Mobile Device Management (MDM) is how IT teams enroll, configure, secure, and monitor the phones and tablets their organization runs on. It is also, for most companies, the only system that knows those devices exist at all, which is where the trouble starts: the laptops and servers live in the IT inventory, and the mobile fleet lives somewhere else entirely.
This post covers what MDM does, how it works on Android and Apple devices, and what it leaves out. Then it gets to the part almost nobody explains: how managed phones and tablets become asset records in the same inventory as the rest of your IT estate, with the MDM acting as the data source instead of a separate console someone has to remember to check.
What is Mobile Device Management (MDM)?
Mobile Device Management is the practice that lets IT administrators manage mobile devices remotely from a central console: enrolling them, pushing configuration and security policies, distributing apps, monitoring status, and locking or wiping a device that gets lost or stolen.
It applies to company-owned hardware and to personal devices enrolled under a Bring Your Own Device (BYOD) policy, and it is one piece of a broader IT Asset Management (ITAM) practice rather than a replacement for it. When vendors talk about enterprise Mobile Device Management or Unified Endpoint Management, they usually mean the same core capability extended across more device types and more policy depth.
MDM vs. MAM
The two get used interchangeably and they are not the same scope. MDM manages the device; Mobile Application Management (MAM) manages the applications and the corporate data inside them.
Benefits of Mobile Device Management
- Consistent security - passcodes, encryption, and remote wipe are enforced by policy across the fleet instead of relying on each user to configure them.
- Faster deployment at scale - devices arrive preconfigured through automated enrollment, so a new phone is usable without an administrator touching it.
- Central visibility of device state - one console shows OS versions, compliance status, and which devices have stopped checking in.
- Controlled app distribution - approved apps get pushed and updated centrally, and unapproved ones can be blocked.
How does MDM work?
Every MDM platform works on the same basic model: a management server holds the policies and the device inventory, and each device is enrolled into it so it can receive configuration and report back. What changes between platforms is how the operating system exposes that control, and Android and Apple do it differently.
How MDM works on Android
Android management runs on Android Enterprise, the framework Google built into the OS. The decision that shapes everything else is the enrollment mode, because it sets how much control IT gets and how much of the phone stays private:
- Work profile - a separate corporate container for apps and data, with the personal side untouched. The standard model for BYOD.
- Fully managed - company-owned devices under full IT control, with zero-touch enrollment available so they configure themselves on first boot.
- Dedicated devices - locked to one app or a few, which is how kiosks, point-of-sale terminals, and warehouse scanners get deployed.
Google's endpoint management in the Google Workspace admin console covers standard fleets, Microsoft Intune handles Android inside a mixed environment, and SOTI MobiControl reaches the rugged hardware the other two handle poorly. Fragmentation is the practical catch: OEM layers and old OS versions mean a policy can behave differently across device families, so test per family instead of assuming the fleet is uniform.
Recommended reading
Read Article
Android Device Management: How to Manage Android Devices in Your IT Inventory
How MDM works on Apple devices
Apple took the opposite approach: the MDM protocol is built into iOS, iPadOS, and macOS, so nothing gets installed on the device, and Apple defines what every platform is allowed to do through it. The organizational layer is Apple Business Manager, or Apple School Manager in education, where purchased devices and app licenses are registered and linked to your MDM. How a device enrolls from there depends on who owns it:
- Automated device enrollment - company-owned devices registered in Apple Business Manager enroll during setup and become supervised, which unlocks the stricter controls: restricting features, enforcing OS updates, blocking the user from removing management.
- User enrollment - for BYOD. Work data sits under a separate managed account that IT can wipe without touching personal content, in exchange for much narrower visibility.
- Device enrollment - the user installs the enrollment profile themselves, one device at a time, for hardware that never passed through Apple Business Manager.
Settings travel as configuration profiles covering passcodes, Wi-Fi and VPN, restrictions, and certificates, with Jamf Pro and Jamf School the most widely used platforms for distributing them. Keep in mind that Apple's limits on what MDM can read apply to every vendor equally, so a capability that is missing on iOS is usually a platform boundary rather than a weakness of your tool.
Recommended reading
Read Article
iOS Device Management: How to Manage Apple Devices in Your IT Inventory
MDM and your IT inventory: why one is not enough
An MDM is built to control devices, and it does that well. What it holds is the operational state of the phone: who it is assigned to in the directory, what OS it runs, whether it complies with policy, when it last checked in. That is everything you need to secure a fleet and almost nothing you need to manage it as property.
The questions that come from outside IT operations land outside that console. What these 200 phones cost and how much of that value is left. Which carrier plan or insurance covers each one, and when it renews. Which cost center pays for it, and where the device sits in its lifecycle beyond enrolled or not enrolled. There is also a coverage limit: an MDM only knows the devices someone enrolled in it, so the phone that never got enrolled, the tablet inherited in an acquisition, and the warehouse scanner running on another platform never show up at all, and their absence looks identical to not existing. An IT inventory is the layer that holds all of it, with the MDM feeding the technical data it is genuinely good at collecting.
How to bring mobile devices into your IT inventory with InvGate Asset Management
Unify Your IT Asset Inventory in 24 hours! Leverage Automated Discovery
InvGate Asset Management treats your MDM as a discovery source: it connects to the platform already managing your phones and tablets, pulls the device data, and creates an asset record for each one alongside the laptops, servers, and cloud resources in the same inventory. No CSV exports, no parallel spreadsheet. Four native discovery sources cover the most common platforms:
- Microsoft Intune - for mixed fleets. You choose which operating systems to sync, and the integration brings in hardware details, OS and compliance data, user information, and Intune's own attributes like enrollment type, device category, ownership, and last check-in. On mobile devices it also picks up IMEI, carrier, and phone number when those are available.
- Jamf Pro and Jamf School - for Apple fleets, business and education respectively. Each iPhone and iPad arrives with its type, manufacturer, model, serial number, IMEI, network details, processor, RAM, and storage, plus whether the device is supervised and when Jamf last inventoried it.
- SOTI MobiControl - for rugged and purpose-built hardware, like the Zebra scanners and field tablets running in warehouses, stores, and hospitals. It syncs enrollment date, OS version, last check-in, assigned user, compliance status, and enrollment state.
- Google Workspace - imports and syncs Chromebooks and mobile devices managed through Google's endpoint management, generating an asset profile for each one.
What you can do once the devices are in
Every capability an MDM console cannot offer becomes available on those records:
- Ownership and location - set the owner, site, and cost center, and keep them current as devices get reassigned.
- Contracts and coverage - attach the carrier plan, insurance, or service agreement as a contract, and the warranty or AppleCare coverage with automated reminders before it expires.
- Costs and lifecycle - track acquisition cost and depreciation, and move each device from in stock to assigned to retired.
- Relationships - build Configuration Management Database (CMDB) connections so a phone links to the services and people around it.
- Tags, reports, and automations - Smart Tags group devices by whatever attributes matter to you, reports cover mobile and traditional endpoints together, and automations flag a device with a stale check-in or one due for an end-of-life review.
Devices that never passed through an MDM belong in the same inventory, and they get there by direct entry, CSV import, or from a purchase order, staying accurate afterwards through physical QR tags and scan-based audits.
Recommended reading
Read Article
Mobile Device Inventory Management: How to Track Every Phone And Tablet (8 Best Practices)
Mobile Device Management best practices
- Match the enrollment method to who owns the device - automated, supervised enrollment for company-owned hardware, user-initiated enrollment with narrower permissions for BYOD.
- Write policies to the minimum control you actually need - every extra restriction on a personal device is a support ticket and a privacy conversation waiting to happen.
- Set an OS version floor and enforce it - decide which versions are acceptable, monitor drift from the console, and act on devices that fall behind.
- Tie offboarding to the inventory, not to memory - when someone leaves, the record should tell you which devices to recover and wipe.
- Reconcile the MDM against the inventory on a schedule - devices that stopped checking in, and devices in the inventory that never enrolled, are both worth finding before an audit finds them.
To sum up
Mobile Device Management gives IT control over the phones and tablets in the organization: enrollment, configuration, security policy, and the ability to act on a device remotely. What it does not give you is the property view, which is why the mobile fleet so often ends up managed well and accounted for badly.
Connecting your MDM to your IT inventory settles that. Start a 30-day free trial of InvGate Asset Management, or talk to Sales to see how it fits the MDM you already run.
Frequently asked questions
1. What is MDM software?
MDM software is the platform that carries out Mobile Device Management: a management server plus the enrollment mechanism each operating system provides, used to configure devices, push apps and policies, monitor compliance, and wipe or lock a device remotely. Widely used options include Microsoft Intune, Jamf for Apple fleets, SOTI MobiControl for rugged hardware, and Google's endpoint management inside Google Workspace.
2. Why do we need Mobile Device Management?
Because a phone with corporate email on it is an entry point to company data, and without central control there is no way to enforce a passcode, require encryption, or wipe that device when it disappears. MDM also removes the manual work of configuring devices one by one as the fleet grows.
3. How does BYOD work with MDM?
Under a BYOD policy the employee owns the device and enrolls it themselves, so the MDM gets a deliberately limited scope: it manages the corporate side of the phone, a work profile on Android or a user-enrolled configuration on iOS, and can remove corporate data without touching personal content. Company-owned devices are enrolled with full management instead. Recording which model applies to each device in your inventory is what keeps the two apart when it matters.
4. Which devices are managed through Mobile Device Management?
Smartphones and tablets first, and depending on the platform also laptops and desktops, Chromebooks, rugged handhelds and scanners, and purpose-built devices like point-of-sale terminals or clinical tablets. Microsoft Intune and SOTI MobiControl reach across most of that range; Jamf covers the Apple ecosystem, including macOS and tvOS.
