A privacy baseline is a verification routine rather than a universal default-settings list. For a managed account, the cited guidance says that an administrator may access and control associated data. It also says that available controls depend on whether the person is signed in, the plan, and workspace settings. Before an account is used for family, school, or work purposes, the person using it should establish whether the account is managed and who, if anyone, administers it.
The same questions should be asked in each context, but the answers can differ. A control seen in one context should not be assumed to be available in another.
How to check it
- Family use: Identify who is responsible for the account, whether an administrator is assigned, and which plan and workspace are active.
- School use: Identify the active workspace, if one is used, and whether an administrator is identified for it.
- Work use: Identify the account or workspace administrator, if one is assigned, and record the sign-in state, plan, and workspace.
Each check should be tied to the current context. A control available under one sign-in, plan, or workspace should not be treated as available under another. If the context changes, the check should be repeated.
What must still be confirmed
The points cited here do not state a universal default for retention, deletion, data use, or export, and they do not define the precise scope of administrator access. They also do not state that an available control is enabled by default. Those details require confirmation in the current account and workspace materials and, where applicable, with the administrator.
A working record should therefore include:
- whether the account is managed;
- the administrator’s identity, or that no administrator has been identified;
- the active sign-in state, plan, and workspace;
- the controls actually shown; and
- unresolved policy questions.
Until those points are confirmed, the account should be treated as potentially managed rather than assumed private. The baseline is a verification aid, not a guarantee of privacy.