How can I use (parts of) a managed account without submitting my device to the Device Policy?

Question

My kid's school uses Chromebooks with Google Apps. All the kids in school have an account which they can use both in and out of school (Gmail, Drive, Calendar, Hangouts, and so on).

I wanted to let my kid log in to that account with his own Android phone (a Wiko Rainbow Jam), but I do not want to allow my kid's school to monitor his phone or erase all his data.
It's not that I'm really afraid they will erase his phone on purpose, but rather more as part of a general action, for instance as part of what they do when a kid leaves school or perhaps even wiping all of their devices at the start of a new school year.

I know it's possible to log in to Gmail through IMAP, but that's just for Gmail. I also found Removing a device from Android Device Manager for a specific account but that seems like a complicated solution, that again just works for Gmail.

I would like him to be able to use all aspects of his school account, without having to subject his phone to the school's device policy.

Is there a way to use his school's Google account on the phone, without allowing the school's device policy to administer his phone?

Alternatively, if I can get the school to do so,

Can the school set an exception to the policy for his device? Or rather, set the device policy so that it only applies to their devices?

---

This is, of course, not the primary account for his phone, that's something akin to [email protected].

Answer 1

He would have to use the web interface via a browser in order to access this account. Adding the account would make it subject to the administrative policy, and this they would be able to monitor and erase his device.

Now, the real question is why would they bother? I can tell you with a fair amount of certainty that no one is sitting there monitoring accounts with their fingers posed over the WIPE button, they don't have time or care and these features are generally never used unless the circumstances are fairly significant, bad enough for a school administrator to be willing to take the heat from a pi$$ed off parent and be able to justify their actions.

These feature are usually employed at the enterprise level, where a person leaves a position, to make sure the company's data is wiped from the device and they do not take it else where, or to be able to locate or clean the device should be it be misplaced/stolen. The ability to "monitor" the phone is somewhat over-rated, as they can't go in and read your text messages or see what calls your making to who, it simply means they can monitor data related to the account that has device administrator access. The problem is these are kind of all in one permissions, for your child to be able to access this account the ENTIRE permission applies.

The answer is although this is a possibility, the concern is likely unfounded. You should be able to allow your child to add his school account to his device with no issue, and when that account is no longer needed the administration rights can be removed and the account with it.

Answer 2

A cow-orker pointed me to the (paid) e-mail and calendar app Nine, which seems to be able to restrict any remote wipes to its data of that account.

So while there may be no way of adding an account without submitting to its device policy, this does solve my problem.

---

Disclaimer: I am not connected in any way to Nine or the company behind it, 9Folders Inc.

Answer 3

SPOILER: Its off by default

Provided you did not activate the account via the device policy app (just added it as a normal account) You'll be fine. Its the same situation here- the tech team leave notes to remind students to not activate device policy.