As I looked more, its called Activate Device Administrator or Exchange Device Administrator
ITs on newer Exchange servers and if they've enabled it, you've got to accept it. I know I had tried denying and never got connect. I hit accept, and I get email. simple as that.
I would say, that I'd never allow my IT folks to touch my phone. Its a "give me the settings and I'll do it myself." kinda thing.