MDM — What It Is, Device Management, and Security Policies

What Is MDM?

MDM (Mobile Device Management) is a technology for centralized management of mobile devices, allowing organizations to control corporate smartphones and tablets from a single console. Implementing MDM addresses security challenges, regulatory compliance, and automation of corporate mobile infrastructure.

The MDM concept emerged alongside the growth of corporate mobile device usage (BYOD — Bring Your Own Device). The first MDM solutions for BlackBerry appeared in the mid-2000s, and the modern architecture is based on cloud platforms with push notifications from OS manufacturers. Today, MDM is part of the broader EMM (Enterprise Mobility Management) category, which also includes application and content management.

According to Gartner (2025), the MDM solutions market is valued at $11.8 billion and continues to grow at 14% annually. The largest vendors are VMware Workspace ONE, Microsoft Intune, Jamf (for Apple), and IBM MaaS360. The choice of solution depends on the platforms used, organization scale, and security requirements.

How Does MDM Work?

MDM system operates on a client-server architecture with push notifications. The MDM server sends commands and policies to devices through the OS manufacturer's infrastructure: Apple Push Notification Service (APNs) for iOS or Firebase Cloud Messaging (FCM) for Android. An MDM agent is installed on the device, which receives commands and applies policies.

1. The device registers with MDM via DEP (Apple) or Zero Touch (Android) — automatically upon activation
2. The MDM server sends a configuration profile with security policies and settings
3. The system monitors device status: OS version, encryption, installed certificates
4. The administrator can remotely install or remove applications, lock the device, or wipe data
5. The device periodically reports compliance status (compliance report)

MDM uses configuration profiles (Configuration Profiles on iOS, Managed Configurations on Android) that contain Wi-Fi, VPN, mail, certificate, and restriction settings. Profiles are signed and encrypted to prevent unauthorized modification. Each device verifies profile integrity before applying it.

MDM for iOS and Android

MDM on iOS and Android is implemented differently due to differences in security architecture. Apple provides a proprietary MDM protocol via APNs, while Android offers an open Android Enterprise platform with work and personal profile separation (Work Profile). Both approaches allow device management, but with different levels of control.

The key difference is Work Profile on Android. This feature creates an isolated workspace on the employee's device without affecting personal apps and data. iOS does not have such separation — corporate management either covers the entire device (for corporate devices) or applies with limited capabilities (BYOD via User Enrollment, added in iOS 13).

App Distribution via MDM

MDM is a key component of enterprise mobile app distribution. The administrator can remotely install, update, and remove applications on all managed devices without user involvement. This is especially important for applications requiring mandatory installation: corporate messengers, security systems, and internal business tools.

On iOS, applications are installed through MDM integration with Apple VPP (Volume Purchase Program). The administrator assigns applications to devices via the MDM console, and iOS automatically installs them in the background. For custom In-House applications, Enterprise Distribution with enterprise certificate signing is used — MDM sends a command to install the IPA file.

On Android, applications are distributed through Managed Google Play. The MDM console connects to Google Play Console, the administrator selects apps for installation and configures mandatory or optional availability. Devices automatically sync and install assigned applications. Updates are also managed centrally.

// Flutter — MDM policy check in app
import 'package:flutter/services.dart';

class MdmService {
    static final MethodChannel _channel =
        const MethodChannel('com.example/mdm');

    static Future<bool> isDeviceCompliant() async {
        final bool = await _channel
            .invokeMethod<bool>('checkCompliance');
        return result ?? false;
    }
}

An important MDM feature is silent app install. Applications are installed without user involvement and without confirmation prompts. This allows organizations to quickly deploy critical security updates across all devices. On iOS, silent installation works via Managed App Configuration, on Android — via Managed Google Play policies.

Choosing an MDM Solution

Choosing an MDM solution depends on several factors: the mobile platforms used, the number of devices, security requirements, and budget. There is no universal solution — each platform has its strengths. For organizations with predominantly Apple devices, Jamf Pro is recommended; for mixed environments — VMware Workspace ONE or Microsoft Intune.

• Microsoft Intune — the best solution for organizations using Microsoft 365. Integration with Azure AD, Conditional Access, and Compliance Policies. Supports iOS, Android, Windows, and macOS
• Jamf Pro — a specialized solution for Apple devices. Deep integration with Apple DEP, VPP, and MDM protocol. Does not support Android and Windows
• VMware Workspace ONE — a multiplatform solution supporting any OS. Includes management of applications, email, and content through a single dashboard
• IBM MaaS360 — an enterprise solution with AI-powered threat analytics and automatic incident response

When choosing an MDM, consider Total Cost of Ownership (TCO). The cost consists of MDM platform licenses, push notification infrastructure, and administration labor costs. Cloud MDM solutions (SaaS) are usually cheaper to maintain than on-premise installations and do not require dedicated server resources.