What Can MDM See?

This is the most popular question among users of iOS devices whose iPhones or iPads are enrolled into the MDM program by their employers. This question will be answered here to let you know whether MDM administrators can view your personal information, photos, messages and location on your supervised device.

You can also view the information about features of your iPhone or iPad managed by your company’s IT department in the Settings menu. When you tap on profile information, you’ll see the list of features managed or restricted via MDM.

MDM & iMessages

The IT department can NOT read SMS messages or iMessages on your iPhone or iPad. The only information available to them in this regard is just a number of messages or contacts on your device. But it’s impossible for them to see what and to who you have sent.

However, it is possible for MDM administrators to view SMS messages via cellular carrier without involving Apple or iMessage app. You should also know that iMessages app can be disabled by the IT department. The other issue is that if a corporate owned device was taken from you to be passed to another employee or for whatever other reason, the IT department can unlock the device and get access to your iMessages. Apple makes sure to prevent remote viewing of iMessages.

MDM & Photos in the Photo app

Things with the Photos app are pretty much the same as with the iMessage app. No MDM protocol exists which can remotely view, modify or delete photos in the Photos app, as well as in iCloud Photos.

At the same time, MDM administrators can disable the iCloud Photos feature. The reason why they would do that is that employees or students do not overload a managed Apple ID with personal photos or media. As a user, you should also be aware of the fact that apps requesting access to your device’s photo library can view all the pictures and location data linked to them.

MDM & Personal email accounts

If you use your personal account via webmail, the chances are that the IT department will know you used your personal account on the managed device. But they definitely can’t read your emails. They can’t read your emails even if you use a local Mail app. What they can do is to restrict new email accounts adding or removal.

MDM & Browser History

Basically, MDM software is supposed to manage devices. Therefore, it can’t monitor your browser history in Safari or Chrome. However, administrators can set restrictions limiting access to certain sites, or just block browser usage at all. Managed devices can also be forced to use VPN in the corporate network which allows MDM administrators to monitor traffic. But still, the list of websites you visited remains unavailable to them.

Location Tracking

MDM allows administrators to track enrolled devices location only if they are put in Managed Lost Mode. If an administrator turns on managed lost mode on a supervised device, its location will be revealed to him or her. But the device will also get locked and will be displaying a message saying it’s locked and is in lost mode. An administrator will have to turn the managed lost mode off to make the device usable again.