What Is MDM (Mobile Device Management)?

MDM (mobile device management) is software that lets an IT team configure, secure, monitor, and - when necessary - remotely lock or wipe phones, tablets, and laptops from a central console. Instead of setting up each device by hand and hoping nobody disables the screen lock, IT defines policies once and the MDM platform enforces them on every enrolled device, wherever it is. MDM is the standard answer to two awkward facts of modern work: company data lives on devices that leave the building every day, and on BYOD personal devices it shares space with someone’s private life.

How MDM works

A device is enrolled - either through a management framework built into the operating system or by installing an agent app. From then on it checks in with the MDM server over the internet and receives profiles: bundles of settings and rules pushed from the console. Because enrolment ties into the OS itself, the policies survive reboots and cannot simply be switched off by the user. Devices bought through corporate channels can even enrol automatically on first boot, so a laptop shipped straight to a new hire arrives configured.

What MDM is used for

• Security baselines - require a passcode, enforce disk encryption, set screen-lock timers, block jailbroken or rooted devices.
• Configuration - push wifi, VPN, email, and certificate settings so devices work on day one.
• App management - install and update approved apps, block forbidden ones.
• Lost and stolen devices - locate (where policy and consent allow), lock, or remotely wipe a device, which turns a stolen phone from a data breach into a hardware loss.
• Work-personal separation - on personal devices, keep work data in a managed container that can be wiped alone.

MDM vs MAM

MDM manages the device; MAM (mobile application management) manages only the work applications and their data. The distinction matters most on personal phones: full MDM enrolment gives the employer device-level control that many people reasonably resist, while MAM draws the boundary at the work apps - the company can enforce a PIN on the mail app and wipe its container at offboarding without ever touching personal photos. Many platforms offer both modes and let the enrolment type follow device ownership.

MDM vs an asset register

MDM knows the live software state of every enrolled device: OS version, installed apps, encryption status, last check-in. It does not know what the device cost, whose budget bought it, when its warranty ends, or that it was handed to a contractor last month - and it knows nothing at all about kit that cannot enrol, like monitors, docks, and peripherals. That custody-and-cost record belongs to hardware asset management, where each device is a tracked configuration item with an owner and a history. Mature teams run both and reconcile them: the MDM console and the IT inventory should agree on how many laptops exist, and the gap between the two lists is where lost and unmanaged devices hide.

Related terms

• BYOD - personal devices at work, the problem MDM and MAM were built to manage
• Hardware Asset Management - the ownership, cost, and custody record MDM does not keep
• IT Inventory - the device count to reconcile against the MDM console
• Asset Discovery - finding devices that never got enrolled or recorded
• Configuration Item - the ITSM term for a managed, tracked component