What IT can see on enrolled devices
When a phone, tablet, or computer enrolls in Outpost mobile device management, your organization’s IT team, or the IT provider it works with, can manage some things on it and not others. What they can do depends on who owns the device. This page explains the difference for the people who use the devices and for the IT teams who manage them.
Company devices and personal devices
Section titled “Company devices and personal devices”How the device enrolled decides whether it is a company device or a personal device. You cannot change one into the other without enrolling again. See Enrollment methods.
- A company device belongs to the organization. IT manages the whole device.
- A personal device belongs to you. You enrolled it with your work account so you can use work apps and email on it. IT manages only the work side.
What IT can and cannot do on a personal device
Section titled “What IT can and cannot do on a personal device”| Area | On a personal device |
|---|---|
| Work apps and work accounts | IT can install, configure, and remove them. |
| Settings for work data | IT can apply settings that protect work data, such as a passcode requirement. |
| Your personal apps | IT cannot see them. App inventory covers managed work apps only. |
| Your location | IT cannot locate the device or put it in lost mode. |
| Erase | IT cannot erase the device. Removing it from management deletes the work apps and work data, and leaves your own data in place. |
| Supervision-only controls (Apple) | Not available. They need a company device. |
What IT can do on a company device
Section titled “What IT can do on a company device”On a company device, IT can manage settings, apps, and updates for the whole device, and can:
- Lock, restart, or erase the device.
- Locate the device and put it in lost mode if it is lost. Outpost records every location request in the audit log.
- On a supervised Apple device, apply controls that Apple reserves for supervised devices.
By default, erasing a device, clearing Activation Lock, and locking many devices at once need a second person on the IT team to approve the request, unless an owner overrides the approval after confirming their identity again.
The privacy page
Section titled “The privacy page”Before a personal device enrolls, Outpost shows the person enrolling it a privacy page generated from these rules. It states what IT can and cannot see and do on that device, so the person can decide before they enroll.
How Outpost protects this information
Section titled “How Outpost protects this information”- Location data is stored encrypted, and every location request is recorded in the audit log.
- Secrets that IT sends to devices, such as Wi-Fi passwords, are never stored in the settings themselves.
- The certificates a device uses to talk to Outpost MDM cannot be used to impersonate a computer running the Outpost agent.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.