Well, if people are using un-approved personal devices on the corporate network, it seems there is some fault on both sides. Assuming there is policy addressing this issue.

Sure, but you send out an Email warning people first. There's no reason to wipe people's devices unless they are willfully defying policy, and even then, you've got a list of the people doing it - just go to their office and talk to them in person (involve their manager if needed).

Wiping a personal device to "send a message" is passive-aggressive and totally destructive to morale.

They typed "AGREE" to the policy on day one when they were hired. IT is 2000 miles away. No one from IT is going to visit their office. They are going to wipe the device per corporate policy.

They have the right to do that, perhaps, but it's still not very nice.

People don't do good work when their employer is mean to them, regardless of what they signed. What is your "destroying potentially confidential data" is their "leaving to improve your competitor's product while you spend nine months trying to find a replacement".

Balance is the key.

It's also quite likely completely illegal - warning or not.

It's a personal device - the company has no rights to it.

Then it has no business being borged into the corporate IT system of a company which demands rigorous enough control of data to use remote device wipe.

You handed the company rights to it when you added it to the Exchange domain.

The only issue at hand is whether a phone should be more explicit in telling you doing this will hand IT complete control of the device.

Their "approval" is insufficient. If they want me to carry a device with data which they have the power to destroy, it's not really mine, so they are going to have to buy one for me. Remote wipe is the kind of thing you could be prosecuted for … if you weren't doing it to a private citizen.

No, not really. If using an un-approved device on the company exchange compromises corporate security, you need to either lecture me, take "disciplinary action", or both. Nuking my iPhone from orbit is neither.

You leave your phone in a bar. You tell your IT team about it the next day. You're holding out hope that it'll get turned in. Meanwhile, god only knows what's on it and who's got it. Sure, you're fired and all, but meanwhile: you handed a bunch of sensitive data out to the world, and firing you doesn't solve that problem.

Should you be told that this is the policy? Of course. But what's the rest of the complaint here?

I don't have a problem with them wiping my phone if I leave it in a bar, that's what the feature is for.

I have a problem with them, having on their screen a message saying "User X connected an unapproved device to Exchange", choosing to clicking "wipe", knowing they might destroy my personal stuff, instead of writing an e-mail telling me to get off the Exchange within 24 hours, and don't ever do it again, or face a remote wipe.

Yeah, in this case you need to ban the devices, not wipe them...

There could be important data still on the device itself, I imagine the argument would be.

Seems to me how it should work is that the device's user defines a PIN number for his device. Should the device be lost, the user could provide the IT guys with that PIN number, which would be required for the "remote nuke" feature to be used.

That assumes the user is a willing participant in that matter and will give over the PIN.

Suppose the user is a remote employee who's just been sacked -- the boss and IT are hundreds of miles away and can't just take the phone from him. That phone has some product-related emails on it that, if they were to get out, would tank the company's stock price. They have to be able to wipe that data without waiting for the user to hand over the key.