My organization is rolling out BYOD MDM for personal iPhones. What can they see?

What your organization can see and do on your personal iPhone/iPad (User Enrollment)

With User Enrollment, Apple keeps work data and personal data separated. Your organization manages only the work side: your Managed Apple ID and the apps, accounts and settings it installs. Your personal data stays private.

Information your organization can see

• Device basics: device name, model, iOS version, storage capacity and free space, battery level, time zone.
• Enrollment details: enrollment date, last check-in time, and your Managed Apple ID.
• Security status:
  • whether a passcode is set and whether it meets the organization’s requirements
  • the auto-lock grace period
  • encryption capability
• Privacy settings: whether you share diagnostics and app analytics with Apple.
• Work apps: the apps your organization installed, and their versions.
• Work configurations: the profiles your organization installed, such as Wi-Fi, email or certificates, plus the work accounts set up on the device.
• Unique identifier: an anonymous enrollment ID that Apple creates only for this enrollment. It is not your device’s real hardware ID.

Information your organization cannot see

• Serial number, IMEI, real hardware ID (UDID) or SIM details (ICCID)
• Phone number, carrier or network details (IP address, Wi-Fi and Bluetooth addresses, roaming or hotspot status)
• Device location: no Lost Mode or location tracking
• Your personal apps, or any app you installed yourself
• Personal data: photos, messages, email, contacts, browsing history, call logs, files
• iCloud backup status, Do Not Disturb, Activation Lock, or the Apple ID you use for the App Store

What your organization can do

• Refresh information: ask the device to report the details listed above again.
• Install and remove work apps: install apps (licensed to your Managed Apple ID), update them, configure them, and remove them. Only apps they installed can be removed.
• Send you a message: only through the SimpleMDM app, and only if it’s installed.
• Remove management (unenroll): this deletes all work apps, accounts, settings and data. Your personal data is not touched.

What your organization cannot do

• Erase or factory-reset your device
• Clear or reset your passcode
• Put the device in Lost Mode, play a sound on it, or locate it
• Restart or shut it down, or force or schedule iOS updates
• Rename your device
• Manage Activation Lock or your Apple ID
• Turn Bluetooth on or off, change roaming or hotspot settings, or collect diagnostic logs
• Install books or media

Settings your organization can apply

Can apply

• Wi-Fi networks
• Work email, calendar, contacts and directory accounts
• Certificates
• Passcode requirements
• Web shortcuts (Web Clips)
• AirPlay and AirPrint setup
• Single sign-on extensions
• Settings for work apps

Restrictions (limited set)

• Keep work data in work apps (control copy, paste and “Open In” between work and personal apps)
• Block screenshots
• Block iCloud sync for work apps
• Require encrypted backups
• Siri and lock-screen controls
• On-device-only dictation
• Safari fraud warnings
• The other restrictions Apple allows for User Enrollment

Cannot apply

• A VPN or proxy that covers the whole device
• Web content filtering
• Home screen layout or wallpaper
• Single-app (kiosk) mode
• Hiding or blocking your personal apps
• Control over iOS software updates
• Most device-wide restrictions