Just to be a bit more clear-- the difference here is with device provisioning using Mobile Device Management (MDM) services, not necessarily the default OS apps

Just to be a bit more clear-- the difference here is with device provisioning using Mobile Device Management (MDM) services, not necessarily the default OS apps. The user enrollment process doesn't necessarily require giving permissions beyond mail/contacts/calendar access. But many organizations take advantage of the opportunity to use pre-baked profiles which restrict behaviors, auto-configure VPN with client certs, activate features like remote wipe, etc. We dealt with a lot of this when building the ActiveSync module for the Inbox[1] sync engine, which works with all Exchange servers and offers a modern REST API. (ie: like Twilio/Stripe for email) https://www.inboxapp.com/ https://www.inboxapp.com/ [1] Google stole our name last month. :(