Mobile device management stopped being optional the moment staff started reading work email on personal phones. If a company mailbox sits on a device you can't wipe, you have a data protection gap, and most small businesses have one without realising.
Choosing MDM isn't complicated, but the wrong choice creates friction that staff will actively work around. Here's how to pick.
Decide what you're actually protecting
Before comparing products, answer one question: are you managing devices or data?
- Company-owned devices, you can manage the whole device: enforce encryption, control apps, wipe it entirely.
- Personal devices (BYOD), you can only reasonably manage the work data on them. Attempting full control of a personal phone gets you a staff revolt and, in some cases, a legal problem.
Most SMEs have both, which means you need a platform that handles each differently. This is the single biggest cause of failed MDM rollouts: applying device-level policy to personal phones.
The realistic options
Microsoft Intune, if you're already on Microsoft 365 Business Premium, you have it. It's included, it uses the identity you already run, and it handles Windows, iOS, Android and macOS. For most businesses we support, this is the answer, and it needs no additional licence. We set it up as part of Microsoft 365 support.
Basic Mobility and Security, the cut-down version included in lower Microsoft 365 tiers. Fine for enforcing a PIN and enabling remote wipe. Not enough if you need app protection policies or conditional access.
Third-party platforms, Jamf for Apple-heavy estates, or dedicated MDM vendors. Worth it when you have specialist requirements, a large Mac fleet, or shared/kiosk devices. Otherwise you're paying for a second identity platform alongside the one you already have.
What to check before you commit
- Does it cover every OS you run? Including Windows laptops, not just phones.
- Does it support app protection without full enrolment? This is what makes BYOD workable, you protect the work app, not the phone.
- Does it integrate with your identity provider? Conditional access that blocks non-compliant devices from Microsoft 365 is the point of the exercise.
- Can you do selective wipe? Removing company data and leaving personal photos alone.
- How does enrolment work? Automated enrolment for company devices (Apple Business Manager, Windows Autopilot) saves hours per device.
- What does the reporting look like? You need to prove compliance, not assume it.
- What's the licence model? Per device or per user, a difference that matters when people carry three devices.
The policies that actually matter
Whatever platform you choose, start with these and expand later:
- Device encryption enforced
- PIN or biometric required
- Remote and selective wipe enabled
- Blocking of jailbroken or rooted devices
- App protection: prevent copy/paste from work apps into personal ones, and block saving work files to personal storage
- Conditional access: no company data on non-compliant devices
- Automatic OS update enforcement
Resist the urge to lock everything down on day one. Over-restriction pushes people to forward mail to personal accounts, which is worse than the problem you started with.
Common mistakes
Rolling out with no communication. Staff see a management profile appear on their personal phone and assume you can read their messages. Explain what you can and cannot see, in writing, before enrolment.
Forgetting the leaver process. MDM is most valuable the day someone resigns. If wiping a leaver's device isn't part of your offboarding checklist, the platform isn't doing its job.
Treating it as separate from security. MDM is one control among several. It works alongside endpoint protection, MFA and conditional access, not instead of them. Our cyber security work treats them as one posture.
Ignoring Windows. Laptops leave the building far more often than phones and hold far more data. Modern MDM covers them; use it.
The BYOD policy you need alongside it
Technology alone doesn't settle the questions staff will ask. Write down: which devices are permitted, what the company can and cannot access, what happens when someone leaves, and who pays for what. One page is enough, but it needs to exist.
Getting it in place
For the majority of businesses we work with across Birmingham, Solihull and the West Midlands, Intune plus a sensible BYOD policy covers everything, using licences they already own. The work is in configuring it properly and rolling it out without disrupting people.
If you'd like a hand scoping it, our IT consultancy team can review your device estate and tell you what you already have available, book a call to get started.
