Mobile device management (MDM) is software that lets organisations centrally enrol, configure, secure and monitor smartphones, tablets and laptops used for work.
How MDM works
A device is enrolled in the MDM service, usually by installing a management profile or through automated enrolment programmes from Apple and Google. The administrator can then:
- enforce passcodes, encryption and minimum OS versions;
- push Wi-Fi, VPN, email and certificate settings;
- install, update or block apps;
- check compliance, for example detecting jailbroken or rooted devices;
- locate, lock or remotely wipe lost or stolen devices.
Common products include Microsoft Intune, Jamf and Ivanti, built on the management frameworks of iOS, Android Enterprise, Windows and macOS. MDM is now often part of broader unified endpoint management (UEM).
Why MDM matters
Mobile devices hold corporate email, documents and authentication apps, and are easily lost. MDM provides the device health signals that zero trust access policies rely on, and supports data loss prevention by keeping corporate data in managed apps. For BYOD scenarios, lighter options such as work profiles separate personal and corporate data.
Because MDM has powerful control over every device, it is also a valuable target. In 2018 Cisco Talos described a campaign that used a malicious MDM server to install spyware on iPhones in India, and in 2023 zero-day flaws in Ivanti Endpoint Manager Mobile were exploited to breach Norwegian government ministries.
Best practices
- Protect MDM admin consoles with MFA and patch MDM servers promptly.
- Limit admin rights and log all remote wipe and policy changes.
- Collect only the data needed and explain privacy rules to employees.
- Never install management profiles from untrusted sources.
