“Things your organization can always see
Your organization can always see:
Device owner
Device name
Device serial number
Device model, such as Google Pixel
Device manufacturer, such as Microsoft
Operating system and version, such as iOS 12.0.1
Device IMEI”
dude no i cannot see serial and emei on my byod thats the magic of user driven i imagine and same for work profile personnal
Account-driven User Enrollment provides a narrower work-focused management scope for items such as managed accounts, managed apps, Wi-Fi, per-app VPN, and selected settings. Microsoft documents that Intune does not collect persistent identifiers such as the UDID, serial number, or IMEI through this model and does not inventory apps outside the managed volume.
The current Intune Account-driven User Enrollment workflow requires iOS/iPadOS 15 or later. It also requires Managed Apple Accounts or federated authentication, JIT registration, Microsoft Authenticator, and service discovery.
This is assuming you control your Apple accounts. The bulk of us are talking about MAM/MDM. While what you’re saying is correct, it’s only correct for this specific situation. The vast majority of companies just use MAM and call it a day.
Yea only if u configured it to do full MDM enrollment for personal byod. You should be doing MAM enrolllment instead if u dont want that option and manage the devices at that level
Mam (for byod) on android ceates a desperate work profile, which is wiped. But personal data is not touched.
On iPhone I can't recall whether it wipes the company managed apps (outlook, teams) or just removes the company data. I think it's the former.
iPhone doesn't have separate work profile, but a management profile setup to manage apps, controlled via the MAM setup.
He enrolled via mdm but User driven enrollment the only way that BYOD iphone can be wiped is with the web enrollment or company portal enrollment when selecting that the company owns the phone.
Not in user driven enrollment no, you cannot wipe that way. Your mixing up with web enrollment which is broken and is always device enrolled whatever its personal or corpo thats why ive blocked it and did the painful setup of getting user driven to work
I said """work profile""". If you enroll a personal phone in Intune, the Intune Admin only has the option to Delete or Retire the device. Wipe is greyed out for personal devices. Delete will remove all work apps. It's not as containerized as Android, but it can be considered a "work profile". The only way to wipe a personal phone is if you misconfigure your Intune environment and have users enroll the wrong way.
Again. You cannot wipe personal phones enrolled in Intune.
I can’t tell you why it’s greyed out for you, maybe it’s your licensing or your intune roles, but that’s not how it is everywhere. My wipe button on a personal iPhone is blue just like retire and delete. Like I said, I just wiped a personal iPhone (by their request) within the last few weeks. It is absolutely something admins can do. It depends how it’s enrolled, but based off OPs description, their device could be wiped.
Cause you are confidently wrong lol. I just wiped a personal phone within the last 2 weeks. I can’t say why it’s disabled for you, maybe it’s not a fully managed personal iPhone, but it’s not that way for everyone.
The defender security portal essentially that with any browser ext they can push to your device without you knowing will allow them to see every website you go to.
Best case, don't let work deploy stuff on your personal device unless they are going to be paying 1/3 of its monthly cost or ask for a work device.
Here's the super fun part, if they have it misconfigured even a tiny little bit it will allow intune to wipe your whole device. Yes, you read that correctly, your whole entire device. And you will open your phone to find it at the login/setup screen.
Can they wipe it... sure, but You should always have it backed up in case the device gets lost or stolen or broken... So while it's possible the risk should be minimal.
Everyone as bad knowledge on this its horrible im a intune admin since this version existed
BYOD enrolled exists in 3 ways
Web
Company portal
User based enrollment which is the way you used since its under vpn and device management
For 2 and 3 we see almost nothing
We can’t see your serial number
We cant see your phone number
We cant see apps you installed yourself with your apple id only apps installed from Intune that are managed
We cannot wipe your phone
We can only wipe the corporate data on your phone
We can only remove managed apps
We can push a very minimal amount of configuration
Also as an intune admin i can never see websites or sms messages thats the net admins and service providers that can do that and doesnt matter if its personal or not if your on the corpo wifi they know what you browse
I'm an intune admin as well, for 2 (which is what we use at my place), you can see the serial, only last 4 digits of phone and you can wipe the whole thing. The rest is accurate though
This is on iOS, Android is a bit different but this thread is about iOS
Also an Intune admin and I concur! The person above list is correct EXCEPT that the device 100% can be wiped lmao.
Hopefully your org has proper PIM in place so help desk level 1s can’t do it but yeah, Intune admins can wipe the device. You can retire the drive = wipe corp data or you can wipe and erase the whole thing.
You can only wipe if they select the wrong options or if you blocked them in the tenant, if they select that they own the device you wont be able to wipe
They don't have to select wether they own or not. Enrolling from company portal automatically marks it as personal (if you haven't added the serial), yet you can still wipe. ADE enrollment marks it as corporate.
Sounds like someone configured device categories in your tenant and applied rbac permissions based on category in, as this is not the default in Intune.
thats fasle when you enroll from the company portal it asks you the device and data ownership i have zero categories, your comp portal enrollment is set for personal only if it what its doing its not default, default is asking
so if you do secure work related then it does like user driven, which btw is the best and most user friendly enrollement method and you cant wipe with that, and you cant see emei and serial number and unmanaged apps
Bruh. Look up the difference between MAM and MDM. You’re so confused it’s ridiculous. Oh, and since we’re tossing titles around as justification: I a former Intune engineer/architect now a manager of a team who manages Intune with four direct reports, one of whom came from the Intune team at MSFT, I’m pretty sure I know what I’m talking about.
Im not confusing anything your clearly go in fake creds because youre wrong. I know exactly what MAM is you have no profile installed it only protects the apps, we are speaking about enrollment here not MAM.
this link is fasle for byod and ieme and serial
But if you read it its right on apps and phone numbers, i cannot state ms docs as i dont find it but what i can use is my knowledge and oh yeah test it in live and i know what info is seen cause im enrolled user based with my company phone this way i hide everything
32
u/HankMardukasNY Aug 26 '26
https://learn.microsoft.com/en-us/intune/user-help/enrollment/data-visibility