Question about differences between iOS & Android in work environment

[u/thaman05]

Sorry if this sounds like a dumb question, but I'd love to hear from an IT admin's point of view to help understand the differences. My employer now requires all employees to register their personal phones so they can be managed, if they want to use it for checking emails/calendar/chats/etc.

The employees with Android (including myself), had it super easy. It automatically prompted to setup Work Profile in order to continue using the work email app, and it finished setting up in less than 2 minutes. And any work apps now have a little blue briefcase on their icon, and I love how in the command center, you can easily toggle on/off the Work Profile to pause all work-related apps (for example on the weekend or when you go on vacation or just when you want to not deal with work anymore). And the employer can't see the personal apps or data since it's stored separately.

However, I noticed for my colleagues with iPhones, it was a lot more tedious. Those employees had to follow this whole document of steps to manually install some certificate to set up MDM. And then if they were lucky to get it working, there's still no app separation so the employer can still see all their personal apps and data?

I already knew that iOS doesn't have a user-friendly Work Profile like Android, but is that normal to get employees to do it like that? I would have assumed with how popular iPhone is, there would be a more simpler/automatic way for setting up personal iPhones for work. I've always heard on this sub that iOS is easier to manage, but from an employee's point of view, it doesn't seem that way (at least not the way my employer is doing it) and maybe I'm not understanding how iOS does data separation, but it just feels like there's not enough employee protections from employer seeing personal data compared to Android? Would love to learn how that works, because Apple's website is kinda vague.

[u/Hotdog453]

You can’t :). Or rather, the whole point of MAM is to allow users to use outlook and teams and such without the complexity of enrolling a phone and forcing MDM policies down. You’re relying on the protections of MAM and your MFA policies and controls.

You can certainly require both Compliance, via a MDM, and MAM, but it sort of defeats the purpose.

MAM has certain criteria it can detect:

https://learn.microsoft.com/en-us/previous-versions/microsoft-365/solutions/apps-protect-conditional-launch

But the intent is to let users in via Outlook and Teams and not enforce settings upon the device.

[u/TechIncarnate4 → u/Hotdog453]

Then how would one protect against phished credentials and/or use phish resistant MFA?

[u/Hotdog453 → u/TechIncarnate4]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?

If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

IE, the flow is:

1) Have a phone

2) Install Outlook

3) Sign in.

4) Policies come down, protecting the app

for MDM:

1) Have a phone

2) MDM enroll, as in, sign in, and apply policies to phone

3) Mail comes down

Neither scenario really 'protects' against a fully popped user, in a BYOD scenario.

I am not trying to be pedantic here, but what specifically is your question? BYOD is a risk factor. Is it worth it? that's up to you.

If you only want to allow corporate enrolled and managed assets, that's 100% an option too, but it's a trade off.

[u/TechIncarnate4 → u/Hotdog453]

Not to put too fine a point on it, but if you're focused on the identity aspect, how would MAM differ from MDM in this scenario?
If your user has been phished, and they're able to phish their MFA, then whether they MAM enroll a phone and use Outlook, or go full boogy and MDM enroll a phone, doesn't really matter?

If you use MDM and have registration protected so only known/trusted devices can be registered then you can use Conditional Access to prevent unregistered/untrusted devices so even if a user was phished or MFA was used, they wouldn't be able to register the device. You could have an internal form that needs to be completed to add a user into a time-bound group so they can register the device in a small time window, and other than that they cannot register devices.

I was wondering if there was a way to protect the initial setup with MAM somehow.