Does anyone have a solution for corporate email on personal devices?

[-]

Prophage7@reddit

Intune specifically has policies for this that only allow users to login to work accounts through Microsoft apps on their phone, can prevent them from copying anything out of them, and let you block them out completely and wipe data from the apps when you disable their account.

Reply

[-]

CelebrationWitty8657@reddit

Well, I ve had situation when address book from outlook stays on the device that has been retired from intune (iOS) and also all downloaded data to local storage from enrolled profile, so I would recommend go for full wipe if the user could cause harm to your company no matter what

Reply

[-]

pinacoelho@reddit

Note that unless the full-wipe has been communicated to the user (and accepted), you’re factory-resetting a device you don’t own, and is no different from the user formatting the payroll database and backups on his way out.

Reply

[-]

PowerShellGenius@reddit

The amount of damages may be different, but the offense is indeed the same one.

Reply

[-]

PowerShellGenius@reddit

That means you provide a company phone. It is ILLEGAL under the Computer Fraud and Abuse Act for any person - including IT staff - to deliberately destroy someone else's personal data.

Reply

[-]

Golden-trichomes@reddit

Man everyone else in this thread is so wrong on their answers OP the Microsoft suit of tools support full MDM functionality including isolation between your work and the users personal data within the Microsoft apps. No need for full MDM.

Reply

[-]

Prophage7@reddit

It's soooooo common for companies to pay for M365 Business, E3, E5, etc licenses but then just not use the majority of tools the package comes with.

Reply

[-]

MonstersGrin@reddit

Yeah, but Microsoft is kind of a dick about what's included in what subscription. You want a few specific things, and you have to shell out for an unnecessary and expensive subscription, because they're composed to nickel and dime you, instead of helping you save money. On top of that, Microsoft makes it really difficult to figure out which subscription you actually need. I have that problem right now, actually...

Reply

[-]

DoTheThingNow@reddit

This

Reply

[-]

sohcgt96@reddit

Right? It integrates with everything, lets you make a work profile, compartmentalize data, apply policies and remote-wipe the company content from the phone if need be without touching the user's data. Its really not bad and if they have O365 they may already even be paying for it.

Reply

[-]

HYRHDF3332@reddit

It's on the list! That long *long* list...

Reply

[-]

pimmit1@reddit

Please share more info... How can I find out about to m his to use these features?

Reply

[-]

signed-@reddit

As everyone else state, **DON'T DO THAT** If you are required for some reasons, get a GWorkspace and deploy Work profile on Android. iOS will not have such functionnality and will require MDM.

Reply

[-]

jzzzzzzz@reddit

Until you have employees in China and Android enterprise doesn’t work.

Reply

[-]

InvisibleTextArea@reddit

I imported mainland Chinese phone and it just straight up lies to MDM when presented with an Android work profile.

Reply

[-]

MonstersGrin@reddit

Now I'm curious. Could you elaborate, please?

Reply

[-]

InvisibleTextArea@reddit

So when you deploy a Work profile to it the end user gets a popup that's basically yes (apply) / no (ignore) / Fake (fake fail with randomised errors) / Simulate (claim success but do nothing aka lie to MDM). This also pops up for enforcement, check-ins and wipe requests. Furthermore in there is an extra Work profile section in settings. you get something similar to app permissions where you can individually turn induvial Work profile enforced settings on / off / fake fail / simulate (lie). If you turn on 'advanced mode' (which requires root). You can also provide fake information for any data gathering (make / model / Android version / Carrier / etc) and have it report that back to MDM instead what it really is. Again you can also chose to report nothing at all, or fake an error too in the same place.

Reply

[-]

Inevitable-Fruit19@reddit

This is exactly what a device I pay for should allow me to do.

Reply

[-]

MonstersGrin@reddit

Woow. Now, that's just another reason to ban chinese phones completely. Thanks for taking the time to describe this. I had no idea.

Reply

[-]

sohcgt96@reddit

Working on deploying that right now, working at a startup company that grew rapidly but had no IT Dept, just a local MSP. Everybody just kind of did whatever the hell they wanted. Here's what I walked into my first day: 300ish users, all with laptops and local admin accounts. No domain. No MDM. A partial deployment of Connectwise (which has been a damn life saver as we're getting Azure rolled out) and a user base conditioned that doing whatever they want with no oversight is fine.

Reply

[-]

HYRHDF3332@reddit

Those are my favorite companies! So much to unfuck you will never get bored.

Reply

[-]

YachtingChristopher@reddit

Was the MSP terrible? Or did ownership just keep them relegated to minimal user support?

Reply

[-]

milkcarton232@reddit

I want that. Having the keys to the castle is wonderful and nothing bad has ever happened because of it

Reply

[-]

TriggernometryPhD@reddit

This is the way. Don't open yourself up to significant liability by compromising on BYOD policy. It's a treacherous and vulnerability ridden slippery slope.

Reply

[-]

colechristensen@reddit

Eh, just make sure the risk and policy are written down and somebody else’s decision. Make it a problem for legal and compliance, not yourself.

Reply

[-]

home_theater_1@reddit

Look into Intune MAM-WE. It essentially creates a container for company data that can be locked out if you need to for whatever reason.

Reply

[-]

imnotaero@reddit

We do this, and it is good. It even blocks copy-paste out of MS into anything not in your tenant.

Reply

[-]

junkman21@reddit

> It even blocks copy-paste out of MS into anything not in your tenant. I didn't know this. That's sweet.

Reply

[-]

DburkeZM@reddit

I turned that off because it was fucking with me

Reply

[-]

Glomgore@reddit

Yeah I'm torn with this one. Managing end users, and the computer illiterate it makes sense... but I'm an L3 hardware engineer and I can't copy a damn serial number in or out of an email... I'm more likely to copy it incorrectly by hand than with copy pasta.

Reply

[-]

changee_of_ways@reddit

This one caused me some intense rage when I couldn't copy an physical address out of an email and copy it into google maps. I've already had to drive clear out into bumfuck nowhere on a Friday because we can't get anyone competent to power cycle gear and now I'm driving around getting later for dinner because I can't find this godforsaken office. It's not like users couldn't just screen cap stuff anyways.

Reply

[-]

Resident1942@reddit

It can block you from screen capping too

Reply

[-]

Inevitable-Fruit19@reddit

Typically screen cap blocking doesn't prevent screen recording.

Reply

[-]

DburkeZM@reddit

I guess you could setup specific policies for different users but thats annoying to manage. And trying to test them is a nightmare with the way Microsoft syncs to devices and domains. After 3 changes it takes over 8hrs, like wtf.

Reply

[-]

changee_of_ways@reddit

> with the way Microsoft syncs to devices and domains. After 3 changes it takes over 8hrs, like wtf. Wait, what?

Reply

[-]

DburkeZM@reddit

[https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#:\~:text=Enrollment%20policies-,Policy%20refresh%20intervals,-Intune%20notifies%20the](https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#:~:text=Enrollment%20policies-,Policy%20refresh%20intervals,-Intune%20notifies%20the)

Reply

[-]

JCochran84@reddit

Only if you configure it that way. By default it does not (i believe)

Reply

[-]

DonutHand@reddit

This also prevents any other email account being configured in the mobile Outlook app, right?

Reply

[-]

home_theater_1@reddit

No it doesn’t, you can probably block others but I have 6 email accounts configured in mine.

Reply

[-]

Twizity@reddit

Totally this. We use it and have numerous controls in place via it and can enforce various requirements. Partial list: * Require device encryption * Require device PIN/password/etc * Block screenshots of MS365 apps (Outlook, Teams, Word, etc) * Block copy/paste outside MS365 apps. You can copy/paste from Outlook to Teams for example, but not to say Discord or SMS. * We can whitelist specific non-365 apps to allow copy/paste as we want. * On-demand wipe of MS365 apps data.

Reply

[-]

IT-Man0@reddit

I can't believe how far down this answer is. MAM does exactly what the OP describes.

Reply

[-]

roushbombs@reddit

It was at the top for me. ¯\_(ツ)_/¯

Reply

[-]

IT-Man0@reddit

It only had 4 upvotes when I saw it lol

Reply

[-]

lunchlady55@reddit

You dropped this \\

Reply

[-]

roushbombs@reddit

No! The formatting stole it from me!!

Reply

[-]

lunchlady55@reddit

¯\\\_(ツ)_/¯

Reply

[-]

Tinyatio163@reddit

If you want corporate privacy & data protection you cannot allow data to cross over onto personal devices.

Reply

[-]

gtc0119@reddit

My issue with relying on Intune to wipe company data is that when I send a command to wipe company data from a phone it can take 30 minutes to take effect for the office suite and I think the same goes for native iphone mail. I guess I was spoiled with Airwatch which seemed to wipe much faster.

Reply

[-]

Roland_Bodel_the_2nd@reddit

That's interesting, for a MAM, you don't need to have any special configuration on the end-user device? I guess the app itself picks it up from its cloud controller based on the user that is signed into it: [https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-mamwe](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-mamwe)

Reply

[-]

ThePickledFox@reddit

App protection policies rock! We use a combination of mam-we and mam with enrollment. With enrollment we provide a little bit more access to things. At the end of the day you can manually do ‘app selective wipes’ to wipe all your org data off the devices when you want. We also have policies in place that also remove org data when a user account is disabled.

Reply

[-]

RembrandtQEinstein@reddit (OP)

Will do. Thanks!

Reply

[-]

dergissler@reddit

Webmail

Reply

[-]

RembrandtQEinstein@reddit (OP)

I disabled owa externally. I'm not giving that back. This is more for higher ups. If a C level is termed, they need to lose access immediately.

Reply

[-]

R8nbowhorse@reddit

Yeah: don't

Reply

[-]

sysadminbj@reddit

The answer is NO. HELL NO. Do not allow company data on personal devices without management. Period. No argument at all. If some pain-in-the-ass middle manager wants email on their personal whatever, but doesn’t want to deal with “Big Brother snooping on their Insta” they can go pound sand.

Reply

[-]

NotYourNanny@reddit

> Do not allow company data on personal devices without management. Really, you have two extra words at the end there. Just provide a work device.

Reply

[-]

sysadminbj@reddit

Eh. BYOD is fine with management. My org has a few hundred personal devices enrolled in BYOD. I can yank any company data in a few clicks.

Reply

[-]

NotYourNanny@reddit

> BYOD is fine with management. Therein lies the problem.

Reply

[-]

gex80@reddit

There is nothing wrong with BYOD if the correct steps are taken. One of those being an MDM solution. Allowing BYOD without MDM, policies, etc to sufficiently protect company data on said device is the issue. Both are approved by management.

Reply

[-]

NotYourNanny@reddit

> There is nothing wrong with BYOD I disagree. > if the correct steps are taken. One of those being an MDM solution. That's what wrong with using *my* device for work. > > Allowing BYOD without MDM, policies, etc to sufficiently protect company data on said device is the issue. Too many words there. Let me correct it: >Allowing BYOD is the issue. > > Both are approved by management. Do you actually believe that management **never** makes a bad call? Because if you don't, your statement is irrelevant. Keep work stuff on work equipment. Keep personal stuff off of work equipment. It's not rocket science.

Reply

[-]

gex80@reddit

> I disagree. You're free to do that. That has no bearing on my statement. > That's what wrong with using my device for work. Okay so then don't use your device. What does that have to with the rest of the company? If you don't want to work at a company that uses MDMs, you're 100% free to go to another company. Everyone is replaceable and the institutional knowledge you have now can be figured out by someone else. Source: Used to be a consultant who was brought on to push out the IT director of a company who refused to share passwords with his direct reports. >Too many words there. Let me correct it: You're not as clever as you like to think. Also just because you hold a certain opinion doesn't make you correct or the authority on the topic. > Do you actually believe that management never makes a bad call? Because if you don't, your statement is irrelevant. Do you think sysadmins never make bad decisions or fuck up? See /r/sysadmin as proof of non-management fuck ups. Seeing as how I'm a devops manager, I'm well aware of what management is and is not capable of. But sure, I guess in your world Microsoft, Google, Amazon, Apple, Meta, any company on the fortune 500 list buys all of their employees a cell phone so they can have access to email.

Reply

[-]

NotYourNanny@reddit

> That has no bearing on my statement. Your statement was ridiculous.

Reply

[-]

gex80@reddit

And so is your position on the subject.

Reply

[-]

NotYourNanny@reddit

I know you are, but what am I?

Reply

[-]

YachtingChristopher@reddit

I worked in IT at Microsoft. You are wrong.

Reply

[-]

NotYourNanny@reddit

You worked in IT at Microsoft. You are the very definition of wrong. And did you really just claim that Microsoft management **never** makes bad decisions? Are you so deluded you actually *believe* that?

Reply

[-]

YachtingChristopher@reddit

I'm sorry, what global enterprise IT have you been a part of? Microsoft was allowing BYOD ten+ years ago. It has only gotten easier and more functional to manage since. I claimed no such thing. All company's management makes bad calls sometimes. But you sound like the 50 year olds I worked with 15 years ago railing about "CLOUD BAD!".

Reply

[-]

NotYourNanny@reddit

You cite "management is OK with it" as a reason why it's acceptable. You really haven't mentioned any other reason. There is no other sane interpretation of what you've posted. You apparently believe that Microsoft management **never** makes bad calls. This makes me question both your sanity and your intelligence.

Reply

[-]

YachtingChristopher@reddit

This is what you call a false equivalency. You think BYOD is bad, so you call management bad for approving it. But BYOD isn't bad at all with the right systems and people in place.

Reply

[-]

NotYourNanny@reddit

The right systems and people would be the company paying for the tools employees need to do their jobs.

Reply

[-]

Present-Plant-227@reddit

If management approves it isn’t that by definition then “OK”? It’s not unethical or something, and there are solutions to protect that data.

Reply

[-]

NotYourNanny@reddit

> If management approves it isn’t that by definition then “OK”? Only if you believe management is always right. Sam Bankman Fried approved of a good many things he's going to go to prison for. > It’s not unethical or something, I disagree. I find it very unethical to use employees' personal equipment for work purposes. > and there are solutions to protect that data. At the expense of protecting employees' interests.

Reply

[-]

Present-Plant-227@reddit

Why do you think allowing BYOD is wrong? You’ve not explained why that I’ve seen just keep replying “you are wrong”

Reply

[-]

NotYourNanny@reddit

I have explained. I won't bother doing so again, since you clearly aren't interested in understanding.

Reply

[-]

StingOfTheMonarch82@reddit

> That's what wrong with using my device for work. I understand this logic but I hate carrying two phones

Reply

[-]

NotYourNanny@reddit

We all have choices to make in life.

Reply

[-]

llDemonll@reddit

Not an issue at all. If the company says “we want to allow BYOD” then you allow it. Apple and Android have versions of work profiles that will pull all related data when requested without wiping the device. For Android it’s called Work Profile, for Apple it’s Managed Apple IDs.

Reply

[-]

NotYourNanny@reddit

> If the company says “we want to allow BYOD” It's because they don't want to spend the money to provide work tools for employees. It's really not in the company's interest to allow it under circumstances that are not bad for employees. Yeah, there are tools that protect the company's interests, but only at the expense of giving them too much control over the employee's personal device.

Reply

[-]

llDemonll@reddit

> Yeah, there are tools that protect the company's interests, but only at the expense of giving them too much control over the employee's personal device. Please explain how a work profile, which operates in essentially a sandbox, allows too much control over a personal device. No one is forcing the employee to have company resources on their phone. The company can use work profiles to protect their data and keep it separate from personal data on the phone (including pulling that data off if needed in the event of a term).

Reply

[-]

NotYourNanny@reddit

> No one is forcing the employee to have company resources on their phone. Is that really true? In some cases, yes, but in others, you really can't do the job without it. Either way, if it's used for the job, the company should be providing it. (I live in California, where the company is absolutely required to pay at least part of the bill if the device - any device, including internet service - is used for work. I do not disagree with this.)

Reply

[-]

sysadminbj@reddit

By management I meant technical not people.

Reply

[-]

NotYourNanny@reddit

And?

Reply

[-]

shit_creek_pilot@reddit

What are you using for MDM?

Reply

[-]

sysadminbj@reddit

VMWare WorkspaceONE + Airwatch

Reply

[-]

shit_creek_pilot@reddit

can you block cut & paste for apps running in that sandbox?

Reply

[-]

sysadminbj@reddit

Airwatch has the full suite of DLP capabilities.

Reply

[-]

Turdulator@reddit

Man I don’t want to be responsible for fixing, maintaining, inventorying, etc for phones. So much overhead and for what? Intune > company portal app > push the outlook app… block any other email client.

Reply

[-]

NotYourNanny@reddit

Precisely. Give them a company phone that you have total control over, like you should.

Reply

[-]

Turdulator@reddit

Why? So much overhead and for what? Just force them to use outlook and use intune to lock it down…. Why do anything more than that?

Reply

[-]

NotYourNanny@reddit

> Just force them to use Their own equipment for the employer's business, and allow the employer at least partial control over their own equipment. No thanks. I don't work for companies too damn cheap to pay for the tools I need to do the job. I've carried two phones for a number of years. I see no downside to it. Neither does my employer.

Reply

[-]

Turdulator@reddit

Or just make mobile email entirely optional. It’s real easy to just not expect employees to answer emails outside of business hours.

Reply

[-]

NotYourNanny@reddit

Many people use mobile devices to answer email - and texts, and phone calls - *during* business hours. Sometimes, you *do* need a phone to do the job. At those times, the business should be providing it.

Reply

[-]

Cairse@reddit

A sysadmin's job *is not* to tell management how to run a company. A sysadmin's job is to provide all of the info in an easy to understand way so that management can make an informed decision about the level of risk they are willing to take. Give your advice, pushback once, and then ultimately do your job. Make sure you get everything in writing. Trying to fight management will cause unnecessary stress and poor mental health as well as causing friction with the people who can fire you. It's not our job to make the world an impenetrable tech fortress. It's our job to inform clients and mitigate risk where possible and to the best of our abilities.

Reply

[-]

PMMEYourTatasGirl@reddit

>#Make sure you get everything in writing.

Reply

[-]

ImmediatePick1144@reddit

mitigate the risk, find a better solution. Using two devices for everything is a waste of money, resources, time. For PCs you can implement VDI for example. I've been lucky so far and where I work now for example they just give me $50/month to pay for my own phone. I am so glad I don't have to use two phones. Having a seperate laptop if VDI can't been provided I completely understand. But phones .. please no.

Reply

[-]

eNomineZerum@reddit

and really with Android Enterprise and the IOS equivalent it gets pretty well sandboxes. It is even a plus to the end user, at least on Android I hit a toggle and shut off all work stuff when on vacation or off shift. Just like a good little VM on my phone.

Reply

[-]

GhoastTypist@reddit

If you want corporate privacy & data protection you cannot allow data to cross over onto personal devices. Pretty simple.

Reply

[-]

pryan67@reddit

M365 also wipes the ENTIRE device if you select "wipe company data" and they're using the native mail app to access email.

Reply

[-]

GhoastTypist@reddit

Isn't that dependent on the license that you have?

Reply

[-]

pryan67@reddit

True...Intune can do it...but with just an E3 license, it will wipe the phone itself if they use the built in app

Reply

[-]

Brilliant_Nebula_480@reddit

Based on these comments - seems like everyone works at a company that can just ignore the CEO's or hire ups ruling.

Reply

[-]

pinacoelho@reddit

The misspelling gave it an extra-funny dimension. Keep it.

Reply

[-]

Brilliant_Nebula_480@reddit

lolll

Reply

[-]

9Tens@reddit

The “HELL NO” responses and upvotes are pretty telling of their experience as a sysadmin. There are plenty of ways to do this safely and plenty of companies do this without issue. I’d hate to have hired someone who flat out says “No” to something when there are plenty of viable solutions.

Reply

[-]

jkdjeff@reddit

They THINK they do. Big difference.

Reply

[-]

EvolvedChimp_@reddit

This makes no sense. If someone even has an inkling they are about to lose their job for whatever reason, and they wanted to get spiteful and harvest info, there's nothing stopping them from exporting their mailbox to a PST before the fact. This come down to management and hiring the right people and not letting your paranoia get the better of you. Any half decent person would be thankful to never see their previous employers work mailbox ever again

Reply

[-]

Naive-Donut-@reddit

Informative

Reply

[-]

RembrandtQEinstein@reddit (OP)

Thank you all for the responses! I inherited this mess, so I guess I will attempt to get the C-level on board with placing devices in mdm or no email on phone at all. Now to get a quote for licensing...

Reply

[-]

Avas_Accumulator@reddit

Define licensing? It could be baked into your already-there Microsoft 365 license

Reply

[-]

Any_Particular_Day@reddit

Three choices really… Give them a corp device enrolled in the MDM Put their person device in the MDM No corporate data on the device. Really, the first is the best way since you have complete control of the device, can restrict how it’s used, what gets installed, etc. But a lot of places like BYOD so then you’d use the second option. But if you won’t give them a corporate device, and won’t enroll their personal device in MDM, then there shouldn’t be any corporate data on the device. And personally, if you want me to carry a device with corporate data, you either need to give me a corp device or pay me a BYOD stipend so I can have a second device dedicated to work.

Reply

[-]

Kapoffa@reddit

MAM?

Reply

[-]

RobotTreeProf@reddit

SIR?

Reply

[-]

Kapoffa@reddit

Yes I know what it is. Just wondering why it wasn't one of the alternatives.

Reply

[-]

Apex-toso@reddit

Intune, AirWatch, having configuring conditional access in Azure

Reply

[-]

AdderallBuyersClub@reddit

I dont recommend air watch. that thing only works when it feels like it. constantly not allowing you to even get to the admin dashboard and heaven forbid if you try to log in to the company portal on the device during deployment.

Reply

[-]

AdderallBuyersClub@reddit

Here is the image...   https://preview.redd.it/m010dhbfitqa1.png?width=1258&format=png&auto=webp&v=enabled&s=ec36e98f9f9ebd5da442b6ded579dc8a8774cf26

Reply

[-]

AdderallBuyersClub@reddit

You dont need an extra program. Exchange Online and exchange already do this. You can wipe the company data or wipe their phone. But if you have the licenses, go ahead and set up Intune to manage them. In exchange online, you go to the EAC and you select the user, open their EOL properties and can remove the company mailbox from their phone.

Reply

[-]

ice2257@reddit

MaaS360

Reply

[-]

bkb74k3@reddit

MAM

Reply

[-]

thelug_1@reddit

We use VMware Airwatch with Boxer. Puts a work profile on all devices that can be remote wiped and depending on how far you lock it down, little or no carryover. We alos use it to lock down our company iPads as well. That being said, InTune seems to be the goto these days. Very popular from the peers I speak with.

Reply

[-]

YachtingChristopher@reddit

In addition to the loads of info you are getting here, any user can export their mailbox to pst in outlook. They can then send that to themselves via whatever means they have access to. All emails, forever, taken with them anytime. Worry less about the infinite small details and take care of the large strokes. Personal devices in MDM is the only way to even remotely achieve this, and is incredibly low-hanging fruit.

Reply

[-]

RembrandtQEinstein@reddit (OP)

Oh, I know it will never be perfect. There will always be ways around everything. They could take pictures with another phone or anything else low-tech and there is nothing I can do about it. I just want to get started in the right direction to adding what safeguards we can. I really appreciate everyone's input.

Reply

[-]

Enxer@reddit

I run the nine.app which by default is app data wipe only. coupled with implementing onedrive file storage only could be a good way to keep data off mobile/web devices and remotely wipe only the work data.

Reply

[-]

Bloodryne@reddit

If you are a windows shop, INTUNE MDM works well for this

Reply

[-]

tommishuck@reddit

Look at MAM solutions - mobile application management. MDM manages the device and MAM will manage the corporate data. Intunes is good if you used O365.

Reply

[-]

joelgsamuel@reddit

Great write-ups on BYOD risk views, and Deployment Approaches from UK NCSC: [https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device](https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device)

Reply

[-]

RembrandtQEinstein@reddit (OP)

Thanks for the link. I need ammo.

Reply

[-]

thecravenone@reddit

I love not having work email on my personal device. I close my laptop at the end of each day and that's the end of me thinking about work that day.

Reply

[-]

midevilman2020@reddit

Yup. Will always have two phones. Never want work on mine, don’t care how you try and do it.

Reply

[-]

Kapoffa@reddit

And I love pasta. All kinds of pasta!

Reply

[-]

musicmakesumove@reddit

Copypasta?

Reply

[-]

pdp10@reddit

Email being accessed from non-org-controlled devices isn't necessarily the ragnarok that it's often perceived to be. For example, this is routine in academica, despite the amount of confidential R&D that happens in academia. > Essentially want to make sure when someone leaves, they do not have an archive of previous emails on their device. Do you prevent people from printing out email for CYA, and taking the printout? Why or why not? One organization had a problem with salespersons "hoarding" their professional contacts away from the rest of the organization, and also with salespersons taking the whole organization's sales contacts with them when they left. As salespersons tend to come and go quickly everywhere, a paranoid manager may even feel that competitors are "planting" people to steal their contacts and sales. A large part of the answer is to get the sensitive information out of email and into a CRM system with appropriate security. Everything has to be in the CRM system so that commissions can be paid. Bulk-exports from the CRM system are impossible for end-users. Queries are logged. It's not hard to have better security than the FBI.

Reply

[-]

Turdulator@reddit

Sales people have been hoarding contacts since phone numbers were invented….. no matter where you save contact info, if they can see it, nothing will stop them from writing it down.

Reply

[-]

pdp10@reddit

"Hoarding" in the context above means not sharing contacts/potentials with the rest of the organization. "Appropriation" is the term I've seen used for the behavior you're talking about. Appropriation is harder to inhibit than hoarding. At scale, compartmentalizing information is often used -- "sales regions", things like that. But the first goal of a CRM is to make it impossible for a nonprivileged user to get a structured bulk export.

Reply

[-]

Anonymous1Ninja@reddit

Ummm MFA and password policy enforcement.

Reply

[-]

mnoah66@reddit

Intune app protection combined with conditional access. The user will need an Intune license but full device enrollment not required. Just outlook and the Authenticator app on iOS.

Reply

[-]

DburkeZM@reddit

Intune is good for this, wouldn't recommend it for PCs that's too complicated but we use Intune. Its nicer on android that iOS because it creates a separate work account on the phone to separate personal and business stuff and apps.

Reply

[-]

gex80@reddit

Not using MDM on non-work devices is a bad idea full-stop. The only way to have your cake and eat it too is to use browser based email.

Reply

[-]

Jaexa-3@reddit

Gmail app on the phone can add any inbox to receive email as long as you have the imap and stmp settings

Reply

[-]

peanutbuttersmack@reddit

Does anyone have a solution to intuned Outlook to have a secondary email? Primary company is intuned but their sister company is not but need a solution to access both emails. Currently we have a CA policy to allow unregistered device to access their secondary email on native app.

Reply

[-]

lost_signal@reddit

We use Boxer. It does mail and email. My biggest gripe is notifications are for BOTH of them the same.

Reply

[-]

fontasia@reddit

Since version 14 Exchange has allowed to remotely wipe just the mail account from the mobile device management. But the better solution is MAM where you can lock all the work stuff into seperate apps. Another reason to miss Windows Mobile as this had a great implementation.

Reply

[-]

boomshank84@reddit

Mobile iron worked well for my company

Reply

[-]

Blurryface1104@reddit

Google Workspace

Reply

[-]

DDOSBreakfast@reddit

Nine Folders is an Android email application that runs in a sandbox that supports the ActiveSync mobile device policies. If someone is connected to Exchange with ActiveSync using Nine Folders it will respect being told to wipe emails.

Reply

[-]

einsteinsviolin@reddit

Intune policies around the application only. Don’t mess without anything on a personal device outside of the company singed in app.

Reply

[-]

Puzzlehead8675309@reddit

I believe you should look into Boxer, or as others state use the work profile setups

Reply

[-]

akadmin@reddit

Any MAM product.

Reply

[-]

bofh@reddit

Yes. Intune. It’s a solved problem.

Reply

[-]

fishing4life12@reddit

MAM is what you're looking for

Reply

[-]

XXL_Fat_Boy@reddit

Mobile Application Management via Intune

Reply

[-]

progenyofeniac@reddit

Require Outlook, using a combo of conditional access and MAM policies. You can also prevent copy/paste out of Outlook. And you can have a trigger in the MAM policy that wipes the account from the employee's device when their O365 account is termed. It's not perfect, but it's about as close as you'll get without full MDM. Go full MDM if you want total control.

Reply

[-]

bemenaker@reddit

MDM or nothing.

Reply

[-]

christystrew@reddit

Hey, I think this might be helpful for you. [https://blog.scalefusion.com/corporate-email-security/](https://blog.scalefusion.com/corporate-email-security/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=CM)

Reply

[-]

Alternative-Award-23@reddit

Ew, a referral link. Pay for advertising like everyone else.

Reply

[-]

Rocknbob69@reddit

You need some sort of MDM policy and BYOD policy. If they want to use corporate services their phones need to be managed.

Reply

[-]

VA_Network_Nerd@reddit

> We are not wanting to put personal devices on our mdm That's gonna be a problem right there. Is there a mobile webmail client?

Reply

[-]

jmbpiano@reddit

This right here. Honestly, if the webmail client is good enough you can get ungrumbling buy-in from your users, it's by far a better approach than an MDM with remote data wipe capabilities, IMHO. Wipes can fail or be sabotaged, but cutting off access to a web service is instant and decisive.

Reply

Reply to Post

158 Comments