MDM

Mobile Device Management (MDM) is the management model where IT enrols and controls the entire device — including OS configuration, app installation, security policies, remote wipe of the whole device. In Microsoft 365, MDM is delivered by Microsoft Intune for Windows, macOS, iOS, iPadOS, and Android. The right model for corporate-owned devices where IT needs broad control. Contrast with MAM (Mobile Application Management) — particularly MAM-WE — where only specific apps are managed and the rest of the device is untouched, suited to BYOD scenarios. Many organisations run both: MDM for company-issued hardware, MAM for personal phones accessing corporate data.

Worked example

A company issues laptops it owns outright to every employee, enrols them into Intune MDM at first boot via Autopilot, and from that point can push a full Windows configuration, require BitLocker encryption, and remotely wipe the device the day someone leaves. For personal phones checking work email, the same company doesn't enrol the whole device into MDM at all — it uses MAM instead, so the Outlook app is protected and corporate data can be wiped from inside it, without IT ever gaining control over the employee's personal photos, other apps, or the device's lock screen.

Common pitfalls

Reaching for full MDM enrolment on personal (BYOD) devices out of habit, rather than the lighter MAM model, is a common overreach that tends to meet employee resistance — asking someone to hand a personal phone's full device controls to their employer is a bigger ask than protecting one work app on it. Conflating "the device is enrolled" with "the device is compliant" is a related mistake: enrolment just means Intune manages the device, while compliance policies (encryption on, OS version current, no jailbreak) are a separate check that Conditional Access actually keys off. And assuming MDM alone secures corporate data ignores that Conditional Access is the piece that actually blocks access based on the compliance signal MDM produces — MDM without a Conditional Access policy requiring compliance is enrolment with no real enforcement behind it.