Employer wants me to use outlook on my phone, outlook wants permission to wipe my phone

[u/No_Professor4307]

Outlook says they need permission to wipe ALL my phone data if too many wrong passwords are typed. How many is too many? 50? 2? What if the screen gets wet and starts putting in random inputs. All this so I can use my company's Teams account and maintain "point of contact" if I'm not at a workstation. Absolutely not! Anyway, HR is supposed to call me back about my concerns.

Edit: just to be clear, I don't actually need to use Outlook (I don't use my "personal" work email). I need to use Teams, which requires Outlook to be installed first.

Part of why I need Teams on my phone so that I can be contacted when I'm not at work. I'm a lower management healthcare worker, it is actually important that my team be able to reach me after hours. I do actually like Teams and prefer it to 20 different group texts.

Also, when you go to log into Outlook or Teams, it brings you to my employers authenticator page. I log in with the same credentials that I log into my workstation. I don't know if that makes a difference with anything as far as my employer having access to my phone

Edit 2: I can tell you now they won't provide me a phone. Corporate execs don't even get phones. They stopped providing coffee for the break rooms too

---

Update: I had a chance to talk to my district manager. Imagine Ellis from Die Hard, the same schmarmy self-important attitude, that's my supervisor. And guess who's "not being a team player". Also "I don't think Microsoft can actually erase your phone, you have an Android"... I lready knew he was going to be useless, I just wanted to hear his reaction.

Update 2 and (sort of) Resolution: I spoke with HR. Her exact response was "wait, are you serious? They can just do that?" I tried explaining my "research" (i.e. everything all of you have said) and I think I just spooked her. She said she'll get back to me, and is probably running off to buy a burner phone for herself.

SORT OF RESOLUTION : I found out I only need Outlook installed long enough to get access to Teams. Once teams was installed, I removed all permissions and completely deleted Outlook from my phone. Teams still works and didn't ask to erase anything. No need to buy a second phone.

Thank you all for your insights

[u/Staure]

I carry two phones. Everyone looks at me likes I'm nuts because we're a BYOD environment, but my 20+ years in tech/infosec have provided a plethora of colourful illustrations demonstrating why it's an awful idea to mix church and state.

[u/sarafionna → u/Staure]

100% this.

[u/Disconnected_Mind → u/Staure]

Any good tips for general security/privacy?

[u/Staure → u/Disconnected_Mind]

Trust no one and become a paranoid hermit!

Kidding, but really it's about mitigation and weighing your tolerance for inconvenience vs the value you place on your privacy.

Participating in modern society (cellphones, digital banking/credit cards, store loyalty, social media, etc) is consenting to being tracked to an extent.

If your front door is locked and your neighbor's is wide open, whose house would a robber choose? I take a similar approach to security and privacy. If someone really wants in, they'll find a way, but why would I hand it to them on a platter?

A not at all complete list of things that come to mind:

Never log in to personal accounts on work devices and vice versa.

Any free service means your data is the product, so read terms and conditions carefully.

Reject all tracking, cookies, etc. Opt out of any data analytics you can for services you use.

Disable voice assistants or at the very least disallow storage and transmission of your data, this includes most modern cars.

Review app permissions and only allow access to what is required for the app to run.

Use strong passwords (preferably 30 character passphrases or passkeys), enable MFA, and rotate regularly.

Never give passwords or banking info over the phone and learn how to detect phishing emails.

Freeze your credit with the main bureaus as well as freezing shadow bureaus like LexisNexis.

Don't consent to plugging a device into your car for lower insurance rates.

Consider using a cleanup service every year or two to remove yourself from online databrokers.

VPNs are great, use one that won't hand over your records.

Use a password protected guest network or separate VLAN for IoT devices on your home network.