Mobile device management (MDM) is a way for an organization to administer enrolled phones, tablets, computers, and other devices through management software and the device’s operating-system capabilities. It can deliver settings and apps, check whether devices follow policy, and—where the platform and enrollment allow—lock or erase a device.
What MDM does—and what it is
MDM is an administration approach, usually provided through a third-party service. The service does not replace the device’s operating system: it uses that platform’s management framework to send supported settings and commands to enrolled devices. The exact controls differ by operating system, version, device, service, and enrollment method. NIST’s definition of MDM describes administration of devices including smartphones, tablets, laptops, and desktops.
As an Amazon Associate I earn from qualifying purchases.
Organizations use MDM to configure devices consistently, distribute or manage apps, apply security requirements, and check compliance. It is a way to put policy into practice, not a guarantee that devices or an organization are secure.
How MDM works
- Choose a management service and enrollment method. The organization selects an MDM service and decides whether devices will be personally owned, organization-owned, or set up for a specialized purpose.
- Enroll the device or user. Enrollment establishes a management relationship between the device and the service. The method determines the scope of management and may require user action or support automated deployment.
- Deliver configuration and apps. The service sends supported policies, settings, and app-management instructions through the device platform’s management framework.
- Check compliance and respond. The service can receive compliance information and, if supported and authorized, issue actions such as locking or erasing a device.
For Apple devices, Apple says the MDM service uses Apple Push Notification service (APNs) to wake a device, which then makes a direct, secure connection to the management service. APNs itself does not carry confidential or proprietary information. See Apple’s device-management security overview.
#1 Best Overall
Personal devices and company-owned devices
Ownership and enrollment method matter because they shape both administrator control and the boundary between work and personal use. The labels below describe common approaches, not a promise that every MDM service or device behaves identically.
| Approach | Typical use | Management and data boundary |
|---|---|---|
| BYOD work profile or user enrollment | An employee uses a personal device for work. | Designed to separate work from personal activity. On Android, administrators manage the work profile and can remove that profile from a personally owned device without affecting personal data. Apple User Enrollment is an option for BYOD. The exact information administrators can see and actions they can take depend on the platform and configuration. |
| Fully managed or supervised enrollment | An organization owns and deploys the device. | Allows broader organization-level administration than a work-only profile or user enrollment. On Apple devices, supervision generally indicates organizational ownership and enables additional restrictions. |
| Dedicated-device deployment | A device is assigned to a single purpose, such as a kiosk. | Android Enterprise supports dedicated-device deployments. Available policies and controls depend on the device, platform, and management service. |
Apple documents its enrollment approaches and management capabilities in its Device Management documentation. Android explains work-profile separation in its Android work profile guide and describes management options in its mobile device management solutions overview.
What an employer may be able to see or control
There is no universal answer based only on the word “MDM.” Visibility and control depend on the operating system, whether the device is personally or organization owned, the enrollment method, the policies configured, and what the service supports. Work-profile and user-enrollment approaches are intended to separate work from personal activity, but that does not establish an identical privacy boundary across every setup.
Before enrolling a personal device, ask the organization to explain what information it collects, what administrators can inspect, which settings they can enforce, and what can be removed or erased during offboarding. In particular, clarify whether removal can be limited to the work profile or work data. For an organization-owned device, ask which controls are enabled and whether the device is supervised or fully managed.
Rank #3
NIST’s mobile-security guidance covers both organization-provided and personally owned devices. Its mobile threat catalogue entry for enterprise mobility management identifies unauthorized enrollment and privacy breaches by administrators as risks. Clear user communication, limited administrator privileges, and documented enrollment and offboarding procedures are therefore important alongside technical controls.
Apple and Android examples
Apple devices
Apple’s management framework supports configuration, software updates, compliance checks, app distribution, and device lock or erase actions, subject to enrollment and platform capabilities. For organization-owned devices, Automated Device Enrollment can help with initial deployment; supervision enables additional restrictions. Apple advises organizations to select their MDM solution before deploying devices because changing solutions may require erasing and reenrolling them. See Apple’s guide to choosing an MDM solution and its Device Management documentation.
Android devices
Android Enterprise supports work profiles, fully managed company-owned devices, and dedicated devices for single-purpose deployments such as kiosks. Zero-touch enrollment can support remote deployment and configuration on compatible devices; availability may vary by device, country, and reseller. Android Enterprise’s management overview reports more than 150 EMM partners. That is Android Enterprise’s own partner-ecosystem count, not an independently audited measure of market size or a recommendation of any particular provider. See Android Enterprise’s management overview and Android Enterprise enrollment information.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat to evaluate when choosing an MDM service
Organizations should match the service to their devices, users, privacy requirements, and operating model. Compare:
Best Value
- Platform coverage: supported operating systems, versions, device models, and management capabilities.
- Enrollment choices: whether it supports BYOD work profiles or user enrollment, fully managed deployments, and automated setup where needed.
- Privacy boundaries: what administrators can inspect, what data is separated, and whether work data can be removed without erasing personal content.
- Administration and security: how administrator access is limited, how compliance is checked, and how enrollment and offboarding are governed.
- Hosting and operations: Apple notes that MDM services may be hosted locally or in the cloud. Assess the operational requirements and pricing for the organization’s needs.
MDM is most useful when the organization understands the platform-specific controls it is deploying and communicates those controls clearly to users. It helps administer devices at scale, but it does not replace sound security practices or responsible handling of administrator privileges.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
