What Is MDM and How Companies Manage Work Laptops and Phones
Basics4 minInnovialabs editorial team
In short
MDM is a system a company uses to centrally configure, secure and, when needed, wipe work laptops and phones without touching each device by hand.
What MDM is
MDM (Mobile Device Management) is a system for centrally managing a company's devices: laptops, smartphones and tablets. From a single console an administrator sees every device and can:
- configure devices without handling each one manually;
- require a passcode, disk encryption and updates;
- install and remove work apps;
- lock or wipe a device if it is lost or an employee leaves.
Today MDM is often part of broader UEM (Unified Endpoint Management) platforms that manage both mobile and desktop systems.
Device enrollment
A device comes under management once it is enrolled in MDM. Options:
- Manual enrollment — the user installs a profile or agent app and signs in with a work account. Suitable for small fleets and personal devices.
- Automated enrollment — a device bought through an authorized channel connects to the company's MDM on first boot. Vendor programs exist for this: Apple Business Manager, Android Zero-touch, Windows Autopilot.
- Enrollment via work account sign-in — for example, signing in with a corporate account on Windows or through a work profile app on Android.
Automated enrollment is the most convenient: a new laptop can be shipped to an employee still in its box, and the right settings apply at first sign-in.
Policies: what is usually configured
| Policy | Why |
|---|---|
| Passcode or PIN, screen lock | Protection if the device is lost |
| Disk encryption | Data cannot be read without the key |
| Mandatory OS updates | Closes known vulnerabilities |
| Wi-Fi and VPN profiles | Employees connect to the office network without manual setup |
| Restrictions | Block apps from unknown sources, USB drives and so on |
| Compliance checks | A device without encryption or with an outdated OS cannot reach mail and documents |
Start with a minimal set: passcode, encryption, updates. Overly strict restrictions on day one cause resistance and workarounds.
Remote lock and wipe
- Remote lock — the device is locked and can display a contact for its return.
- Full wipe — the device is reset to factory settings. Used for company-owned devices.
- Selective wipe — only work data and apps are removed; personal data stays. This is the key feature for BYOD.
Write the procedure down in advance: who decides on a wipe, how employees report a loss, and what happens when someone leaves.
App deployment
Through MDM an administrator can:
- automatically install required apps (mail, messenger, CRM, VPN client);
- publish a catalog of optional apps for self-service installation;
- remove work apps when a device is unenrolled;
- pre-configure apps, for example by setting a server address.
BYOD: personal devices at work
BYOD (Bring Your Own Device) means employees work from their own phones and laptops. It saves on purchases but requires balancing security and privacy.
- On Android, use a work profile: work apps and data are isolated from personal ones.
- iOS and iPadOS offer User Enrollment with limited control over a personal device.
- For many companies, app management (MAM) without full device management is enough: only work apps and their data are protected.
- Explain clearly to employees what the company can and cannot see, and put it in a written policy.
Which tools suit a small company
- MDM built into an office suite. If you already use Microsoft 365 or Google Workspace, some plans include device management. This is the easiest start.
- Apple-focused MDM. A good fit if your fleet is mostly Mac, iPhone and iPad.
- Cross-platform cloud MDM/UEM. Manages Windows, macOS, Android and iOS from one console.
- Open-source and self-hosted options. More control, but you need your own server and administration.
When choosing, look at supported platforms, automated enrollment, console usability, integration with your identity system, and the licensing model (per device or per user).