Interviewing on Your Work Laptop: What IT Can See

Taking a job interview on your current employer's laptop is a different risk than most candidates assume. Your employer almost certainly cannot read the contents of your interview. It can, however, see that an unfamiliar application appeared in the device inventory, that a managed browser profile is signed in, and — in many configurations — that a specific URL tripped a data-protection rule. This article separates what device management documentation says is visible from what candidates worry about, using first-party Microsoft and Google documentation current as of October 2026.

The short version: the risk on a managed machine is not a recording of your interview. It is metadata — installed software, policy events, calendar availability, and network traces — and metadata is enough to prompt a question you would rather not answer.

What a managed Windows laptop reports by default

Microsoft publishes a candidate-friendly list of what an organization can and cannot see on a device enrolled in Intune. On that list, the organization cannot see "calling and web browsing history," "email and text messages," contacts, calendar, passwords, pictures, or "content of user-created documents" (Microsoft Learn, device enrollment data visibility).

That exclusion list is narrower than it sounds, because the same document states that on a corporate-owned Windows device the organization can query "hardware and operating system environment information," "file paths and file names," "registry and event log entries," and "details about running processes." A work laptop issued by your employer is a corporate-owned device. The distinction that protects a personal phone enrolled under BYOD does not apply to it.

The most reliable trace is software inventory. Microsoft documents that for corporate-owned devices, Intune's Discovered apps feature "collects all apps installed on the device, whether managed or unmanaged," and that Win32 applications — anything that appears in Add/Remove Programs — refresh "every 24 hours from device enrollment," with modern apps refreshing every seven days (Microsoft Learn, Discovered apps). The exported report lists application name, version, publisher, and device count.

Read that in practical terms: if you install any desktop application on a managed Windows laptop, its name and publisher are likely to appear in an administrator-facing inventory report within a day. Nobody has to be watching you specifically. The inventory exists whether or not anyone looks.

For the mirror-image question on Apple hardware — which permissions a given application holds and how to check them yourself — see the macOS interview app permissions audit.

What a managed browser reports

Managed Chrome is where candidate assumptions most often go wrong, in both directions.

Google's documentation for managed browser details lists what an administrator sees in the Admin console: machine name, browser version, number of installed extensions, the installed apps and extensions themselves with status and version, policy configuration, and the "email address of the person signed in to the profile" (Chrome Enterprise Help, view Chrome browser details). Browsing history is not part of that inventory view.

Separately, Chrome log events can surface URLs, but only through defined triggers rather than a continuous history feed. Google documents an "unsafe site visit" event for deceptive or malicious URLs, a "suspicious URL events" type for URLs assessed as "medium risk or higher" on Chrome 138 and later, and a "URL filtering" event that fires when "the user tried to access a URL that matched a Data Protection rule set by the admin" — the last of which "requires Chrome Enterprise Premium" and Chrome 113 or later (Google Workspace Admin, Chrome log events). Reporting connectors must be configured for any of these to be collected.

So the accurate statement is conditional. In a baseline Chrome Enterprise Core deployment, your employer is not receiving a list of every site you visited. In a tenant running Chrome Enterprise Premium with data-protection rules, a URL that matches a rule generates a logged event with the URL attached. You generally cannot tell from the browser which of those two worlds you are in, which is the reason to treat the managed profile as unsuitable for a job search rather than to calculate the odds.

One trace is unambiguous: signing a personal Google account into a managed Chrome profile attaches that address to a record an administrator can read.

Windows Recall on a Copilot+ work PC

Recall snapshots screen content on Copilot+ PCs, which makes it the obvious candidate for "my laptop recorded my interview." Microsoft's management documentation contradicts the strongest version of that fear and confirms a weaker one.

On the fear: Microsoft states that Recall snapshots are "locally stored and locally analyzed on your PC," that "IT admins can't access or view the snapshots on end-user devices," and that "Microsoft can't access or view the snapshots." Snapshots are encrypted with keys protected by the TPM and require Windows Hello authentication to open (Microsoft Learn, manage Recall).

On the controls: the same documentation states that "by default, Recall is disabled and removed on managed devices," and that where the Allow Recall to be enabled policy is disabled, users "won't be able to enable it on their managed device." Administrators can also set an app deny list and a URI deny list for snapshots, and connect Recall to a data-loss-prevention provider. Recall automatically filters private browsing in supported browsers, DRM-protected content, and remote desktop sessions including mstsc.exe, VMConnect.exe, and Azure Virtual Desktop.

That remote desktop exclusion is worth noting alongside the separate question of whether an assessment platform can tell you are on a remote desktop session in the first place.

What remains, if Recall is enabled on your work machine and you consented to snapshots, is a local, searchable index of your interview on hardware your employer owns and can reclaim at any time. Administrators cannot read it remotely. That is not the same as the record not existing.

The traces that have nothing to do with endpoint software

Most candidates who get caught are not caught by an inventory report.

Calendar availability. Microsoft documents AvailabilityOnly as a calendar permission meaning "view only availability data," with LimitedDetails extending that to "availability data with subject and location" (Microsoft Learn, Set-MailboxFolderPermission). The level applied to the Default user varies by tenant. In many organizations, colleagues can see that you are busy from 2:00 to 3:00 on a Thursday, repeatedly, for three weeks. Check your own calendar permissions rather than assuming.

Network path. Interview traffic routed through a corporate VPN or corporate DNS resolver passes through infrastructure your employer operates and logs. Joining from the office network has the same property.

The address you gave the recruiter. A calendar invite or interview link sent to your work email lands in a mailbox your employer administers and can place on legal hold.

The screen you share. If you share a window from the work laptop during a technical round, the prospective employer sees whatever is adjacent to it — notifications, tab titles, a corporate wallpaper, a VPN badge. That is a disclosure in the other direction, and it is covered in more depth in what interviewers can see during screen sharing.

What the law requires your employer to tell you

In the United States, monitoring on an employer-owned device is broadly lawful, and some states add a notice requirement rather than a prohibition. New York Civil Rights Law § 52-c requires employers to give prior written notice upon hiring that "any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage ... may be subject to monitoring at any and all times," to obtain written acknowledgment, and to post the notice conspicuously. Penalties run to $500 for a first offense, $1,000 for a second, and $3,000 for subsequent offenses, enforced by the state Attorney General (NY Civil Rights Law § 52-c).

Notice statutes like this are useful to candidates for a reason their drafters did not intend: the acknowledgment you signed on your first day is often the clearest available description of what your employer monitors. Read it before you reason about risk. Rules vary by state and country, and this is not legal advice.

What this means if you use interview tooling

This is the part where a product claim would be easy and wrong, so here is the candid version.

Any desktop interview assistant — Control included — is an installed application. On a corporate-owned Windows laptop enrolled in Intune, Microsoft's own documentation says Win32 installations are inventoried and refreshed roughly every 24 hours. A desktop tool that stays out of a screen-share capture does not stay out of a software inventory report, because those are different mechanisms operating at different layers. Screen-share behavior is about what a capture API returns. Inventory is about what the operating system reports to a management agent. One says nothing about the other.

Control is a desktop-native assistant for Windows and macOS, and its overlay is built to stay out of screen-share capture; as of October 2026 the site lists a free allowance of 5 messages and 2 minutes of voice, a $12 day pass, a $19 sprint pass, and a $39 monthly plan. None of that changes the inventory question above. The honest recommendation is the boring one: run interview tooling on a personal machine.

If you want the adjacent question — what the interviewing company's assessment page can observe about applications running on your machine — that is a separate detection surface, covered in what interview websites can see about running apps.

The practical conclusion

Use a personal device and a personal account for interviews. Not because your employer is reading your screen, but because the cheap, boring signals — an unfamiliar app in an inventory report, a recurring busy block, a calendar invite in a mailbox under legal hold — are the ones that actually surface, and none of them require anyone to target you.

If a personal machine genuinely is not available for a given round, reduce the trace surface rather than trying to outwit it: use a personal email address and a personal phone for scheduling, join from a personal network, share a single application window rather than a full screen, and install nothing. Then check your own calendar permissions and your signed monitoring acknowledgment, which will tell you more about your actual exposure than any general article can.

If you are evaluating desktop interview tooling for use on hardware you own, Control's technical explanation of how its capture behavior works is the more useful starting point than a feature list.