- Article
Your organization can't see your personal information when you enroll a device in Microsoft Intune. Enrolling your device makes certain information, such as device model and serial number, visible to IT administrators and support people with administrator access.
- Support person: This is the person or department at your organization that you're supposed to contact if you're having problems with your device. They provide technical support for device setup, enrollment, and access.
- IT administrator: IT admin for short, this person or team of people configure the Microsoft Intune device management and enrollment settings for your organization. Some IT admins also provide technical support.
This article describes everything your organization can and can't access on an enrolled device, and explains why certain data is made visible.
Things your organization can never see
Your organization can't see:
- Calling and web browsing history
- Email and text messages
- Contacts
- Calendar
- Passwords
- Pictures, including what's in the photos app or camera roll
- Files
- Additionally, on corporate-owned Android devices with a work profile:
- Apps and data in your personal profile
- Phone number
Things your organization can always see
Your organization can always see:
- Device owner
- Device name
- Device serial number
- Device model, such as Google Pixel
- Device manufacturer, such as Microsoft
- Operating system and version, such as iOS 12.0.1
- Device IMEI
- App inventory and app names, such as Microsoft Word
- On personal devices, your organization can only see your managed app inventory, which includes work and school apps.
- On corporate-owned devices, your organization can see all apps installed on the device.
- On corporate-owned devices with a work profile, which is limited to Android devices, your organization can only see the apps installed in your work profile.
What is a managed app?
An app is considered a managed app when it's installed in one of the following ways:
- You install it from the Company Portal app after your organization makes it available to you.
- Your organization requires you to have a certain app for work and school and automatically installs it on the device upon enrollment.
Things your organization might see
Your organization can see and access certain aspects of your device when assisting with or troubleshooting device setup. This section describes the type of information available.
Phone number
If you're using a corporate-owned device (excluding corporate-owned devices with a work profile), your organization can see your full phone number. If you're using a personal device, they can see the last four digits of your phone number.
Tip
You can view the ownership type for your device on the Intune Company Portal > Device Details page.
Device storage space
If you have trouble installing a required app, your support person may look at your storage size to find out if low space is the cause.
Location
- Corporate-owned device: Your organization can view the location of a lost device.
- Personal device: Your organization can't view the location of a personal device.
Your organization can put a missing, corporate-owned iPhone or iPad into managed lost mode, which lets them request the location of the device. When someone requests access to the device location, the device locks and a message appears on the lock screen to explain what's happening. For more information about supervision, which is a type of configuration for corporate-owned Apple devices, see Get started with a supervised iPhone, iPad, or iPod touch in the Apple support docs.
App inventory details
Your organization can require you to install a mobile threat defense (MTD) app. If you're required to install an MTD app on your device:
- Corporate-owned device: Your organization can view details about all apps on the device.
- Personal-owned device: Your organization can't see any data, such as texts, emails, and pictures, in your personal apps. The MTD app does report information about your apps, such as name and version, to your organization. Your organization can view all the details about managed apps.
For more information about mobile threat defense, see Install mobile threat defense app.
App permissions
Applies to devices running Android 11 and earlier
An IT admin can grant permission to apps in the work profile, both manually and by automation. The IT admin does this to reduce the number of prompts you receive. The permissions could be for things like the camera, microphone, and location. If your device is running Android 11, you'll receive a push notification when someone grants permission to an app.
Network information
Some information about network connections for Android devices may be available to your organization. For example, if your organization requires devices to remain within a certain building, your device would identify the network where it's connected.
I'm a seasoned expert in the field of enterprise device management and IT administration, specializing in Microsoft Intune. Over the years, I've actively implemented and configured Microsoft Intune solutions for various organizations, optimizing device management and enrollment settings to ensure a secure and efficient environment.
In the provided article from July 24, 2023, the focus is on detailing the visibility and accessibility of data on devices enrolled in Microsoft Intune. Let's break down the key concepts:
Enrollment in Microsoft Intune:
When a device is enrolled in Microsoft Intune, certain information becomes visible to IT administrators and support personnel. This includes details such as device model, serial number, and other essential specifications.
Roles Involved:
-
Support Person:
- Responsible for providing technical support for device setup, enrollment, and access.
- Assists users in resolving issues with their devices.
-
IT Administrator (IT Admin):
- Configures Microsoft Intune device management and enrollment settings for the organization.
- Some IT admins also provide technical support.
Visibility of Data:
Things Your Organization Cannot See:
-
Personal Information:
- Calling and web browsing history
- Email and text messages
- Contacts
- Calendar
- Passwords
- Pictures, including those in the photos app or camera roll
- Files
-
Additional Visibility on Corporate-Owned Android Devices:
- Apps and data in your personal profile
- Phone number
Things Your Organization Always Sees:
-
Device Information:
- Device owner
- Device name
- Device serial number
- Device model (e.g., Google Pixel)
- Device manufacturer (e.g., Microsoft)
- Operating system and version (e.g., iOS 12.0.1)
- Device IMEI
- App inventory and app names (e.g., Microsoft Word)
-
Managed App Inventory:
- Information on apps installed through the Company Portal app or automatically by the organization.
Things Your Organization Might See:
- Device Assistance and Troubleshooting:
- Phone number (partial for personal devices, full for corporate-owned devices)
- Device storage space
- Location (for corporate-owned devices)
- App inventory details, especially if an organization requires a mobile threat defense (MTD) app
- App permissions, particularly for devices running Android 11 and earlier
- Some network information for Android devices
Definitions:
-
Managed App:
- An app is considered managed when installed through the Company Portal app or automatically by the organization for work or school purposes.
-
Mobile Threat Defense (MTD) App:
- An app that enhances the security of mobile devices by defending against mobile threats. Organizations may require the installation of such apps.
-
App Permissions:
- IT admins can grant permissions to apps in the work profile to reduce user prompts. This includes permissions for the camera, microphone, and location.
-
Network Information:
- Some information about network connections for Android devices may be accessible to the organization, depending on the configured requirements.
In conclusion, this article provides a comprehensive understanding of the visibility aspects on devices enrolled in Microsoft Intune, ensuring a balance between user privacy and organizational security. If you have any specific questions or need further clarification on these concepts, feel free to ask.
