Every laptop and phone your team uses holds some of your business: emails, customer details, files, and the logins to everything else. In a small company those devices are usually set up by whoever unboxed them, and nobody can say for certain which ones are up to date. MDM fixes that.
What MDM is
MDM stands for mobile device management. It is software that lets you look after every company laptop, phone, and tablet from one place. Despite the name, it covers laptops as well as phones.
Each device is enrolled, which means it is signed up to your MDM service once. From then on, you can see it, set its rules, and act on it from a single dashboard, wherever the device happens to be.
It works like a building's facilities manager. Nobody has to visit each office to check the locks and the lights, because everything reports to one desk.
What it does day to day
- Sets the basics on every device. A passcode or password, a screen that locks itself, and encryption, which scrambles everything stored on the device so it is unreadable without the password.
- Keeps devices up to date. It can install security updates, the fixes software makers release when they find a weakness, and show you any device that has fallen behind.
- Installs the right apps. New starters get the tools they need without a day of setup.
- Deals with lost devices. If a laptop is left on a train, you can lock it, or erase it completely with a remote wipe, before anyone gets at what is on it.
Why a small business needs it
Lost and stolen devices. A lost laptop with no passcode and no encryption is a data breach, and under UK data protection law a breach involving personal data may need reporting to the Information Commissioner's Office. A lost laptop that is encrypted and can be wiped is an inconvenience.
People leaving. When someone leaves, MDM lets you take back company data and access in one step, rather than relying on a handover.
Cyber Essentials. Cyber Essentials is the UK government-backed scheme that shows customers you take security seriously. It covers five areas: firewalls, secure configuration, security update management, user access control, and malware protection. MDM is one of the simplest ways to set up and evidence several of them across every device at once.
What about personal phones
Many teams read work email on their own phones. This is often called BYOD, short for bring your own device. Nobody wants their employer able to see their photos or wipe their phone.
Modern MDM handles this by managing only a separate work area on the phone. Android calls this a work profile, and Apple offers a similar arrangement called User Enrolment. The business controls the work apps and data inside it, and can remove them when someone leaves. The rest of the phone stays private.
The main options
You may already pay for one.
- Microsoft Intune is included in some Microsoft 365 business plans, including Business Premium, and manages Windows, Mac, iPhone, and Android.
- Google Workspace includes device management for phones and laptops that use your Google accounts, with more controls on higher plans.
- Apple Business Manager is Apple's free service for registering company-owned Apple devices. It works alongside an MDM tool rather than replacing one.
- Dedicated tools such as ManageEngine, from the company behind Zoho, or Jamf, which specialises in Apple devices, suit businesses with more complex needs.
The right choice usually follows the email and office software you already use.
Getting started
- List your devices. Every laptop, phone, and tablet that touches company data, and who uses each one.
- Choose a tool. Start with what your existing plan includes.
- Agree the rules. Passcodes, encryption, automatic updates, and what happens when a device is lost.
- Enrol one device first. Test it on a willing colleague before rolling it out to everyone.
- Enrol the rest, then check the dashboard once a month for anything that has fallen behind.
For a team of ten, this is usually a few days of work, and then very little upkeep.
We set up device management and Cyber Essentials for small teams. If you are not sure which of your devices are protected, get in touch.
Glossary
- MDM (mobile device management): one place to control, update, and lock every company laptop and phone.
- Enrol: sign a device up to your MDM service so it can be managed.
- Encryption: scrambling the data on a device so it cannot be read without the password.
- Security update: a fix a software maker releases when it finds a weakness.
- Remote wipe: erasing a lost or stolen device from a distance.
- BYOD (bring your own device): staff using their own phones or laptops for work.
- Work profile: a separate, managed area for work apps on a personal phone.
- Cyber Essentials: the UK government-backed scheme that certifies basic security controls.