 6y ago
With all the security implications there could be, I would just refuse to use or own a smartphone in any capacity if it's related to work, unless there was no camera, mic, or GPS sensor (or they could provide hardware switches). Seriously, they could be logging your exact location, remotely activating the camera or doing any number of disgusting things. Requiring the use of a spy should not be a factor in an employment setting, of course we're seeing this is the case and it is very offputting. Thankfully not something I need to worry about though.
- Xylakant 6y ago
  Apples iOS MDM framework is exemplary in that regard. Access to the camera is not possible. Access to GPS is only possible if the device is marked as lost, which will visibly change the lock screen. Even when lost mode is deactivated, GPS access that happened during lost mode is highly visibly marked on the lock screen. Installing an app that relays GPS and camera may be possible, but permissions need to be granted by the user explicitly- the MDM server cannot grant those permissions.
  - GekkePrutser 6y ago
    I don't think Apple is the best at this. Yes they limit the things you mention, but they don't limit visibility to things like the app list... This can already be quite revealing in some cases. Google has in my opinion the better approach with work profile. Only give the MDM control and visibility over the work area and nothing else. Apple has started heading into this direction with User Enrolment but it's not sufficient for most companies as it only allows built-in apps to be used for both work and personal data. And it requires Apple account federation which is problematic.
- smabie 6y ago
  You don't have a work laptop?

haalia 6y ago

Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.

filoleg 6y ago
> Does Amazon provide company phones or just install an MDM profile on your personal phone? > Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise. Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately. So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured). However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this. There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time. But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.
- haalia 6y ago
  Yes, you're correct, and I didn't mean to imply that MSFT forces employees to install their MDM on personal devices. It was optional for me as well, with a large full-disclosure prompt stating that they can remotely wipe your device if you proceed with mobile setup.

unethical_ban 6y ago

At my company, you have to provide your own device, but the phone number/plan is either (a) paid for by the company, or (b) you get a $40/mo stipend for cell service. It turns out that I can use our 2FA app without MDM, on my personal. And nowadays, I rarely use slack or email from mobile, and I don't get calls. I am pretty strong in the "don't put company stuff on personal devices" camp. Even if they don't control your phone by policy, they do technically. They put root certs on the device, and though they can't see individual app data (depending on config) they can see a list of installed apps, and enforce certain baselines.

ta20200710 6y ago

Amazon has MDM (Airwatch). AFAIK there are not generally company phones or phone plans. Monthly limit on reimbursement for phone business expenditures in the US is $50, although I think you can also expense the device itself.

dickjocke 6y ago

No Amazon generally does not provide you a company phone, at least not when I was there.

nixass 6y ago

If your job requires it, you will get it. It's been like that for a while now

yumraj 6y ago

No, they are controlling the environment under which their company emails can be accessed. If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device. Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.

chooseaname 6y ago
If any company expects me to access my work email while mobile, they have to provide a phone. I never mix work and personal. I've also never had a company say no to that.
- cheonic729 6y ago
  > If any company expects me to access my work email while mobile, they have to provide a phone. No they don't. If you don't like it, switch employers.
  - Assumer 6y ago
    Pretty sure that's what he's saying. The company gets to choose between dropping the requirement, providing a phone or hiring/retraining.
  - sdoering 6y ago
    Depends on the jurisdiction. In Germany they do. Labor rights explicitly says that your employer needs to provide the means for you to do your work. And that includes mobile phones if they want you to access your work email (or whatever) from a mobile device.
    - GekkePrutser 6y ago
      Yes they do... The problem is some users in Germany actually prefer to use their personal one so they don't have to carry two.. But due to this mindset they can't. I don't think the German approach is always the best.

spelunker 6y ago

There's also no requirement to have your business email on your phone, at least in my organization in Amazon. I'm happy to leave it off and not worry about any issues like this. Of course I do have other apps directly related to work... I guess those aren't an issue if I had TikTok?

foolfoolz 6y ago
i haven’t had work email on my phone in 7 years. it has not impacted my career negatively
- smabie 6y ago
  How do you know?

Sodman 6y ago

Most companies I've worked for wouldn't provide a work phone and there's no explicit expectation that you read or answer work e-mails on your phone. But like everything else, if you don't read/reply to work e-mails on your phone, and your colleagues do, good luck getting that promotion/raise/bonus.