We already have MDM for our regular mobile fleet, but are considering extra protection for a small group of executives and other sensitive users. This is more about protecting mobile communications than storing classified data on phones.
Would GrapheneOS offer enough beyond a locked-down iPhone or managed Android device to justify the support effort? I'm especially interested in app compatibility, Workspace ONE, VPNs, certificates, and compliance policies.
Start with the threat, not the operating system. Who might target these users, what communications need protection, and what would a hardened phone prevent that your current controls would not?
Also look beyond the phone. If sensitive documents can be downloaded to unmanaged devices, a special handset may address only a small part of the risk. Reduce what needs to be accessible on mobile and get leadership to decide which risks and restrictions are acceptable.
A tightly managed, up-to-date iPhone is a reasonable baseline to test before adding another platform. Depending on the threat and usability requirements, look at Lockdown Mode and Advanced Data Protection for iCloud, along with your usual restrictions and identity controls.
Those features do different things, so check which ones address your actual risks and what they change for users. Disabling functions such as Bluetooth or SMS might be appropriate for some users, but that comes with practical tradeoffs.
GrapheneOS may be worth a small compatibility pilot, but don't assume it will behave like your standard managed Android build. MDM and work apps may run into issues involving sandboxed Google Play services, and that can be a deal breaker for users who rely on things like Outlook and Teams.
Test your actual Workspace ONE enrollment, compliance checks, VPN, certificate delivery, and required apps on a supported device. Include updates, device replacement, troubleshooting, and what happens when a compliance check fails. The integration questions are specific enough that a general security comparison won't answer them.
6d+buttonkite_819:
I'd include the users' normal communication workflows in that pilot too. A device that passes enrollment but breaks a required app isn't a workable deployment.
For only tens of devices, supportability can outweigh a theoretical improvement. Compare the extra training, setup, updates, and replacement work against what you can already enforce with iOS or Android Enterprise and your MDM.
There are also specialized hardened phones worth considering, but evaluate them against the same app, management, and support requirements rather than assuming a dedicated product solves those problems.
Answers are reviewed before publication.
9k+velvetspool_361:
That is the question we're trying to answer. It may be that our existing managed devices are sufficient once we define the actual risks.