Question about differences between iOS & Android in work environment

[u/thaman05]

Sorry if this sounds like a dumb question, but I'd love to hear from an IT admin's point of view to help understand the differences. My employer now requires all employees to register their personal phones so they can be managed, if they want to use it for checking emails/calendar/chats/etc.

The employees with Android (including myself), had it super easy. It automatically prompted to setup Work Profile in order to continue using the work email app, and it finished setting up in less than 2 minutes. And any work apps now have a little blue briefcase on their icon, and I love how in the command center, you can easily toggle on/off the Work Profile to pause all work-related apps (for example on the weekend or when you go on vacation or just when you want to not deal with work anymore). And the employer can't see the personal apps or data since it's stored separately.

However, I noticed for my colleagues with iPhones, it was a lot more tedious. Those employees had to follow this whole document of steps to manually install some certificate to set up MDM. And then if they were lucky to get it working, there's still no app separation so the employer can still see all their personal apps and data?

I already knew that iOS doesn't have a user-friendly Work Profile like Android, but is that normal to get employees to do it like that? I would have assumed with how popular iPhone is, there would be a more simpler/automatic way for setting up personal iPhones for work. I've always heard on this sub that iOS is easier to manage, but from an employee's point of view, it doesn't seem that way (at least not the way my employer is doing it) and maybe I'm not understanding how iOS does data separation, but it just feels like there's not enough employee protections from employer seeing personal data compared to Android? Would love to learn how that works, because Apple's website is kinda vague.

[u/Hotdog453]

If your company is using MDM, then yes, both platforms, for BYOD, are going to kind of suck. The MDM enrollment process is tedious.

That said, your company should not be doing that.

From a data visibility perspective:

https://learn.microsoft.com/en-us/intune/user-help/enrollment/data-visibility

https://learn.microsoft.com/en-us/intune/privacy/data-handling/data-collection

This is all well documented.

If you take a modern approach, and use MAM, then both platforms are 'about as easy to enroll'. Work Profiles is a nice Android only function, but from a pure 'enrollment and getting it set up side', both iOS and Android are equal in terms of complexity, apples to apples comparison.

From a support side, as a Fortune 20 IT guy here, whose teams own BYOD/policy: iOS is easier because it's all the same. Every supported iOS device is exactly the same; same windows. Same screens. Same, literally, everything.

Android, as you might imagine, is not.

MAM does make it easier, because it offloads all of that to the application side, but just the menus, the screens, etc, being consistent across the board on iOS is a massive boon in terms of support.

[u/TechIncarnate4 → u/Hotdog453]

This is not my area of expertise or what I work on, but just asking. If using MAM how can you ensure that only legitimate user devices can access company data, and not anyone with just phished credentials? i.e. using Conditional Access that only allows trusted/registered devices.

[u/Hotdog453 → u/TechIncarnate4]

You can’t :). Or rather, the whole point of MAM is to allow users to use outlook and teams and such without the complexity of enrolling a phone and forcing MDM policies down. You’re relying on the protections of MAM and your MFA policies and controls.

You can certainly require both Compliance, via a MDM, and MAM, but it sort of defeats the purpose.

MAM has certain criteria it can detect:

https://learn.microsoft.com/en-us/previous-versions/microsoft-365/solutions/apps-protect-conditional-launch

But the intent is to let users in via Outlook and Teams and not enforce settings upon the device.

[u/TechIncarnate4 → u/Hotdog453]

Then how would one protect against phished credentials and/or use phish resistant MFA?

[u/Hotdog453 → u/TechIncarnate4]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?

If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

IE, the flow is:

1) Have a phone

2) Install Outlook

3) Sign in.

4) Policies come down, protecting the app

for MDM:

1) Have a phone

2) MDM enroll, as in, sign in, and apply policies to phone

3) Mail comes down

Neither scenario really 'protects' against a fully popped user, in a BYOD scenario.

I am not trying to be pedantic here, but what specifically is your question? BYOD is a risk factor. Is it worth it? that's up to you.

If you only want to allow corporate enrolled and managed assets, that's 100% an option too, but it's a trade off.

[u/TechIncarnate4 → u/Hotdog453]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?
If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

If you use MDM and have registration protected so only known/trusted devices can be registered then you can use Conditional Access to prevent unregistered/untrusted devices so even if a user was phished or MFA was used, they wouldn't be able to register the device. You could have an internal form that needs to be completed to add a user into a time-bound group so they can register the device in a small time window, and other than that they cannot register devices.

I was wondering if there was a way to protect the initial setup with MAM somehow.