# 20 Basic mobile device management

> DRAFT · v0.1.0 · role: Prevent · [policy: #25 · #7](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Unlocks: [№21 Leaver offboarding runbook](leaver-offboarding.md)

The free floor of device control: every phone that syncs work data is enrolled, must carry a screen lock, refuses to sync when rooted or jailbroken, and can have its work account wiped from the console the day its owner leaves. All of it ships in every edition — basic management needs no agent on iOS and only the Device Policy app on Android. Device-trust CAA ([29 Device-trust CAA via MDM](device-trust-caa.md)) builds posture gating on top of the same screens; this control is the layer beneath it that every tenant can afford, and it is what makes the wipe step of the leaver runbook ([21 Leaver offboarding runbook](leaver-offboarding.md)) possible.

Documentation: [Set up basic mobile device management](https://knowledge.workspace.google.com/admin/devices/set-up-basic-mobile-device-management)

## Caveats

- Basic management's wipe is an ACCOUNT wipe — it removes the work account and its data from the device, not the device's contents; a full device wipe needs advanced management.
- OS-version and encryption signals can take days to sync after enrolment — a Context-Aware Access policy keyed on those signals (№29) may lock fresh enrolments out in the interim.
- This manages the sync channel, not the endpoint: work data read through the phone's browser never touches mobile management — the web session ceiling (№12) is what bounds that path.

## Setup steps

1. Set the management level under General > Mobile management. Basic is the floor for every personal device; reserve Advanced for organization-owned devices, where its full-wipe and app-management powers are proportionate. — `Devices › Mobile & endpoints › Settings › Universal`

   - **Mobile management** = Basic (Advanced for company-owned devices)
   Note: Basic management is on by default in new tenants — the step exists because migrated and older tenants routinely have it off, and because the default only helps if the settings below it are actually configured.

2. Require a password on managed devices, so a lost phone is a locked phone rather than an open mailbox. — `Devices › Mobile & endpoints › Settings › Universal`

   - **Password requirements** = Require users to set a password/screen lock

   docs: [Apply universal settings for mobile devices & endpoints](https://knowledge.workspace.google.com/admin/devices/apply-universal-settings-for-mobile-devices-and-endpoints)

3. Block compromised devices — a rooted or jailbroken phone can lie about every other posture signal, so it does not get to sync work data at all. — `Devices › Mobile & endpoints › Settings › Universal`

   Security > Compromised devices: Block rooted/jailbroken devices from syncing = On

   docs: [Apply universal settings for mobile devices & endpoints](https://knowledge.workspace.google.com/admin/devices/apply-universal-settings-for-mobile-devices-and-endpoints)

4. Require admin approval before a new device syncs, so device enrolment becomes a decision instead of an event you read about in a report. — `Devices › Mobile & endpoints › Settings › Universal`

   - **Security > Device approvals** = Require admin approval
   Note: Someone must actually work the approval queue — route the approval notifications to the monitored admin alias ([№2](alert-recipient-hygiene.md)), or this setting turns into users waiting silently for access.

## Ongoing maintenance

- **[automatable: script]** Quarterly: export the device inventory and retire stale entries — an approved device that stopped syncing months ago is standing access waiting for its next sync.

## How to verify

1. Enrol a test phone with no screen lock — sync must be refused until a passcode is set. The refusal is the control working; observe it on the device, not in the console.

2. Export the inventory and confirm every syncing device is managed and approved.

   ```
   gam print mobile fields deviceid,email,model,status,lastsync
   ```

## Settings screens

- Devices > Mobile & endpoints > Settings > Universal
  - console: https://admin.google.com/ac/managedsettings/724141353720?vid=EMM_UNIVERSAL_SETTINGS_VIEW