BES admin here too, double security, we insist if they must put personal data on the device that they should also use the passwoor keeper app.
That password can not be reset via BES and if the device is lost or stolen we can still wipe it remotely including the data in the password keeper.
I love GOD mode!