If you set up intune correctly (and its a requirement) you can prevent access to the entire of m365 including outlook unless they register their device and you can use allow lists for users who are approved to use their own devices, or just block them full stop while allowing company phones access.
If yours isn’t requiring registration, then its not setup to do so, you can very much enforce it, this is usually done via conditional access requiring that the device is registered before it can get access.
Often admins also forget to block web access from mobile devices, but that’s also blockable via the conditional access settings (and other ways, but conditional is how I would do it). Its not perfect as its using the user agent, which can be spoofed. Personally if the client needs that level of protection then web access should just be blocked for non company devices.
You can enforce that the company is added as a device manager, that’s usually how the device wipe is enforced. Access to personal data isn’t really what you are granting here, it is the ability to remote wipe the entire device.
Its a proper device management system with a ton of options. You can for example force users to only use an approved list of applications on their own device for company data.
There are ways around this. I run Outlook inside of a sandbox, so you can remote wipe the sandbox, but the rest of the phone isn’t accessible to anything in the sandbox even with “device admin” permissions.
There are ways around most things, but you’ll have to define this sandbox on your mobile as a lot of these can be prevented with the right additional product, obviously Microsoft being Microsoft isn’t going to give this away.
Doesn’t that create an isolated admin environment I don’t think it gives me access to their personal stuff.
Also not part of Outlook, adding a work email to a private device doesn’t register it to the admin environment
If you set up intune correctly (and its a requirement) you can prevent access to the entire of m365 including outlook unless they register their device and you can use allow lists for users who are approved to use their own devices, or just block them full stop while allowing company phones access.
If yours isn’t requiring registration, then its not setup to do so, you can very much enforce it, this is usually done via conditional access requiring that the device is registered before it can get access.
Often admins also forget to block web access from mobile devices, but that’s also blockable via the conditional access settings (and other ways, but conditional is how I would do it). Its not perfect as its using the user agent, which can be spoofed. Personally if the client needs that level of protection then web access should just be blocked for non company devices.
You can enforce that the company is added as a device manager, that’s usually how the device wipe is enforced. Access to personal data isn’t really what you are granting here, it is the ability to remote wipe the entire device.
Its a proper device management system with a ton of options. You can for example force users to only use an approved list of applications on their own device for company data.
There are ways around this. I run Outlook inside of a sandbox, so you can remote wipe the sandbox, but the rest of the phone isn’t accessible to anything in the sandbox even with “device admin” permissions.
There are ways around most things, but you’ll have to define this sandbox on your mobile as a lot of these can be prevented with the right additional product, obviously Microsoft being Microsoft isn’t going to give this away.