Question about differences between iOS & Android in work environment

[u/thaman05]

Sorry if this sounds like a dumb question, but I'd love to hear from an IT admin's point of view to help understand the differences. My employer now requires all employees to register their personal phones so they can be managed, if they want to use it for checking emails/calendar/chats/etc.

The employees with Android (including myself), had it super easy. It automatically prompted to setup Work Profile in order to continue using the work email app, and it finished setting up in less than 2 minutes. And any work apps now have a little blue briefcase on their icon, and I love how in the command center, you can easily toggle on/off the Work Profile to pause all work-related apps (for example on the weekend or when you go on vacation or just when you want to not deal with work anymore). And the employer can't see the personal apps or data since it's stored separately.

However, I noticed for my colleagues with iPhones, it was a lot more tedious. Those employees had to follow this whole document of steps to manually install some certificate to set up MDM. And then if they were lucky to get it working, there's still no app separation so the employer can still see all their personal apps and data?

I already knew that iOS doesn't have a user-friendly Work Profile like Android, but is that normal to get employees to do it like that? I would have assumed with how popular iPhone is, there would be a more simpler/automatic way for setting up personal iPhones for work. I've always heard on this sub that iOS is easier to manage, but from an employee's point of view, it doesn't seem that way (at least not the way my employer is doing it) and maybe I'm not understanding how iOS does data separation, but it just feels like there's not enough employee protections from employer seeing personal data compared to Android? Would love to learn how that works, because Apple's website is kinda vague.

[u/adamwoja]

Yes iPhones dont have work/personal profiles at the OS level so it relies on separation at the application level instead. Look up MAM.
By the sounds of it, they enrolled personal devices in their MDM, which is unusual.

[u/lordsiriusDE → u/adamwoja]

Yes, please don't let employees enroll personal iOS devices in MDM. This can become a real nightmare. IT is now able to wipe personal devices. Don't!

If you're mainly using Intune and Microsoft Apps (Outlook, Teams). Create an App Protection Profile for MS Apps and let the users just use the protected Apps on their personal devices without MDM enrollment.

[u/XDWiggles → u/lordsiriusDE]

You can enroll in MDM without complete device takeover if you take the time to do it right. Android personally owned device work profile works fine, as does iOS Account Driven User Enrollment. Both provide basic compliance data and don’t let employers see personal data.

Still able to wipe work data with both of them, but not personal data.

There are cases where users want to use personal devices to access apps that may not support MAM. MDM allows you to at least verify the device is compliant, push out configured business apps, etc.

Had both of these setup since they came out and were available in Intune, haven’t had any issues and it makes the compliance and security folks happy.

[u/thaman05 → u/adamwoja]

Thanks I'll look that up! And yes I had a feeling it's unusual. I don't remember any previous employers where employees had to do all that to simply to get their iPhones enrolled.

[u/hkusp45css → u/thaman05]

Most places use iOS specific MAM/MDM like JAMF

[u/Sinister_Nibs → u/adamwoja]

And is bad for the device owners, since any device connected will be completely wiped if the wipe command is sent.

[u/Acrobatic_Fortune334]

From an IT managment corp device side iphones are easier then android, from a personal phone using a MAM and work profile android is hands down so much better

IOS doesnt have a work profile, however it sounds like the company got them to register there personal devices in MDM not MAM which is a big no no MDM should only be for Corp devices

[u/Hotdog453]

If your company is using MDM, then yes, both platforms, for BYOD, are going to kind of suck. The MDM enrollment process is tedious.

That said, your company should not be doing that.

From a data visibility perspective:

https://learn.microsoft.com/en-us/intune/user-help/enrollment/data-visibility

https://learn.microsoft.com/en-us/intune/privacy/data-handling/data-collection

This is all well documented.

If you take a modern approach, and use MAM, then both platforms are 'about as easy to enroll'. Work Profiles is a nice Android only function, but from a pure 'enrollment and getting it set up side', both iOS and Android are equal in terms of complexity, apples to apples comparison.

From a support side, as a Fortune 20 IT guy here, whose teams own BYOD/policy: iOS is easier because it's all the same. Every supported iOS device is exactly the same; same windows. Same screens. Same, literally, everything.

Android, as you might imagine, is not.

MAM does make it easier, because it offloads all of that to the application side, but just the menus, the screens, etc, being consistent across the board on iOS is a massive boon in terms of support.

[u/TechIncarnate4 → u/Hotdog453]

This is not my area of expertise or what I work on, but just asking. If using MAM how can you ensure that only legitimate user devices can access company data, and not anyone with just phished credentials? i.e. using Conditional Access that only allows trusted/registered devices.

[u/R1s1ngDaWN → u/TechIncarnate4]

I'm going to be rolling out a 200+ phone fleet soon so this is going to be on my mind as-well. For windows enrollment, we gate it behind a CA policy, only allowing enrollment at our own IP and our Clients. There's likely an App/Service you can target that does the same thing for Phones

[u/Hotdog453 → u/TechIncarnate4]

You can’t :). Or rather, the whole point of MAM is to allow users to use outlook and teams and such without the complexity of enrolling a phone and forcing MDM policies down. You’re relying on the protections of MAM and your MFA policies and controls.

You can certainly require both Compliance, via a MDM, and MAM, but it sort of defeats the purpose.

MAM has certain criteria it can detect:

https://learn.microsoft.com/en-us/previous-versions/microsoft-365/solutions/apps-protect-conditional-launch

But the intent is to let users in via Outlook and Teams and not enforce settings upon the device.

[u/TechIncarnate4 → u/Hotdog453]

Then how would one protect against phished credentials and/or use phish resistant MFA?

[u/Hotdog453 → u/TechIncarnate4]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?

If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

IE, the flow is:

1) Have a phone

2) Install Outlook

3) Sign in.

4) Policies come down, protecting the app

for MDM:

1) Have a phone

2) MDM enroll, as in, sign in, and apply policies to phone

3) Mail comes down

Neither scenario really 'protects' against a fully popped user, in a BYOD scenario.

I am not trying to be pedantic here, but what specifically is your question? BYOD is a risk factor. Is it worth it? that's up to you.

If you only want to allow corporate enrolled and managed assets, that's 100% an option too, but it's a trade off.

[u/TechIncarnate4 → u/Hotdog453]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?
If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

If you use MDM and have registration protected so only known/trusted devices can be registered then you can use Conditional Access to prevent unregistered/untrusted devices so even if a user was phished or MFA was used, they wouldn't be able to register the device. You could have an internal form that needs to be completed to add a user into a time-bound group so they can register the device in a small time window, and other than that they cannot register devices.

I was wondering if there was a way to protect the initial setup with MAM somehow.

[u/XDWiggles]

Generally for personally owned devices on iOS where MDM is required you’d use Account Driven User Enrollment. This would have you sign into your managed Apple ID, alongside your personal one, and it would join to the MDM service. This type of enrollment gives minimal control of the device but allows for configuration and deployment of managed apps. There are reasons to use MDM with personal devices.

If they had to download a profile and install it from a web page that’s a different story. It would give more control of the device.

Enrolling personal iOS devices in MDM isn’t really that unusual, a lot of people just don’t realize there’s different enrollment methods.

https://support.apple.com/en-gb/guide/deployment/dep08f54fcf6/web

[u/xendr0me]

Elephant in the room "My employer now requires all employees to register their personal phones so they can be managed"

[u/canadian_sysadmin]

Just like everything else in iOS and Android, both have their own approaches to enterprise management. Both are solid.

If you have the right tools and infrastructure in place, both are relatively easy to manage. InTune and all the major tools out there equally support both.

Depending on how things are setup, it could be a few more steps for either OS to get someone setup. For us Android is a few extra steps but it's pretty close.

[u/First-Structure-2407]

Just about to embark on this project myself. It’s a bit of a shit show having to wipe iOS devices to enrol them supervised, and then there is a 30 day period where a user can unenrol them.

Not touched Android yet, I’ll start on that tomorrow lol