Default permissions are the ability erase everything. It actually requires work to remove those permissions.
Probably just your exchange admin doesnt have an incentive to change the settings.
Probably just your exchange admin doesnt have an incentive to change the settings.
No they aren't. You get no permissions by default. You have to do work to get any.
What's likely is Device Administration was added as a feature for exchange admins to remotely erase compromised/old/whatever phones.
This can never go wrong.