iPhone tower · floor

iPhone device management, and what an employer cannot see

Two questions bring people to iPhone device management, and Apple answers both in a page written for the person holding the phone rather than for the administrator. The first is what the organisation can change. The second is whether it can see where they are, and Apple’s answer to that one is unusually precise.

It is worth being careful about what that sentence covers and what it does not. It is about location. Apple’s page also notes you “might see a message in your settings that your organization can monitor your internet traffic and locate your device” — and then narrows the second half of that message to Managed Lost Mode. The first half is not narrowed, and this floor is not going to pretend otherwise: what a managed network can see of traffic is a separate question with a separate answer.

The distinction between those two checks matters. The message at the top of Settings answers whether; the profile under VPN & Device Management answers what. Apple treats them as two separate lookups rather than one, and only the second tells you which features have been changed from their defaults — which is the part you would actually want in an argument about what the phone is doing.

Read that list for what it is: examples, not an inventory. Apple is describing a capability, and the specific policy your organisation has written is not published anywhere you can read it. Which leads to the instruction Apple gives and most guides omit.

The step Apple names that most people skip. After looking at the profile, the guide says: “To learn more about the features changed for your specific organization, ask your administrator whether these settings are enforced.” That is not a brush-off. The profile screen shows the categories a profile touches; only the organisation can tell you how its policy is actually configured — and asking creates a record of having asked, which is worth having if the answer later turns out to be different.

A word about what this floor will not do, since a large part of the searching in this area is for a way out. A supervised device belongs to the organisation that issued it — that is the premise of the whole arrangement, and Apple’s page is addressed to “customers who use a supervised device from their employer or school”. Removing management from a device somebody else owns is not a settings problem, and there is nothing here about how to do it. If the device is genuinely yours and the profile is a leftover from a previous arrangement, that is a conversation with whoever installed it rather than a workaround.

The floors below take it three ways: what supervision is and how to check, what an administrator can change, and the neighbouring settings on a phone somebody else has a say in.

What this tower will not do

It will not tell you an employer is watching you continuously. Apple states one condition for location visibility and attaches a locked screen and a notice to it.

It will not tell you an employer sees nothing either. Apple narrows the location half of that settings message and not the traffic half, and this floor reports both.

And it will not explain how to remove management from a device an organisation owns. That is the premise of the arrangement rather than a fault in it. What holds instead is simple: the statement that an administrator can view a device’s location only in Managed Lost Mode, which locks the device and shows a notification; that devices are unsupervised by default and supervision can only be enabled at setup; the two ways to check; the examples of what supervision allows; and the instruction to ask your administrator are quoted from Apple’s support documentation, listed below.