How can my employer change my Andriod security settings?

Question

I got the following email from my employer:

Passwords required on all mobile devices

In order to protect College data stored on portable devices, from Tuesday 20 November ICT will enable a feature which requires all mobile devices (Android, iOS phones and tablets) used to access College emails to be protected with either a PIN password or biometric recognition, such as fingerprint or face recognition. This applies to all portable devices, whether College or personally owned.

At a minimum, ICT will enforce the use of a PIN for access to the device. Devices that do not meet the minimum requirement will be prevented from accessing College email accounts until the device has been appropriately secured.

You can manage your security settings from the ‘settings’ menu of your device. Please get in touch with the Service Desk if you have problems doing this. If you do not wish to secure your device, then you may not be able to access your College email account from your

Is there a feature in Android that I don't know about that will enable them to change the settings on my phone?

EDIT The Plot Thickens

On my way to work this morning popped up on my phone screen when I tried to check my meetings for the day.

Now I am worried. I don't want to give my work admin access to my personal phone. What will they be able to do? Delete my emails? Reset the phone? Lock me out of the phone? Track my location?

I can see how this is fine on devices supplied by an employer but it normal for personal devices.

Answer 1

Your employer is informing you of the security you need to implement on your device to access company mails / apps etc. This is a standard practice to endure that company confidential information is not compromised owing to your not having secure lock screen etc. They are not changing it for you. They are asking you to change it. Going by the screenshot, it's simple - agree to implement yourself those measures or not access college mails etc.

But, there are variations like BYOD / Company owned device etc, which can exercise far more control on your device. See here for details.

Edit:

From discussion on comments added a very useful input from Izzy. The app which you are installing to read the mail should not have device manager permission as only such apps can do a factory reset (aka Google Device Manager on case of stolen devices)

Answer 2

If your employer has installed a management app, then they can do a lot of things. There are many MDM (Mobile Device Management) products for all the platforms. (iOS, Android, Windows, Blackberry, etc). .

If your email is done via ActiveSync, that protocol allows the mail client to manage device settings (With permissions, but with the permissions, it can do it) and to lock down security.

(MS Exchange, Office365, and GroupWise can all use ActiveSync for email, instead of IMAP/POP).