5

I connected to my employer's Exchange server in order to receive email, calendar, etc... In the small print of the instructions, it was mentioned that by doing that, the administrators gain the right to remotely wipe my phone. Note that I own the phone - not the employer.

There are several documents on the internet that provide instructions (while not mentioning iPhone specifically, but rather generic "phone").

Is remote wipe actually possible with an iPhone just by connecting to an employer's Exchange server?

7

Yes, depending on how things are configured, your employer may be able to wipe your device. The ability to wipe only the Exchange account data was added later as an optional wipe mode.

From another TechNet article:

Your users carry sensitive corporate information in their pockets every day. If one of them loses their mobile phone, your data can end up in the hands of another person. If one of your users loses their mobile phone, you can use the Exchange admin center (EAC) or the Exchange Management Shell to wipe their phone clean of all corporate and user information. (emphasis added)

In other words, the phone is not "completely erased" -- but all user data is destroyed. I believe this is accomplished on iOS by throwing away the encryption key. The operating system remains, but all user data is gone.

For example:

In June of 2016 Microsoft announced an update to the Exchange ActiveSync protocol which they called EAS 16.1. Among the improvements in EAS 16.1 was the addition of account-only remote wipes, which allows an administrator to issue a remote wipe for only the Exchange mailbox data on a mobile device. Previously, a remote wipe for an ActiveSync device would wipe the entire device if the user was using a native mail application to connect from the device.

| improve this answer | |
  • 1
    When you say user data, does that mean all my photos and contacts that are on my phone (and have nothing to do with employer) are gone as well? – AngryHacker Nov 30 '18 at 17:56
  • That’s how i interpret the information. Your iCloud account and your backups would be untouched. – samh Dec 1 '18 at 2:47
3

In most cases, the answer is yes. The iOS device running iOS 10+ can be completely erased if a corporate exchange account resides on the device.

In the latest version of 2016 Exchange Server on-premises, by default, there are 2 versions of remote wipe that can take place. The first only removes the exchange account, and the second is a complete wipe; meaning complete wipe functions exactly like using the built in iOS settings, general, "erase all content and settings" function.

There is no prompt on the exchange admin end to enter any Apple ID password, nor passcode...

If you're allowing your personal iOS device to connect to your company's Exchange Services, please read the use agreement careful before you sign.

If you keep local backups in iTunes, you will be able to restore your iOS from a backup.

I just initiated a test of remote wipe as of this writing, so this info is timely.

| improve this answer | |
  • This doesn't actually seem to work with Office 365. Adding the Exchange account via Apple Mail and then triggering a remote wipe or a wipe of the account off the device itself does nothing. Seems like you may have to have the Outlook App on the iPhone installed for this to possibly work. – Steve Bauman Mar 28 '19 at 17:23
  • 1
    @SteveBauman I just wiped my entire phone via Mail.app and my companies Exchange server. No Outlook App needed. It even keeps wiping the device after a backup is installed, and will continue to do so until the device is removed from the Exchange Server. The Outlook App should be sand boxed and not able to read or write to any file outside of it's own directory on the phone, so it shouldn't be able to wipe the iPhone unless Apple granded Microsoft special permission to. – tww0003 May 1 '19 at 17:59
  • @tww003 That's using your companies on-premise Exchange server I'm assuming? Office 365 still doesn't work for me. – Steve Bauman May 1 '19 at 21:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .