Most corp IT teams require employees to install a mobile device management profile, which enables you to then run teams, get email access etc. it’s also what gives your company privileges on your phone.

Some MDM profiles can have pretty nasty access enabled (e.g. route all IP traffic via Corp net, access device location at all times, remote wipe etc).

Take a look at what your MDM profile says if you have one installed.