Mobile device management (MDM) is software that lets IT manage and secure phones and tablets, and in many products laptops too, from a central console. Once a device is enrolled, IT can apply settings such as passcodes and encryption, install and configure work apps, keep the operating system updated, check that the device meets security requirements, and lock or wipe it remotely if it is lost or the employee leaves. The term also names the management frameworks built into Apple, Google and Microsoft operating systems, which MDM products use to control devices.
At a glance
- MDM enrolls devices and then pushes settings, apps, restrictions and updates to them from a central console.
- It can lock or wipe lost and stolen devices remotely, or remove only company data where the device is managed through a work profile.
- Company-owned devices are usually fully managed; personal devices are usually managed more lightly, or through app-level protection instead.
- MDM grew into unified endpoint management (UEM), and many products now manage laptops as well as mobile devices.
- Device compliance data from MDM often feeds sign-in decisions, so non-compliant devices can be blocked from company apps.
What problem it solves
Phones, tablets and laptops carry company email, files and app access everywhere. Without management, IT can’t tell which devices hold company data, whether they are encrypted or locked with a passcode, or whether they run software with known security holes. When a device is lost or an employee leaves, there is no reliable way to remove the data. Setting up each new device by hand also takes time and produces inconsistent results.
MDM gives IT a central record of devices and the ability to configure and protect them consistently. New devices can be set up automatically when the user first signs in, security settings are enforced rather than requested, and lost devices can be locked or wiped. It also provides evidence, such as encryption status and update levels, that auditors, customers and cyber insurers ask for.
How it works
Enrollment. A device is registered with the MDM service. Company-owned devices can be enrolled automatically through the manufacturer’s or carrier’s enrollment programs, so they arrive configured, as described in imaging and zero-touch deployment. Personal devices are typically enrolled by the user, often with a work profile or user enrollment that separates work from personal data.
Configuration and policy. IT defines profiles and policies, such as passcode rules, encryption, Wi-Fi and VPN settings, email accounts, app restrictions and update deadlines, and the service pushes them to devices through the operating system’s management framework.
Apps. Work apps are installed and configured remotely, often alongside mobile application management (MAM) policies that protect data inside those apps.
Compliance and access. The MDM checks whether each device meets requirements and reports its device posture. Identity systems can use that status through conditional access to allow or block sign-ins.
Remote actions. IT can locate a device where permitted, lock it, reset the passcode, or wipe it fully or selectively. Some organizations add mobile threat defense (MTD) to detect malicious apps, networks and phishing on mobile devices.
When it matters for buyers
- When issuing company phones or tablets. Zero-touch enrollment and full management are the usual approach for company-owned devices, including COPE models.
- When allowing personal devices. A BYOD program needs a decision on enrollment versus app-level protection, and a clear privacy policy.
- When an audit, customer or insurer asks about endpoints. MDM reports on encryption, passcodes and update status are common evidence.
- When choosing between included and standalone tools. Device management bundled with your productivity suite may be enough; larger or mixed fleets often need a dedicated UEM.
- When managing shared or frontline devices. Kiosk, single-app and shared-device modes are important for retail, warehouse and field teams.
Questions to ask vendors
- Which operating systems do you manage, and is laptop management included or a separate license?
- Do you support automatic enrollment for company-owned devices from our suppliers and carriers?
- How do you handle personal devices, and what can IT see and do on them?
- Can device compliance feed our identity provider’s conditional access policies?
- What remote actions are available, including selective wipe of company data?
- How are apps and operating system updates deployed and reported?
- How is licensing counted: per device or per user, and with what device limits?
How it differs from UEM
Unified endpoint management (UEM) is the broader platform that manages end-user devices of many kinds, including Windows and Mac laptops, phones, tablets and often rugged or shared devices, from one console, usually adding app management, patching and reporting. MDM originally meant managing phones and tablets and still names the operating system frameworks UEM tools use. In practice, many products called MDM now manage laptops and many UEM products are still called MDM, so compare what each actually covers rather than the label. Enterprise mobility management (EMM) is an older term for MDM plus app and content management. See our unified endpoint management page for enrollment models and baseline policies, and Mobile Data Security: Today’s Top Data Threat for the risks MDM addresses.
Problems this helps with
- A lost or stolen phone with company email and files on it
- Setting up every new phone or tablet by hand
- Can't prove to auditors or insurers that mobile devices are encrypted and locked
- No idea which devices still run outdated software
