Unified endpoint management (UEM) is software that lets IT manage and secure all of a company’s end-user devices, including Windows and Mac laptops, iPhones, Android phones and tablets, and often ChromeOS and rugged or shared devices, from one console. It handles enrollment, configuration, software and update deployment, security settings, and remote lock and wipe. UEM grew out of mobile device management (MDM) and traditional PC management tools, combining them into a single platform.
At a glance
- UEM manages laptops, desktops, phones and tablets across operating systems from one console.
- It automates device setup, so new devices can ship straight to a user and configure themselves.
- It enforces security settings such as encryption, passcodes and OS updates, and reports on compliance.
- It can lock or wipe lost devices, or remove only company data from personal ones.
- It works alongside, not instead of, endpoint security tools such as EDR.
What problem it solves
Most companies have a mix of devices: Windows and Mac laptops, company and personal phones, tablets, and sometimes shared or rugged devices in warehouses and stores. Managing each type with a different tool, or by hand, means slow onboarding, inconsistent settings and no reliable answer to “Is every device encrypted and up to date?”
That answer matters. Insurers, auditors and customers ask for it, and identity systems increasingly check device health before allowing access to company apps. Lost and stolen devices are routine, and the business needs to be able to protect the data on them. UEM provides one place to set policy, see the state of every device and act on it.
How it works
Enrollment. Devices are registered with the UEM, ideally automatically. Programs from Apple, Google and Microsoft let company-owned devices enroll themselves on first power-on (often called zero-touch enrollment), so a laptop can ship from the reseller straight to an employee. Personal devices usually enroll through an app with a work profile that keeps company data separate.
Configuration. IT defines profiles for Wi-Fi, VPN, email, certificates, security baselines and restrictions, and applies them by group, device type or location.
Apps and updates. The UEM deploys and removes applications, controls OS updates, and on many platforms patches third-party apps. Update support differs by operating system and product, so check it for each platform you run.
Security and compliance. Policies require encryption, passcodes, firewall settings and minimum OS versions. Devices that fall out of compliance can be reported, restricted or blocked from company apps through integration with your identity provider (often called conditional access).
Inventory and remote actions. Depending on the product, operating system and how a device was enrolled, IT can see hardware and software inventory and lock, wipe or retire devices remotely. Company-owned devices can typically be wiped completely; on personal devices, IT is usually limited to removing the work profile and company apps. Locating a device is restricted or unavailable on several platforms, and what inventory a UEM can collect from a personal device is deliberately limited. Some products can also reclaim app licenses and reset devices for the next user. Verify each of these per operating system and enrollment mode before relying on it.
When it matters for buyers
- When hiring quickly or onboarding remote staff. Zero-touch setup saves hours per device.
- After an acquisition. Inherited devices on different tools need to be brought under one policy.
- When an audit or insurer asks for device evidence. Encryption, patch status and inventory reports are common requests.
- When introducing BYOD. A clear way to protect company data on personal devices.
- When Microsoft, Mac or mobile licenses change. A chance to consolidate overlapping management tools.
Questions to ask vendors
- Which operating systems and device types do you support, and how deep is support for each (especially macOS, Android and shared devices)?
- Do you support automated enrollment through Apple, Google and Microsoft programs?
- Can you patch third-party applications as well as the operating system?
- How do you integrate with our identity provider for device-based access decisions?
- How do you separate work and personal data on BYOD devices?
- Can we see licensing per user or per device, and how are shared devices counted?
- Is the service available as a managed offering, and who handles policy changes?
How it differs from MDM
Mobile device management (MDM) originally meant managing phones and tablets, and the term also names the built-in management frameworks that Apple, Microsoft and Google operating systems provide. UEM is the broader platform that uses those frameworks, often alongside an installed agent, to manage every kind of endpoint in one place. For enrollment models and baseline policies, see our Unified Endpoint Management guide.
Problems this helps with
- Different tools to manage Windows, Mac, iPhone and Android devices
- Setting up new laptops by hand for every new hire
- Not knowing whether every device is patched and encrypted
- Lost or stolen devices holding company data
