6 Accounts, Security, and Device Management

Accounts and access

An account identifies a user or service and determines what it can access. Devices may use local accounts, cloud accounts, or work or school accounts connected to organizational services. These account types are related but not identical: adding a work account to an app does not always enroll the entire device in organizational management.

Apply least privilege by giving each account only the access it needs. On Windows, an administrator can change system settings and install software, while a standard user is better suited to everyday work. Keep the number of administrator accounts small, use a standard account for routine tasks where practical, and use separate user accounts to keep people’s files and settings distinct.

Application permissions

Applications have their own permissions, which can include access to the camera, microphone, location, contacts, or files. Grant only the access needed for an app’s purpose, and review permissions periodically. For example, a video-calling app may need camera and microphone access during calls; a simple calculator usually does not. On Android, the Privacy Dashboard can help show which apps accessed certain permissions and when.

Locks and authentication

A screen lock helps prevent someone with physical access to a device from opening it. Configure a PIN, password, or another lock method supported by the device, and avoid easily guessed codes. Biometrics such as a fingerprint or face scan can make unlocking convenient, but retain a strong passcode or password as the fallback. Set the device to lock automatically after a reasonable period of inactivity, and require authentication when it is unlocked.

A device lock and an account password serve different purposes: the lock protects access to the device, while account authentication protects access to online services. Use unique passwords and multifactor authentication for important accounts, and do not share credentials. For managed devices, follow the organization’s required lock settings.

Encryption and recovery

Encryption transforms stored information so it cannot be readily understood without the appropriate key. Device or drive encryption helps protect data if a laptop or phone is lost, stolen, or its storage is removed. Examples include BitLocker on supported Windows devices and FileVault on Mac computers. Mobile operating systems also provide built-in data-protection features, but their exact behavior depends on the device and its configuration.

Encryption does not replace a screen lock, account security, or backups. A device that is already unlocked may expose accessible data, and losing the recovery key or credential can make encrypted data inaccessible. Before enabling or enforcing encryption, verify that it is active and that required recovery information is stored in the approved, secure location. Do not keep the only recovery key on the device it unlocks.

Device management and policies

Organizations use mobile device management (MDM) and related services to configure devices and check whether they meet security requirements. After enrollment, administrators may be able to apply settings, install or manage work apps, deploy Wi-Fi or VPN configurations, require encryption and a screen lock, enforce update requirements, and restrict access to organizational resources. Depending on the enrollment method, ownership, and platform, administrators may also be able to lock or erase a device or remove managed work data.

A configuration policy sets or restricts device behavior; a compliance policy checks whether required conditions are met. A policy might require a supported operating-system version, a screen lock, and encryption. If a device fails a requirement, the organization may notify the user, block access to work services, or take another action defined by policy.

Managed Android Work Profiles can separate work apps and data from personal apps and data. The scope of management depends on how the device is enrolled. Before enrolling a personally owned device, read the organization’s notice or policy. Understand what data and settings are managed, what the administrator can do, and whether a remote action affects only work data or the entire device. Use only profiles and enrollment instructions provided by a trusted organization.

Practical device configuration

Use this sequence when setting up or reviewing a device:

1. Confirm that the correct personal or work account is being used, and remove accounts that are no longer needed.

2. Use a standard, non-administrator account for routine work when possible; limit who can administer the device.

3. Set a strong screen lock and automatic-lock timeout. Review app permissions and revoke unnecessary access.

4. Confirm that device encryption is enabled and recovery information is safely stored.

5. Install operating-system and application updates, then check whether the device is enrolled and compliant with any required management policies.

6. Know how to report a lost device and how the organization’s lock, data-removal, and recovery procedures work.

How the protections fit together

Accounts identify users, while permissions control what users and apps can do. Least privilege, a strong screen lock, and encryption help protect a device and its data. Device-management policies can configure security settings and restrict access when a device is not compliant. Understand the scope of management and protect encryption recovery information.