… actually they aren’t wrong. MDMs are given special permissions including but not limited to reading your SMSes and phone records, restricting and monitoring your installed apps and even wiping your device.
I’m not sure what MDM you’re subjected to but I’ve been an MDM engineer for 7 years using Intune and JAMF and no, no SMS or phone records. Even the phone # is blanked out minus the last 4 digits. Yes we can wipe the devices if it’s lost\compromised but personal versus corporate owned devices are limited. I can’t see what apps you have that were personally installed. And the only info I can get are the device stats (SN, IMEI, storage, battery, memory, etc).
Yeah I have looked at those solutions and one not on your list (MobileIron, not sure if they’re still around). I don’t know why anyone would choose those solutions but good call.
Can you support your claims? I’ve worked with Intune, Jamf, MaaS360, Citrix, and Workspace ONE and none of them could read texts, emails or browser history.
I’d be very interested to learn more about how they can access this information through MDM. We always did it through either the mobile carrier or the admin console for whatever the office/mail suite that was deployed.
I looked through your links. I don’t see anywhere that SMS can be read. The permission kind of makes sense as there is a security component to filter spam/phishing type texts. Sophos themselves claim they don’t store any of that data.
I hadn’t ever seen the call log one and I’m not sure what that would even be used for. It was interesting though.
App lists is common across all MDMs. It’s used to ensure apps are being updated and on fully owned corporate devices some apps will be blocked.
It seems like many don’t really understand how this technology works. That said, it’s better to be overly careful and I agree with others in the comments. If you want me to use a mobile device for work you can provide it, I don’t put MDM on my personal device*.
*the exception being our own MDM we have setup to manage our personal devices more easily.
I looked through your links. I don’t see anywhere that SMS can be read.
From the link, emphasis mine. SMC is the MDM in question
Read SMS or MMS
Allows an application to read SMS messages stored on your device or SIM card.
Malicious applications may read your confidential messages.
SMC usage:
Read the initial configuration and further server notifications. 2. Read all SMS for Backup.
This link provides more information and explicitly states the following:
Sophos Mobile does not track privacy data such as contacts, SMS and call history, browser history, bookmarks, or emails. Sophos Mobile does not access any data outside of the Sophos container.
and
Sophos Mobile does not track privacy data such as contacts, SMS and call history, browser history, bookmarks, emails, or data on the SD card.
Sophos has a strong cybersecurity focus which, I’d imagine, is why they have the message filtering option that they do.
I’m not a Sophos admin, never have been, so I can only speculate but it might be to restore a message that was altered due to the filtering if captured incorrectly.
I’m also not sure why it specifies SMS but not RCS. I do know Sophos uses SMS to communicate between a device and Sophos Central.
Without more context and information it’s hard to say what exactly happening from the permissions KB.
I can’t definitively say it’s not possible but I’ve never heard of an MDM that allows an admin to read user texts. I appreciate the links, it helps to understand where you’re coming from.
I still remain skeptical but, like I said, better to be over cautious than under. I’d be leery of any company that tried requiring me to use my personal device with MDM.
Everywhere I’ve worked with BYOD it’s been optional to use your personal device. If you were in a role that required it you’d get a company provided device.
Please cite any one of your sources. I’ve managed MDM for over a decade and you’re spreading misinformation.
Absolutely none of the MDM products on the market allow for the reading of personal e-mail, SMS, phone records, etc. On the contrary, almost every single one provides an information screen during the enrollment that makes it abundantly clear that they do not (and can not) access that data. Moreover, the “wipe” of data is the removal of company data. It doesn’t wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.
Moreover, the “wipe” of data is the removal of company data. It doesn’t wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.
… actually they aren’t wrong. MDMs are given special permissions including but not limited to reading your SMSes and phone records, restricting and monitoring your installed apps and even wiping your device.
I’m not sure what MDM you’re subjected to but I’ve been an MDM engineer for 7 years using Intune and JAMF and no, no SMS or phone records. Even the phone # is blanked out minus the last 4 digits. Yes we can wipe the devices if it’s lost\compromised but personal versus corporate owned devices are limited. I can’t see what apps you have that were personally installed. And the only info I can get are the device stats (SN, IMEI, storage, battery, memory, etc).
Intune and JAMF are not the only MDMs on the market. There are others that do offer these capabilities, at least on Android.
SMS reading:
https://support.sophos.com/support/s/article/KB-000034436?language=en_US
Call log reading:
https://knowledgebase.42gears.com/article/how-to-view-call-logs-on-android-phones-remotely-using-suremdm/
And app lists:
https://help.ivanti.com/mi/help/en_us/cld/admin/ivanti/91/all/en-us/App_Inventory.htm
Yeah I have looked at those solutions and one not on your list (MobileIron, not sure if they’re still around). I don’t know why anyone would choose those solutions but good call.
I also don’t know why anyone would use these either FWIW
Can you support your claims? I’ve worked with Intune, Jamf, MaaS360, Citrix, and Workspace ONE and none of them could read texts, emails or browser history.
I’d be very interested to learn more about how they can access this information through MDM. We always did it through either the mobile carrier or the admin console for whatever the office/mail suite that was deployed.
SMS reading:
https://support.sophos.com/support/s/article/KB-000034436?language=en_US
Call log reading:
https://knowledgebase.42gears.com/article/how-to-view-call-logs-on-android-phones-remotely-using-suremdm/
app lists:
https://help.ivanti.com/mi/help/en_us/cld/admin/ivanti/91/all/en-us/App_Inventory.htm
I looked through your links. I don’t see anywhere that SMS can be read. The permission kind of makes sense as there is a security component to filter spam/phishing type texts. Sophos themselves claim they don’t store any of that data.
I hadn’t ever seen the call log one and I’m not sure what that would even be used for. It was interesting though.
App lists is common across all MDMs. It’s used to ensure apps are being updated and on fully owned corporate devices some apps will be blocked.
It seems like many don’t really understand how this technology works. That said, it’s better to be overly careful and I agree with others in the comments. If you want me to use a mobile device for work you can provide it, I don’t put MDM on my personal device*.
*the exception being our own MDM we have setup to manage our personal devices more easily.
From the link, emphasis mine. SMC is the MDM in question
2. Read all SMS for Backup.
Yep, it’s part of their message filtering that I mentioned.
This link provides more information and explicitly states the following:
and
Sophos has a strong cybersecurity focus which, I’d imagine, is why they have the message filtering option that they do.
…why would they need to backup all SMS messages for a filtering option? That just plain does not compute.
The short answer is to restore it:
I’m not a Sophos admin, never have been, so I can only speculate but it might be to restore a message that was altered due to the filtering if captured incorrectly.
I’m also not sure why it specifies SMS but not RCS. I do know Sophos uses SMS to communicate between a device and Sophos Central.
Without more context and information it’s hard to say what exactly happening from the permissions KB.
I can’t definitively say it’s not possible but I’ve never heard of an MDM that allows an admin to read user texts. I appreciate the links, it helps to understand where you’re coming from.
I still remain skeptical but, like I said, better to be over cautious than under. I’d be leery of any company that tried requiring me to use my personal device with MDM.
Everywhere I’ve worked with BYOD it’s been optional to use your personal device. If you were in a role that required it you’d get a company provided device.
Please cite any one of your sources. I’ve managed MDM for over a decade and you’re spreading misinformation.
Absolutely none of the MDM products on the market allow for the reading of personal e-mail, SMS, phone records, etc. On the contrary, almost every single one provides an information screen during the enrollment that makes it abundantly clear that they do not (and can not) access that data. Moreover, the “wipe” of data is the removal of company data. It doesn’t wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.
Quick Sources for Intune and JAMF – do your own googling for others:
https://learn.microsoft.com/en-us/mem/intune/protect/privacy-data-collect
https://www.jamf.com/blog/apple-mobile-device-management-faq/
So you’re not aware of Sophos’s MDM offering? That explicitly states they can make copies of all SMS messages?
https://support.sophos.com/support/s/article/KB-000034436?language=en_US
How about call logs, with SureMDM?
https://knowledgebase.42gears.com/article/how-to-view-call-logs-on-android-phones-remotely-using-suremdm/
Also I said nothing about personal emails.
No, the ‘wipe’ can be a full factory reset.
https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe
Edit: typo