By Chen Hao

Edited by Hou Yu

An internal memo released by Microsoft China indicates that starting from September, Chinese employees must use iPhones as their work phones. This news has been confirmed by multiple sources within Microsoft to Wall Street Tech Eye.

This measure is part of Microsoft's global Secure Future Initiative, aimed at ensuring employees can authenticate using Microsoft Authenticator and Identity Pass applications. The Android versions of these apps require downloads from Google Play and Google Mobile Services (GMS), both of which are unavailable in mainland China.

In contrast, Apple's App Store and APNS messaging services are available in China. Therefore, for Microsoft to integrate these apps into the workflow of its employees in mainland China, using iPhones becomes virtually the only option.

The memo states that all employees using Android phones can receive a 128GB iPhone 15 as their work phone. Interestingly, this policy also applies to employees in Hong Kong. Although Google Play is available there, Hong Kong employees are also eligible to receive company-issued iPhones.

Is Microsoft Banning Android Devices for Employees?

In response to reports of "Microsoft China banning employees from using Android phones at work," Microsoft has issued an official statement.

A Microsoft spokesperson said, "Microsoft Authenticator and Identity Pass apps are officially available on the Apple App Store and Google PlayStore. We want to provide employees with access to these necessary apps. Due to the unavailability of Google Mobile Services in this region, we offer alternatives such as iOS devices."

According to a Microsoft employee, many have already received iPhone 15s from the company, but only those who did not already have an iPhone. The employee also clarified that rumors of a "ban on Android devices" are exaggerated. Meanwhile, social media users claiming to be Microsoft employees have been posting pictures of their new iPhone 15s.

There are also rumors that these free iPhones do not need to be returned upon employee departure.

What is Microsoft's Secure Future Initiative?

Launched at the end of 2023, the Secure Future Initiative is an internal Microsoft program aimed at enhancing the security of its products and services through technological innovation, cultural change, and rigorous security governance. Its primary goals include reducing the likelihood of vulnerable code in Microsoft products and accelerating the speed of vulnerability remediation.

Additionally, Microsoft will introduce safer default settings for users and increase the use of the Microsoft Authentication Library, which can more effectively protect user login credentials.

Microsoft Authenticator, required by the company for employees, is a mobile application developed based on the Microsoft Authentication Library, primarily used for authentication and secure login. When users enable two-factor authentication (2FA) in their Microsoft account security settings and link Microsoft Authenticator, all subsequent login requests require approval through the app, significantly enhancing account security.

Identity Pass, similar to Microsoft Authenticator in function, is also an authentication app. However, unlike Microsoft Authenticator, which targets individual users, Identity Pass is an enterprise-level authentication tool used primarily in corporate settings. Its activation requires submitting identity documents and selfies, making the process more stringent.

Why Isn't Android the First Choice?

Android's freedom in installing apps allows users to download APK files at will, but only apps downloaded from the official Google Play Store can guarantee security. As authentication apps, both Microsoft Authenticator and Identity Pass must be downloaded from Google Play.

More importantly, the Android versions of these apps rely on Google GMS services to function.

Firstly, the push notification services of these apps depend on Google's FCM service. As mentioned earlier, when logging into personal/work accounts, users must approve the login request within the app; otherwise, it will be denied. If the app cannot receive push notifications, login approval becomes impossible.

Furthermore, Google GMS provides a series of security services and APIs that help apps detect the security status of devices, preventing them from running on compromised or unsafe devices. For authentication apps, these security services are crucial.

Considering that neither Google Play nor GMS are available in mainland China, Chinese employees using Android phones cannot officially access and use these apps. Therefore, it makes sense for Microsoft to provide iPhones to its employees to advance its Secure Future Initiative.