Mobile device management (MDM)
Also known as: MDM, mobile device management, endpoint management, UEM, Microsoft Intune
Mobile device management (MDM) is software that lets a business centrally configure, secure, and manage the phones, tablets, and often laptops staff use for work.
It can enforce encryption, passcodes, and updates, deploy apps and settings, and remotely lock or wipe a device that's lost or stolen: protecting company data on the move.
Mobile device management (MDM), explained at three levels
At home
MDM is like a building manager holding a master key and a rulebook for every office. Each phone or laptop enrolled in the system checks in with a central service, which sends it rules, such as requiring a passcode and encryption, and the apps the company wants installed. If a device is lost, the manager can lock it or erase the company data on it from anywhere.
At work
Mobile device management is software that lets a business configure and secure all its work devices from one console. It pushes settings, apps, and security rules to phones, tablets, and laptops, checks that they stay in line, and can lock or wipe a lost device. Popular tools include Microsoft Intune, Jamf for Apple devices, and Google's endpoint management. For a business, it turns dozens of separate devices into one managed fleet.
At home
MDM works through management features built into the operating system. When you enroll a device, it installs a management profile and receives an identity certificate. From then on, the device checks in with the MDM service, often prompted by a push notification from Apple or Google, and receives instructions: install this app, require a six-digit passcode, turn on encryption. On a personal phone, enrollment can be limited to a separate work profile, so the company sees only work apps.
At work
An MDM platform manages three things: configuration profiles (Wi-Fi, VPN, email, restrictions), compliance policies (minimum OS version, encryption, no jailbreak), and app deployment. The compliance result feeds conditional access in the identity system, so Microsoft 365 can refuse sign-ins from a device that fails. Company-owned devices can enroll automatically through Windows Autopilot, Apple Business Manager, or Android zero-touch, which also stops a thief from simply resetting the device to escape management.
At home
Operating systems give MDM different levels of control depending on who owns the device. On a company-owned iPhone in supervised mode, IT can lock down almost everything. On a personal Android phone with a work profile, IT controls only the work container and can't see personal apps or photos. That split is enforced by the operating system itself, not by trust. While full control is tempting, in my view a work profile is the right balance for personal phones.
At work
Unified endpoint management combines MDM, app management, and PC management in one platform, such as Microsoft Intune, Jamf Pro, or Workspace ONE. Its real power comes from integration: device compliance becomes a condition of access in Entra ID, and risk scores from endpoint protection can mark a device noncompliant. Failure modes include devices that quietly stop checking in, overlapping policies that conflict, and an expired Apple push certificate, which must be renewed yearly and breaks management of every Apple device at once.
Real-world examples
At home
Thomas's employee left a work phone in a taxi, full of client emails. Because the phone was enrolled in MDM, Thomas had his MSP remotely wipe the work data within the hour: turning a potential data breach into a non-event.
At work
Nadia's firm rolled out MDM (Microsoft Intune) across all staff devices. New laptops now auto-configure on first login, every device is encrypted and patched, and only compliant devices can access firm systems. When an employee departs, their work access and data are removed remotely.
Common confusions
- MDM lets my employer see everything on my personal phone — On BYOD, modern MDM typically manages only the work data and apps, not personal content. IT can wipe company data without accessing or erasing personal photos, messages, or apps.
- MDM is only for phones — Modern MDM/endpoint management covers phones, tablets, laptops, and desktops, applying consistent security and management across all device types.
- Small businesses don't need MDM — Any business with staff devices holding company data benefits. A single lost, unencrypted, unmanaged device can cause a breach that MDM would have prevented.
For analysts
MDM turns 'a lost device is a data breach' into 'a lost device is a remote wipe.' It's foundational for securing a mobile, remote workforce: enforcing encryption and updates, enabling conditional access, and cleanly removing company data from lost devices or departing staff.
History & origin
As smartphones and tablets flooded workplaces, businesses needed a way to secure company data on devices they didn't fully control. MDM emerged to manage and secure mobile devices centrally, later broadening into unified endpoint management (UEM) covering laptops and desktops too. Cloud-based MDM (like Microsoft Intune) made enrollment and management accessible to small businesses, especially as remote and BYOD work grew.