It's a reasonable question with an unsatisfying honest answer: you often can't know with certainty whether a work-issued device is being monitored, or exactly how. What you can do is check for a handful of concrete, observable signals that make monitoring more or less likely, and adjust your behavior based on the realistic possibility rather than false certainty in either direction.
MDM profiles are the most visible signal
Mobile device management (MDM) software lets an employer enforce settings, remotely wipe a device, and in some configurations see basic device information. It's also one of the easiest things to check for directly: on iPhone or iPad, look under Settings → General → VPN & Device Management; on Android, Settings → Security → Device admin apps; on a Mac, System Settings → Privacy & Security → Profiles; on Windows, Settings → Accounts → Access work or school. If a management profile is listed, your employer has some level of administrative control over the device.
Always-on VPN changes what your traffic touches
A corporate VPN configured to connect automatically and stay connected — including outside of work hours — means your internet traffic can route through company network infrastructure even when you're not actively working. Check your VPN client or system network settings for an "always-on" or "connect automatically" toggle, and notice whether it's actually connected during personal time.
Browser extensions you didn't choose
IT departments sometimes push browser extensions automatically as part of a managed device policy. Chrome's extension list at chrome://extensions will flag ones "installed by enterprise policy" specifically — worth a look, since extension permissions can range from harmless to quite broad.
Endpoint monitoring, described carefully
Endpoint detection and response (EDR) or general security monitoring agents are common on corporate devices, primarily for security purposes, though depending on configuration they can also log more general activity. Rather than naming specific products — which change constantly and would risk being wrong or outdated — the practical approach is to check your running processes (Task Manager on Windows, Activity Monitor on Mac) and installed applications list for background software you don't recognize.
The most reliable source: written policy
Technical detective work has real limits. Your company's employee handbook or IT acceptable-use policy, if one exists and is disclosed to you, is the most authoritative source for what's actually monitored — check there first, and ask HR or IT directly if you can't find a clear answer.
The guidance that matters regardless of your findings
Whatever your checklist turns up, the safest working assumption for any work-issued device is that it may be monitored in ways you can't fully verify, and that this can change without an obvious notice to you. The practical response isn't paranoia — it's a simple habit: use a personal device on your own network for personal email, banking, job searching, and private messages, and treat anything you do on a work device as potentially visible to your employer.
Frequently Asked Questions
Yes — Work Device Monitoring Awareness Checklist walks through 5 realistic signals with how-to-check instructions and a monitoring likelihood score. It's a one-time $4.99 purchase — no subscription, no account required.
No. It's an educational checklist, not a scanning tool — it can't access your file system or processes directly. It guides you through checking specific settings and locations yourself.
Real-world monitoring and EDR products change constantly — new vendors, renamed products, shifting deployments. Naming specific tools as fact risks being wrong or outdated, so the checklist describes durable, generic ways to check for each signal instead.
Treat the device as actively monitored: avoid personal accounts, banking, and private messaging on it, and use a personal device on your own network for anything you wouldn't want visible to your employer.
Yes. Your selections are saved locally in your browser's storage only — nothing is transmitted to any server, which matters especially for a tool about monitoring awareness.