Why this matters
A phone with corporate email is a computer you cannot see. Without device management, you cannot tell if it has a passcode, if the OS is current, or if company data sits in a personal cloud backup. That gap matters when a phone is lost, an employee leaves, or an app copies contacts.
MDM gives you a control plane. You push configuration profiles for Wi-Fi, email, VPN and certificates. You set passcode rules, block jailbroken or rooted devices, and require encryption. You can lock, locate or wipe a device, and remove only company data from a personal phone.
The everyday value is repeatable onboarding. A new hire signs in and receives the right apps and settings without a technician touching the phone. Compliance reports show which devices fall out of policy. Conditional access can block email on a noncompliant device until the user fixes it.
It also supports audits. Serial numbers, ownership, enrollment status and last check-in live in one place. That record helps at renewal, at offboarding and when a device goes missing.
Before you start
Decide who owns each device. Corporate phones get full control: supervision, remote wipe, app installs. Personal phones need a lighter model, such as Android work profiles or iOS User Enrollment, where you manage work data and leave personal data alone. Write this down before you pick a tool.
Inventory what you have. Collect make, model, OS version, serial number, IMEI, purchase date and current user. Note SIM locks, expired warranties and OS versions the vendor no longer updates. This list sets your enrollment waves and your replacement list.
Pick a platform that matches your stack. Microsoft Intune fits Microsoft 365 and Entra ID shops. Jamf, Kandji and Mosyle focus on Apple. Google Workspace can manage Android and some iOS. Check the features you need: Apple Automated Device Enrollment, Android zero-touch, per-app VPN, certificate delivery and reporting.
Get the prerequisites in place. You need an Apple Business Manager account, an Apple Push Notification service certificate, an Android Enterprise account bound to your domain, and a directory you can sync users and groups from. Confirm who is global admin, who renews certificates, and where purchase records live. Run a small pilot and tell users what will change.
How to do it
Treat device management as a rollout, not a purchase. Start with a written policy, then configure the platform, then enroll a pilot group, then expand in waves. Each wave should be small enough to support and large enough to expose problems.
Keep configuration in templates, smart groups and naming rules. A new device should land in the right policy without manual work. Test every payload on one device per OS version before you assign it to a group.
Plan for exceptions. Some users need personal phones, some need cellular tablets, some work where Wi-Fi is weak. Document the exception path and who approves it.
- Write the ownership and use policy. Sort users into corporate-owned and personal device groups. State what you can see, lock, wipe and remove on each type. Get sign-off from HR and legal before you configure anything.
- Set up Apple Business Manager and Android Enterprise. Create or claim your Apple Business Manager account and connect it to your MDM. Bind Android Enterprise to your domain and approve the MDM as an EMM provider. Add a test device to each program.
- Connect your directory and certificates. Sync users and groups from Entra ID, Google Workspace or your directory. Upload the Apple Push Notification service certificate and note its expiry date. Set two admins to receive renewal notices.
- Build enrollment profiles. Create enrollment profiles for corporate and personal devices. For Apple, use Automated Device Enrollment with supervision for corporate phones. For Android, choose device owner for corporate and work profile for personal.
- Configure Wi-Fi, email, VPN and apps. Add Wi-Fi, email and VPN payloads with certificate-based authentication where possible. Assign required apps from managed Google Play or Apple Business Manager. Keep personal devices on app protection policies instead of full device control.
- Set compliance and access rules. Define passcode, encryption, OS version and jailbreak rules. Set a grace period so users can fix issues. Connect compliance to conditional access so noncompliant devices lose email but not the ability to enroll.
- Pilot with a mixed group. Enroll 10 to 20 users across roles, OS versions and ownership types. Test remote lock, app install, certificate renewal and wipe on a spare device. Fix the top three support issues before the next wave.
- Roll out in waves and document exits. Enroll by department or location, not all at once. Publish a short user guide and a support channel. Document the retire and wipe steps for leavers, including activation lock bypass and license recovery.
How to check it worked
Use the console reports. Check enrollment rate against your inventory, compliance status by group, last check-in time and policy deployment failures. A device that has not checked in for several days is a problem even if it shows as enrolled.
Test the actions on a spare handset. Send a remote lock, push a Wi-Fi profile, install a required app and run a remote wipe. Confirm the device returns to a clean state and can enroll again. Do this on iOS and Android because behavior differs.
Check the identity side. Open conditional access sign-in logs and confirm a noncompliant device is blocked from email or SharePoint. Verify that a compliant device gets access. Review audit logs for admin changes and failed certificate renewals.
Ask users and spot check. A few calls will reveal battery drain, broken VPN or missing apps. Check that asset tag, serial number and assigned user match your records on a sample of devices.
Mistakes to avoid
Enrolling personal phones with full control. A remote wipe on a BYOD device can erase personal photos if you use the wrong command. Use User Enrollment or work profiles, and make the privacy boundary clear in writing.
Forgetting renewals. The Apple Push Notification certificate expires every year, and enrollment breaks when it does. Put the renewal date in a shared calendar with two owners. Do the same for Android Enterprise binding and any certificate connector.
Over-restricting on day one. Blocking all personal apps or forcing a weekly passcode change creates tickets and workarounds. Start with a baseline: screen lock, encryption, OS update within a set window and jailbreak detection. Tighten later with data.
No offboarding path. When someone leaves, retire the device, remove activation lock, release app licenses and update the asset record. Test that flow before you need it. If you need an inventory and a standard phone spec before the next wave, Cloudverg's Hardware and endpoint review is one option: fixed price $4,500 over two weeks.
Frequently asked questions
What is mobile device management?
It is a set of tools and policies that let you enroll, configure, secure and wipe phones and tablets. An MDM platform pushes settings and apps, reports compliance and enforces access rules. It covers corporate-owned and personal devices, but with different levels of control.
Do I need MDM for BYOD?
Yes, if personal phones access company email or files. Use User Enrollment on iOS or a work profile on Android so you manage work data without touching personal photos and apps. Write a clear privacy notice and get user consent.
What happens when I wipe a device?
A full wipe erases all data and returns the device to factory settings. On a personal phone, choose a selective wipe that removes only company apps, accounts and data. Test both commands on a spare device before you use them in production.