---
title: "What IT can see on enrolled devices"
description: "What your IT team can and cannot see or do on a phone, tablet, or computer enrolled in Outpost MDM, for company and personal devices. In preview."
url: "https://support.outpostplatform.com/mdm/privacy/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "What IT sees on devices enrolled in Outpost MDM (preview). Company devices are fully managed. On personal (BYOD) devices IT manages only work apps and accounts and cannot locate the device, use lost mode, erase personal data, or see personal apps. Every locate is logged. An automatic privacy page is shown before a personal device enrolls."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/mdm/privacy.md"
license: "CC BY 4.0"
---

# What IT can see on enrolled devices

When a phone, tablet, or computer enrolls in Outpost
[mobile device management](/mdm/), your organization's IT team, or the IT
provider it works with, can manage some things on it and not others. What they
can do depends on who owns the device. This page explains the difference for
the people who use the devices and for the IT teams who manage them.

## Company devices and personal devices

How the device enrolled decides whether it is a company device or a personal
device. You cannot change one into the other without enrolling again. See
[Enrollment methods](/mdm/enrollment/).

- A **company device** belongs to the organization. IT manages the whole
  device.
- A **personal device** belongs to you. You enrolled it with your work
  account so you can use work apps and email on it. IT manages only the work
  side.

## What IT can and cannot do on a personal device

| Area | On a personal device |
| --- | --- |
| Work apps and work accounts | IT can install, configure, and remove them. |
| Settings for work data | IT can apply settings that protect work data, such as a passcode requirement. |
| Your personal apps | IT cannot see them. App inventory covers managed work apps only. |
| Your location | IT cannot locate the device or put it in lost mode. |
| Erase | IT cannot erase the device. Removing it from management deletes the work apps and work data, and leaves your own data in place. |
| Supervision-only controls (Apple) | Not available. They need a company device. |

## What IT can do on a company device

On a company device, IT can manage settings, apps, and updates for the whole
device, and can:

- Lock, restart, or erase the device.
- Locate the device and put it in lost mode if it is lost. Outpost records
  every location request in the audit log.
- On a supervised Apple device, apply controls that Apple reserves for
  supervised devices.

By default, erasing a device, clearing Activation Lock, and locking many
devices at once need a second person on the IT team to approve the request, unless an owner
overrides the approval after confirming their identity again.

## The privacy page

Before a personal device enrolls, Outpost shows the person enrolling it a
privacy page generated from these rules. It states what IT can and cannot see
and do on that device, so the person can decide before they enroll.

## How Outpost protects this information

- Location data is stored encrypted, and every location request is recorded
  in the audit log.
- Secrets that IT sends to devices, such as Wi-Fi passwords, are never stored
  in the settings themselves.
- The certificates a device uses to talk to Outpost MDM cannot be used to
  impersonate a computer running the Outpost agent.

## Related

- [Mobile device management](/mdm/)
- [Enrollment methods](/mdm/enrollment/)
- [Audit log](/depot/audit-log/)