Small Town Sysadmin
Free CJIS checklist

Tech basics

"Activate device admin app?" What that prompt means when you add work email to an Android phone

Adding a work email account to an Android phone's built-in mail app can ask for device admin rights, which can include erasing the whole phone. Here's what you're agreeing to, and the friendlier option for personal phones.

You add your work email to your own Android phone, and partway through the setup a screen pops up: Activate device admin app? It lists things the app will be allowed to do, and one of them sounds alarming: erasing all of the phone’s data.

Most people tap Activate to get their email working. It’s worth knowing what that means first, especially on a personal phone.

What’s going on

Work email that syncs through Exchange (including Microsoft 365) can come with a security policy set by whoever runs the mail system: require a screen lock, set a minimum password length, lock after so many minutes, and so on. A phone’s built-in mail app enforces those rules by asking Android to make it a device admin app.

Android’s own developer documentation describes this exact use: the built-in Email app uses the device admin features so Exchange administrators can enforce password rules across devices and remotely wipe (restore factory defaults on) lost or stolen phones.

If you decline, the app stays installed but its policies aren’t enforced, and Android notes you may not be able to sync your data. In practice, that usually means no work email in that app.

What the mail administrator can do once it’s active

Two settings matter most for a personal phone.

Remote wipe. In Exchange Online, an admin can send a Wipe Data command to a phone that uses the built-in mail app. Microsoft’s documentation is blunt about what that does there: all data on the device is wiped, including photos and personal files. There’s also a gentler Account Only Remote Wipe that removes just the work mail, calendar, and account, but only if the mail app supports the newer version of the sync protocol. If it doesn’t, the account-only wipe fails.

Wipe after failed passwords. An Exchange mobile device policy can be set to wipe a phone after a number of wrong screen-lock attempts (an admin can pick anywhere from 4 to 16). A curious toddler with your phone is the classic way this goes wrong.

None of this means your IT person is going to erase your phone. A remote wipe is meant for a phone that’s lost or stolen. But on a phone full of family photos, you should know it’s possible.

Before activating device admin on a personal phone, make sure your photos and contacts are backed up somewhere other than the phone.

Newer Android versions are moving away from this

Google has been retiring the old device admin approach. Starting with Android 9, the device admin password and camera rules were marked deprecated, and on Android 10, apps built for that version can no longer enforce them through device admin. Google now recommends work profiles for personally owned phones, which keep work apps and data in a separate, managed space.

So depending on your phone and mail app, you may see this prompt, a different one, or none at all.

The friendlier option for personal phones: Outlook with app protection

For offices on Microsoft 365, the better setup for staff who use their own phones is the Outlook app with Intune app protection policies. Microsoft describes this as a great option for “bring your own device” setups, because it protects the company’s data without managing the person’s phone.

What changes:

  • Wipes stay inside Outlook. When an admin wipes Outlook for Android, it removes the Outlook profile and the data in it, not your whole phone. With Intune, the admin can remove work email while leaving personal email accounts alone, whether or not the phone is enrolled.
  • The rules apply to the app. App protection policies control things like copying work data out of the app, rather than taking over the phone.
  • On Android, staff also install Intune Company Portal. The phone doesn’t have to be enrolled, but Microsoft says the Company Portal app must be installed for app protection to apply on unenrolled Android phones.

There’s a cost: Intune and Microsoft Entra ID P1 (for conditional access) need to be licensed for each user. Check what your Microsoft 365 plan already includes before buying anything.

One more thing for whoever runs the mail system: Outlook for iOS and Android shows up as one device entry per user in Exchange. A wipe sent to it removes data from every device that person uses Outlook on.

If you already tapped Activate

Nothing bad has happened. If you’d rather switch to Outlook, remove the work account from the built-in mail app, then turn off that app’s device admin access (Android requires this before the app can be uninstalled). The setting’s location varies by phone maker, so the quickest way to find it is to search your phone’s Settings for device admin.

Then ask whoever manages your email which app they want you to use. And while you’re asking, make sure two-step sign-in is turned on for your account.

Sources

All articles