sysop@hub:~/explainers/device-management-explained$
device-management-explained
Mobile device management, or MDM, sounds like surveillance to users and like a project to admins. It is neither: it is the remote control for the handful of settings that decide whether a lost phone is an annoyance or a breach.
what it does
- It puts settings on a device over the air: the passcode rule, Wi-Fi, mail accounts, VPN, certificates.
- It installs and removes company apps.
- It reports the state of the device: system version, encrypted or not, last contact.
- It can lock, locate and wipe a device, or remove only the company's part.
- It can refuse access to mail and files from devices that do not meet the rules. That last point is what makes it a security tool instead of an inventory.
how a device gets in
- Automatic enrolment is the goal for company-owned devices: the device is tied to your management before it is unboxed, and a factory reset does not remove it. A stolen device stays useless.
- Manual enrolment, by installing an app or scanning a code, works for devices you already have and for private ones. The user can undo it.
- Devices bought in a shop are not registered to you. Apple devices can be added afterwards with a second device and some patience, others often not. Buy through a reseller that registers them.
who owns the device
| Model | Device belongs to | Company controls | Fits |
|---|---|---|---|
| BYOD | The employee | Only a work profile or the managed apps. Private side untouched and invisible. | Mail and chat on private phones. |
| Company-owned, private use allowed | The company | The whole device, with a separate private area the company cannot look into. | The usual company phone. |
| Fully managed | The company | Everything. No private accounts. | Shared devices, field service, sensitive roles. |
| Kiosk | The company | Locked to one app or a few. | Scanners, check-in tablets, signage. |
- Decide the model before buying, and write it down for the users in five sentences.
what the company can and cannot see
| The company can see | The company cannot see |
|---|---|
| Model, serial number, system version | Private messages, photos, call history |
| The list of company apps, on fully managed devices all apps | What is inside any app |
| Whether a passcode is set and the device is encrypted | The passcode itself |
| The location, only where that feature is switched on, and on Apple devices only in lost mode | Browsing history |
| The phone number | Private mail accounts |
- Tell users this before enrolment, in writing. Most resistance to device management is the fear of being watched.
- In some countries, employee representatives have a say before such a system is introduced. Ask first.
a small set of policies to start with
- A passcode of six digits or more and automatic lock after a few minutes.
- Encryption on, which the passcode brings with it on current phones.
- A minimum system version, raised a few weeks after each major release.
- Company mail, calendar and files only in managed apps, and no copying from those into private apps.
- Remote wipe of the company's data when a device is lost or someone leaves.
- Block devices that are jailbroken or rooted.
- Notebooks: disk encryption with the key stored centrally, a firewall, automatic updates, no local admin rights.
Start with these, for everyone, and add more only when something calls for it. A long policy list that half the devices fail on day one teaches people to look for ways round it.
choosing one
- If you have Microsoft 365 Business Premium or E3, Intune is included. Use it before buying something else.
- A company that runs on Apple devices is well served by one of the Apple-only management services, which are simpler.
- Google Workspace includes basic management for phones.
- Whatever you choose: enrol three test devices of each kind first, lose one on purpose, and practise the lock and the wipe.
Handing devices out and getting them back: mobile device checklist. For Intune: Intune and Defender cheat sheet, Autopilot cheat sheet, Intune fleet analyzer.
A plain-words overview. Features differ between products and change often, and the rules on employee privacy differ by country. Related: mobile device checklist, new PC setup checklist, hardware buying guide, glossary.