What is MDM? Mobile device management, explained without the jargon
MDM (mobile device management) is how a business sets up, updates and protects its Macs, iPhones and iPads from one place. What it does, what it can't see, and why it matters.
Stabilise
MDM stands for mobile device management. It's software that lets a business look after all its laptops, phones and tablets from one place, instead of one at a time.
So rather than someone setting up each new Mac by hand, chasing people to install updates, and hoping a lost laptop had a password on it, the MDM does it. It sets devices up, keeps them updated, locks them down, and can wipe one remotely if it goes missing.
Despite the "mobile" in the name, it covers Macs and Windows PCs too, not just phones.
A simple way to think about it
Think of it like a fleet manager for company cars. They don't drive the cars. But they make sure every car is insured, serviced on time and fitted with the right kit, and they can get a stolen one back.
An MDM does that for your devices. Every one gets the same safe setup, stays up to date, and stays under the company's control, wherever it is.
What an MDM does, day to day
Sets up new devices for you. A new starter's Mac can arrive in its box, get switched on, and set itself up with the right settings and apps. Nobody from IT needs to touch it. This is called zero-touch deployment, and we walk through it in our zero-touch Mac guide.
Keeps everything updated. Updates fix security holes, so they matter. An MDM can set a deadline, and if someone hasn't updated by then, the device does it for them. On Apple devices this now runs through something called DDM.
Locks things down. It makes sure every device has a passcode, locks the screen when nobody's using it, and has its storage encrypted. On a Mac that's FileVault, which makes the data unreadable without the password.
Installs the right apps. Everyone gets the apps they need for their job, already set up, and they stay up to date.
Deals with lost and stolen devices. Apple says an MDM can lock a Mac with a six-digit PIN and a message on screen. On a company iPhone or iPad, Managed Lost Mode locks the person out, shows your message, and can find where the device is "even if location services are off". And if it's gone for good, you can wipe it.
Handles people leaving. When someone leaves, their laptop can be wiped and handed to the next person, set up fresh. Our offboarding checklist covers the rest of a leaver's last day.
What an MDM can't see
This is the question people worry about most, so it's worth being clear.
On a personal phone, Apple has a mode built for this called User Enrolment. In Apple's words, the company can "manage only an organization's accounts, settings, and information provisioned with a device management service, never a user's personal account". Work apps and data live in their own separate space, apart from your personal apps and accounts. If you leave, only the work side is removed. We go into more detail in why your personal iPhone is safer than you think.
On a company device, the business owns it, so it gets more control. But an MDM is about settings, apps and security. It isn't a tool for reading what people write. And finding a device's location on an iPhone or iPad only works once it's been put into Lost Mode, which the person sees on their screen.
Why it matters for a business
It's how you meet Cyber Essentials. The Cyber Essentials requirements don't name MDM, but they ask for things an MDM makes easy and, just as importantly, easy to prove:
- Critical and high-risk updates installed within 14 days of release.
- Devices locked with a PIN or password of at least six characters, and locked after no more than 10 wrong attempts.
- Accounts removed or disabled when someone leaves.
- Personal phones and laptops that access company data are in scope too.
Doing that by hand across 20 devices means a lot of chasing. With an MDM, it's a setting, and a report when the assessor asks. Our Cyber Essentials v3.3 guide has the full list.
A lost laptop doesn't have to mean lost data. The ICO, the UK's data protection regulator, tells businesses to "enable storage encryption on laptops, smartphones and tablets", and warns it "may not be enabled by default". An MDM turns it on everywhere and shows you it's on. Its guidance for small businesses also suggests wiping a stolen laptop remotely, which you can only do if it's managed.
Most businesses aren't there yet. The UK government's Cyber Security Breaches Survey 2025/26 found 61% of businesses have security controls on company-owned devices like laptops. Only 34% have a policy to apply software security updates within 14 days. That's the gap an MDM closes.
It scales with you. Setting up three Macs by hand is fine. Setting up thirty, each a bit different, is where things start to break. An MDM means the thirtieth device is set up exactly like the first.
Do you need one if you're small?
Yes, from the first device that holds company data. It's much easier to start with an MDM than to bring twenty devices under control later.
The good news is that starting is cheap. Apple Business, Apple's free service for organisations, now includes basic device management built in. For a small team using only Apple devices, that can be enough to begin with. We explain when the built-in option is enough, and when to upgrade.
When you need more, such as compliance reporting, a mix of Mac and Windows, or more control over updates and apps, you move to a full MDM. The common ones for Apple devices are Jamf, Microsoft Intune, Mosyle and Iru. We compare the main options in our Jamf vs Intune vs Iru guide. For what it's worth, we're not tied to one. We pick whichever fits the business.
What an MDM isn't
It isn't antivirus. Security tools that watch for malware and attacks, often called EDR, are separate. The MDM is usually how they get installed on every device. Here's our comparison of Mac security tools.
It isn't backup. An MDM can wipe a device, but it doesn't keep a copy of your files. That's a different job.
It isn't your login system. Who can sign in to what is handled by an identity provider, like Google, Microsoft or Okta. The MDM works alongside it. Our identity provider comparison explains how they fit together.
A quick note if you've bought a second-hand Mac
If you're setting up a used Mac or iPhone and it shows a "Remote Management" screen, it's still registered to a company's Apple Business account.
Apple tells companies to release devices from their account when they're sold. Only that company can do it, so go back to the seller and ask them to get it released. After that, the device needs erasing and setting up again.
Where to start
- List your devices. Every laptop, phone and tablet that touches company email or files, including personal ones.
- Set up Apple Business. It's free, and it's what lets new Apple devices set themselves up.
- Pick an MDM, or ask someone who does this every day. Getting the setup right at the start saves a lot of tidying later.
If you'd rather not do it yourself, this is exactly what we do for Mac-first teams across London.
Frequently asked questions
- What does MDM stand for?
- Mobile device management. It's software that lets a business set up, update and secure its laptops, phones and tablets from one place. Despite the name, it covers Macs and PCs too, not just phones. (In data teams, MDM can also mean master data management, which is something else entirely.)
- Can my employer see my personal stuff if my phone is enrolled in MDM?
- Not if it's set up the way Apple designed it for personal phones. With User Enrolment, Apple says the company can manage only its own accounts, settings and information, never your personal account. Work apps and data are kept separate from your personal apps and accounts, and leaving removes only the work side.
- Does a small business need MDM?
- Yes, from the first device that holds company data. It's the easiest way to keep devices updated, locked and encrypted, to wipe a lost laptop, and to show you meet Cyber Essentials. For a handful of Apple devices, the free management built into Apple Business can be enough to start.
- Is Apple's free built-in MDM good enough?
- For a small, all-Apple team with simple needs, often yes. Once you need detailed reporting for compliance, security tools on every Mac, a mix of Apple and Windows, or more control over apps and updates, most businesses move to a full MDM like Jamf, Intune, Mosyle or Iru.
- Is MDM the same as antivirus?
- No. MDM manages settings, apps and updates. Antivirus, or EDR, watches for malware and attacks. You want both, and the MDM is usually how the security tool gets installed and kept running on every device.
- I bought a second-hand Mac and it says Remote Management. What now?
- The Mac is still registered to a company's Apple Business account. Only that company can release it, so go back to the seller and ask them to get it released. Once it is, the Mac needs erasing and setting up again.
