Explained
8 Hexnode Alternatives That Fix the Pricing & Platform Gaps
Review 8 Hexnode alternatives that fix pricing issues and platform limitations. Expert comparison to help IT admins choose wisely.
Explained
What Is Mobile Device Management (MDM)?
What mobile device management (MDM) is, how it works on Apple, Android and Windows, what it can see on company and personal phones, and how to choose MDM.
- Written by
Atena LadchartabiContent writer, trio.so
- Published on
- Modified on
Mobile device management (MDM) is software that lets an organization enroll, configure, secure and support its phones, tablets and computers from one console. IT uses it to push settings and apps, require a passcode and encryption, see which devices are out of date, and lock or erase a lost device, without touching each one. Modern MDM covers laptops as well as phones. If you're looking for device management for your own fleet, see trio.so's mobile device management.
What MDM does
- Enrollment: brings devices under management, ideally automatically when a new device is first switched on.
- Configuration: Wi-Fi, VPN, email accounts, restrictions and security settings, pushed as profiles or policies.
- Apps: installs, updates and removes work apps, and can limit which apps run.
- Security: passcode rules, disk encryption, OS update requirements, and checks that show which devices don't comply.
- Inventory: a list of every device with its owner, model, OS version and installed apps.
- Remote actions: lock, wipe, restart or locate a device, and on computers run scripts or open a remote session.
How MDM works
MDM is built on management channels the operating system vendors provide. The MDM server doesn't break into the device; the device agrees to be managed and follows instructions from a server it trusts.
- Apple (iPhone, iPad, Mac): the device installs an MDM profile and then checks in with the server when Apple's push service tells it there is work to do. Devices bought by the company can enroll automatically through Apple Business (formerly Apple Business Manager) and be supervised, which allows more controls.
- Android: Android Enterprise gives two modes, fully managed for company-owned devices and a work profile for personal ones. Policies are applied through Google's management API and apps come from managed Google Play.
- Windows: Windows has a built-in MDM client. Devices enroll through a work or school account or automatic enrollment, and policies are delivered as configuration settings.
- Computers in general: many MDMs add an agent on Windows, macOS and Linux for things the OS channel doesn't cover, such as running scripts, a terminal, or installing software that isn't in an app store.
Commands are queued. If a device is offline, it gets the instruction the next time it connects.
MDM vs MAM vs UEM
| MDM | MAM | UEM | |
|---|---|---|---|
| Manages | The whole device | Work apps and their data | All endpoints from one console |
| Enrollment | Required | Not required | Required |
| Typical devices | Company phones and tablets, increasingly laptops | Personal phones (BYOD) | Phones, tablets, laptops, desktops, servers |
| Erase | Whole device or work data, by platform | Work data in managed apps | Whole device or work data, by platform |
The lines have blurred: most products sold as MDM today manage computers too, which is what UEM (unified endpoint management) means. MAM is covered in what is mobile application management.
What can an employer see with MDM?
It depends on who owns the device and how it was enrolled.
- Company-owned device: IT can see the device's details (model, serial number, OS version), its installed apps and its compliance state, and can lock or erase it.
- Personal device with a work profile or User Enrollment: IT manages only the work side: work apps, work accounts and their data. It cannot see personal apps, photos, messages or browsing, and cannot erase the whole device.
Mainstream MDM does not read personal messages or watch the screen. The details for iPhone are in iPhone work profile.
How to remove MDM from a device
- iPhone or iPad: Settings > General > VPN & Device Management, tap the profile and remove it. A device enrolled automatically by its organization may not allow this.
- Android: remove the work profile in Settings. A fully managed company device needs IT to release it, or a factory reset.
- Windows: Settings > Accounts > Access work or school, select the account and choose Disconnect.
- Mac: in System Settings, find the device management profile (under Privacy & Security or General, depending on the macOS version) and remove it, if the organization allows it.
On a company device, ask IT first. Removing management usually removes work apps, accounts and network access with it.
Do you need MDM?
Usually yes, once you have more devices than one person can set up and check by hand, or once a customer, insurer or regulation asks you to show that devices are encrypted, updated and can be wiped. Signs you've outgrown manual management:
- You can't say quickly which devices are missing updates or encryption.
- A lost laptop or phone means hoping it had a passcode.
- New hires wait for someone to set up their device.
- Staff leave and nobody is sure their access and data are gone from their devices.
How to choose an MDM
- Platforms: list what you actually have (Windows, macOS, iOS, Android, Linux) and check each is supported at the depth you need, not just enrollment.
- Enrollment: automatic enrollment through Apple Business, Android zero-touch or Windows Autopilot saves the most time.
- Personal devices: if staff use their own phones, check work profile and User Enrollment support.
- Remote support: scripts, terminal and remote desktop on computers cut site visits.
- Reporting: can you show encryption and update status per device, and export it?
- Pricing: per device or per user, minimum seat counts, and what each plan includes.
For a list of options, see Microsoft Intune alternatives.
Managing this across many devices
trio.so manages Windows, macOS, Linux, iOS and Android devices from one console, with remote operations (commands, terminal and remote desktop) and kiosk mode. Plans start at $5 per device. See trio.so mobile device management.
Related reading: what is mobile application management, iPhone work profile and how to whitelist an app on Android.
Manage every device from one console
trio.so manages Windows, macOS, Linux, iOS and Android devices from one console. Plans start at $5 per device.
Get Ahead of the Curve
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Don't let inefficiencies hold you back.
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Frequently Asked Questions (FAQ)
Have questions? We've got answers. This section covers some of the most commonly asked questions related to this topic.
Software that lets an organization enroll, configure, secure and support its phones, tablets and computers from one console.
The device enrolls with an MDM server it trusts, through Apple's, Google's or Microsoft's management channel, and then applies the settings, apps and commands the server sends.
On a company device: device details, installed apps and compliance, plus lock and erase. On a personal device with a work profile or User Enrollment: only work apps and their data.
MDM manages whole devices, MAM manages work apps and their data without enrollment, and UEM manages all endpoints, phones and computers, from one console.
Remove the management profile or work account in the device's settings. Company-owned devices may not allow it, so ask IT first.
Related
From the blog
The related industry news, interviews, technologies, and resources.
TemplatesHow to Write a Mobile Device Management Policy + TemplateA mobile device management policy sets the governance rules for device use, security, and enforcement, here is how to structure one that works.
ExplainedWhat Is IT Asset Management? Complete OverviewLearn IT asset management fundamentals including lifecycle management, tracking methods and best practices for managing hardware and software.
ExplainedHIPAA Technical Safeguards Explained for IT TeamsHIPAA technical safeguards are the 5 standards in 45 CFR 164.312. What each one requires, required vs addressable, and the device settings that meet it.
ExplainedHow to Detect Shadow AI in Your OrganizationShadow AI breaches average $4.63M. Here is how to detect shadow AI using DNS logs, OAuth audits, and your endpoint inventory, step by step.
ExplainedDeclarative Device Management: A Complete GuideDeclarative device management is Apple's answer to MDM polling delays and unreliable compliance data — here's how it works and how to start using it.
ExplainedAPNS Certificate: Setup, Renewal, and Best PracticesAn APNS certificate is what lets your MDM platform send commands to iPhones, iPads, and Macs — here's how to create, renew, and protect it.
ExplainedDevice Location History: Android, iPhone, and MDM GuideDevice location history works differently on Android, iPhone, and MDM platforms. Here's what each one actually stores and how to access it.