What Is Mobile Device Management (MDM)?

Mobile device management (MDM) is software that lets an organization enroll, configure, secure and support its phones, tablets and computers from one console. IT uses it to push settings and apps, require a passcode and encryption, see which devices are out of date, and lock or erase a lost device, without touching each one. Modern MDM covers laptops as well as phones. If you're looking for device management for your own fleet, see trio.so's mobile device management.

What MDM does

• Enrollment: brings devices under management, ideally automatically when a new device is first switched on.
• Configuration: Wi-Fi, VPN, email accounts, restrictions and security settings, pushed as profiles or policies.
• Apps: installs, updates and removes work apps, and can limit which apps run.
• Security: passcode rules, disk encryption, OS update requirements, and checks that show which devices don't comply.
• Inventory: a list of every device with its owner, model, OS version and installed apps.
• Remote actions: lock, wipe, restart or locate a device, and on computers run scripts or open a remote session.

How MDM works

MDM is built on management channels the operating system vendors provide. The MDM server doesn't break into the device; the device agrees to be managed and follows instructions from a server it trusts.

• Apple (iPhone, iPad, Mac): the device installs an MDM profile and then checks in with the server when Apple's push service tells it there is work to do. Devices bought by the company can enroll automatically through Apple Business (formerly Apple Business Manager) and be supervised, which allows more controls.
• Android: Android Enterprise gives two modes, fully managed for company-owned devices and a work profile for personal ones. Policies are applied through Google's management API and apps come from managed Google Play.
• Windows: Windows has a built-in MDM client. Devices enroll through a work or school account or automatic enrollment, and policies are delivered as configuration settings.
• Computers in general: many MDMs add an agent on Windows, macOS and Linux for things the OS channel doesn't cover, such as running scripts, a terminal, or installing software that isn't in an app store.

Commands are queued. If a device is offline, it gets the instruction the next time it connects.

MDM vs MAM vs UEM

The lines have blurred: most products sold as MDM today manage computers too, which is what UEM (unified endpoint management) means. MAM is covered in what is mobile application management.

What can an employer see with MDM?

It depends on who owns the device and how it was enrolled.

• Company-owned device: IT can see the device's details (model, serial number, OS version), its installed apps and its compliance state, and can lock or erase it.
• Personal device with a work profile or User Enrollment: IT manages only the work side: work apps, work accounts and their data. It cannot see personal apps, photos, messages or browsing, and cannot erase the whole device.

Mainstream MDM does not read personal messages or watch the screen. The details for iPhone are in iPhone work profile.

How to remove MDM from a device

• iPhone or iPad: Settings > General > VPN & Device Management, tap the profile and remove it. A device enrolled automatically by its organization may not allow this.
• Android: remove the work profile in Settings. A fully managed company device needs IT to release it, or a factory reset.
• Windows: Settings > Accounts > Access work or school, select the account and choose Disconnect.
• Mac: in System Settings, find the device management profile (under Privacy & Security or General, depending on the macOS version) and remove it, if the organization allows it.

On a company device, ask IT first. Removing management usually removes work apps, accounts and network access with it.

Do you need MDM?

Usually yes, once you have more devices than one person can set up and check by hand, or once a customer, insurer or regulation asks you to show that devices are encrypted, updated and can be wiped. Signs you've outgrown manual management:

• You can't say quickly which devices are missing updates or encryption.
• A lost laptop or phone means hoping it had a passcode.
• New hires wait for someone to set up their device.
• Staff leave and nobody is sure their access and data are gone from their devices.

How to choose an MDM

1. Platforms: list what you actually have (Windows, macOS, iOS, Android, Linux) and check each is supported at the depth you need, not just enrollment.
2. Enrollment: automatic enrollment through Apple Business, Android zero-touch or Windows Autopilot saves the most time.
3. Personal devices: if staff use their own phones, check work profile and User Enrollment support.
4. Remote support: scripts, terminal and remote desktop on computers cut site visits.
5. Reporting: can you show encryption and update status per device, and export it?
6. Pricing: per device or per user, minimum seat counts, and what each plan includes.

For a list of options, see Microsoft Intune alternatives.

Managing this across many devices

trio.so manages Windows, macOS, Linux, iOS and Android devices from one console, with remote operations (commands, terminal and remote desktop) and kiosk mode. Plans start at $5 per device. See trio.so mobile device management.

Related reading: what is mobile application management, iPhone work profile and how to whitelist an app on Android.