20 Basic mobile device management

draft

The free floor of device control: every phone that syncs work data is enrolled, must carry a screen lock, refuses to sync when rooted or jailbroken, and can have its work account wiped from the console the day its owner leaves. All of it ships in every edition — basic management needs no agent on iOS and only the Device Policy app on Android. Device-trust CAA (29 Device-trust CAA via MDM) builds posture gating on top of the same screens; this control is the layer beneath it that every tenant can afford, and it is what makes the wipe step of the leaver runbook (21 Leaver offboarding runbook) possible.

Documentation: Set up basic mobile device management

Caveats

Basic management’s wipe is an ACCOUNT wipe — it removes the work account and its data from the device, not the device’s contents; a full device wipe needs advanced management.
OS-version and encryption signals can take days to sync after enrolment — a Context-Aware Access policy keyed on those signals (№29) may lock fresh enrolments out in the interim.
This manages the sync channel, not the endpoint: work data read through the phone’s browser never touches mobile management — the web session ceiling (№12) is what bounds that path.

Setup steps

Set the management level under General > Mobile management. Basic is the floor for every personal device; reserve Advanced for organization-owned devices, where its full-wipe and app-management powers are proportionate.

Screenshot pending capture — follow the steps below.

Devices › Mobile & endpoints › Settings › Universal

Mobile management

Basic (Advanced for company-owned devices)

Basic management is on by default in new tenants — the step exists because migrated and older tenants routinely have it off, and because the default only helps if the settings below it are actually configured.
Require a password on managed devices, so a lost phone is a locked phone rather than an open mailbox.

Devices › Mobile & endpoints › Settings › Universal

Password requirements

Require users to set a password/screen lock

Apply universal settings for mobile devices & endpoints
Block compromised devices — a rooted or jailbroken phone can lie about every other posture signal, so it does not get to sync work data at all.

Devices › Mobile & endpoints › Settings › Universal

Security > Compromised devices: Block rooted/jailbroken devices from syncing = On
Require admin approval before a new device syncs, so device enrolment becomes a decision instead of an event you read about in a report.

Devices › Mobile & endpoints › Settings › Universal

Security > Device approvals

Require admin approval

Someone must actually work the approval queue — route the approval notifications to the monitored admin alias (№2), or this setting turns into users waiting silently for access.

Ongoing maintenance

automatable: script Quarterly: export the device inventory and retire stale entries — an approved device that stopped syncing months ago is standing access waiting for its next sync.

How to verify

Enrol a test phone with no screen lock — sync must be refused until a passcode is set. The refusal is the control working; observe it on the device, not in the console.
Export the inventory and confirm every syncing device is managed and approved.
```
gam print mobile fields deviceid,email,model,status,lastsync
```

draft v0.1.0 Prevent policy #25 · #7 ↗