Mobile Device Management: Selecting and Implementing MDM Solutions

• Enrolment. Registers a device with your organization, ideally automatically when a user first turns it on.
• Configuration. Pushes settings for email, Wi-Fi, VPN and certificates so users do not set them up by hand.
• Security policy. Requires a passcode, device encryption and a minimum operating system version, and blocks devices that have been tampered with.
• App management. Installs, updates and removes business apps, and controls which apps are allowed.
• Compliance and access control. Checks device health and can stop a non-compliant device from reaching email or business apps.
• Remote actions. Locks, locates or wipes a device, either fully or only the business data.
• Inventory and reporting. Shows what devices exist, who has them and whether they meet policy.

Vendors use overlapping terms. This table separates them.

If you already manage laptops with a tool that also covers mobile devices, a unified approach may reduce effort. If mobile is the only need, a mobile-focused platform may be simpler.

The ownership model sets how much control you have, and how much privacy the user keeps.

Modern mobile operating systems support separate work areas on personal devices, but the details differ between platforms. Test each platform you support instead of assuming they behave the same.

Write these down before you speak to any platform provider.

• The device mix: phones, tablets, rugged devices, shared kiosks and any laptops that will be included.
• The operating systems you support, and how quickly you need support for new releases.
• The number of devices today and in three years.
• The security and regulatory obligations that apply, including privacy law and any sector rules.
• Your identity provider and email platform, since MDM must work with both.
• Who will administer the platform, and during what hours.
• Language needs, including French for enrolment screens and notices if you have staff in Quebec.

Use a scorecard. Weight each criterion from one to five by how much it matters to you, score each platform from one to five against it, and multiply. Test the points below in a real pilot instead of relying on a demo.

1. Write the policy. State what is required on every managed device, what differs by ownership model, and what happens when a device falls out of compliance.
2. Build baseline configurations. Create one set of profiles for each ownership model, covering passcode, encryption, updates, email, Wi-Fi and app rules.
3. Integrate identity and access. Connect the platform to your directory, so that access to email and business apps can depend on device status.
4. Run a pilot. Include every device type and a few skeptical users. Record every problem, from enrolment failures to battery drain.
5. Communicate. Tell people what is changing, why, what IT can and cannot see, and where to get help. Do this before enrolment starts.
6. Enrol in waves. Move group by group, and fix issues between waves.
7. Prepare the help desk. Give support staff scripts for enrolment, lost devices and non-compliance notices.
8. Operate. Review compliance weekly, track operating system updates, and test the lost-device and leaver processes.

Trust decides whether a bring-your-own-device program succeeds. People will not enrol personal phones if they think the company is reading their messages. Be specific about what IT can see.

On a personally owned device with a work profile, IT can typically see the device model, operating system version, compliance status and the business apps it has installed. IT typically cannot see personal messages, photos, personal app contents or browsing outside work apps. The exact boundary depends on the platform and your configuration, so verify it in the pilot and document it.

Put the rules in plain-language policy that users agree to. Whatever the legal minimum in your province, be open about what is collected and why. Decide in advance whether location data is collected at all, and if it is, when and for what purpose. Check the policy with your legal and privacy advisers.

• A passcode of defined strength, with automatic lock after a short idle period.
• Device encryption turned on.
• A minimum operating system version, with a deadline to update.
• Devices that have been altered to bypass built-in security are blocked.
• Only approved apps can access business data.
• Business data cannot be copied into personal apps on managed devices where this can be controlled.
• Non-compliant devices lose access to business resources until fixed.
• A clear process for lost, stolen and retired devices.

Tie device compliance to access decisions. The zero trust guide explains why device health should be part of every access check.

• Choosing a platform before deciding on the ownership model.
• Enforcing the same controls on personal and company devices.
• Skipping the pilot, and discovering problems during full rollout.
• Failing to explain what IT can see, which creates distrust.
• Not planning for leavers, so company data stays on personal devices.
• Letting operating system updates lag because no one owns them.
• Treating MDM as the whole mobile security strategy, when it is one control among several.

• Which operating systems and ownership models do you support, and how fast do you support new operating system releases?
• Can devices enrol automatically from the first power-on, and can devices we buy through a reseller or carrier be enrolled that way?
• How does the platform separate work and personal data on personally owned devices?
• Where is our console data stored, and who at your company can access it?
• How does pricing change as we add devices, add features or move between ownership models?
• What happens to our configuration and data if we leave?
• What does the support process look like, and in what languages?

Do we need MDM if we only have a few devices?

You need the controls it provides, such as a passcode, encryption, updates and remote wipe. With very few devices, some of these can be handled by built-in settings or the controls in your email platform. As the count grows, or if you handle sensitive data, a dedicated platform becomes worthwhile.

Can MDM read personal data on a bring-your-own-device phone?

With a properly configured work profile, typically not. It separates business data from personal data. Platforms differ, so confirm what is visible in your pilot and tell users in writing.

What is the difference between MDM and MAM?

MDM manages the device. MAM manages the apps and their data without enrolling the device. MAM suits personal devices and contractors, and MDM suits company-owned devices.

How do carriers and MDM fit together?

Many organizations buy devices through a carrier or reseller that can register them for automatic enrolment. The enterprise wireless strategy guide covers the carrier side.