Can personal VPN help protecting my behavior on the company laptop?

Question

Update:

• I don't care if the company knows I'm using a private VPN (this is allowed and confirmed with the IT department). My only concern is if the company knows I visited nba.com (for example).
• On iOS, I think the only demon/background monitoring is the "device management"? So they can only inject the TLS certificates
• I'm not sure for the macOS if they pre-installed software to record the keystroke or the web requests before sending out via OpenVPN.
• I am free to uninstall and install any browser so the Chrome/Firefox is not modified or customized by the company.
• DNS might be another issue but I'm planning to set up a personal DNS server to handle that.
• From the company policy, we are allowed to watch games and even play PUBG/LOL/CSGO using the company laptop. So there is no policy concern.

Question:

I'm using the company laptop (MacBook Pro with macOS 10.13) and iPhone (iOS11). I am aware everything could be censored when I'm on the company WiFi. Due to the device management (at least on iOS) and HTTPS certificate pre-installation, I think the company can also know every web request even I'm using the laptop at home.

So I'm using the personal VPN software (openVPN) whenever I'm not working. (For sure I'm using the company VPN when working and accessing the codebase, which is not in the scope of this question) My assumption is my personal browsing behavior over personal VPN should be protected and not visible to the employer.

Do I need any other steps to hide my behavior?

Answer 1

Yes. You should use the device you own to privately do anything.

Apple Configurator 2, which is used to configure corporate owned Apple devices, is able to

ensure that the users’ web traffic stays within the organization’s guidelines.

It further notes that

These include the ability to enable a web filter via a global proxy to ensure that the users’ web traffic stays within the organization’s guidelines.

If a global proxy is set, OpenVPN will have no chance but to communicate through the proxy, telling (warning) the IT that you are trying to a)connect to a foreign network which can lead to a data breach b)mitigate their control by using OpenVPN.

They could not be able to read the contents, but company policies may get you fired for getting your device unprotected by connecting to a foreign network.

Update:

I don't care if the company knows I'm using a private VPN (this is allowed and confirmed with the IT department). My only concern is if the company knows I visited nba.com (for example).

They can't. But they can forbid deleting browsing history in a device, and require to hand them over.

On iOS, I think the only demon/background monitoring is the "device management"? So they can only inject the TLS certificates I'm not sure for the macOS if they pre-installed software to record the keystroke or the web requests before sending out via OpenVPN.

You can see what the MDM monitors in the MDM profile section in Settings.

I am free to uninstall and install any browser so the Chrome/Firefox is not modified or customized by the company. DNS might be another issue but I'm planning to set up a personal DNS server to handle that.

That's good. Although I am concerned about data breaches.

From the company policy, we are allowed to watch games and even play PUBG/LOL/CSGO using the company laptop. So there is no policy concern.

You need to check a)what liabilities you might take if a data breach happens because of you b)is there an official confirmation that allows personal VPNs