Managing company laptops and phones (MDM basics)

Every laptop and phone that opens company email or files is a door into your business. When you have three people, you can check those doors yourself. When you have fifteen, some on personal phones and some working from home, you need a way to see and control them centrally. That's what mobile device management (MDM) does.

This guide covers the company side. For the habits each person should follow on their own devices, see device and Wi-Fi security basics.

What MDM actually does

The specific features depend on the product and plan, but most MDM tools let you:

Enforce security settings: screen lock and passcode, disk encryption, automatic updates, firewall
See an inventory: which devices access company accounts, who uses them, and whether they meet your rules
Block non-compliant devices: for example, refuse email access from a phone with no passcode
Install and remove apps on company-owned devices
Wipe remotely: erase the whole device (company-owned) or only the company data and apps (personal)
Set up new devices automatically: a new laptop can arrive at someone's home and configure itself when they sign in

Company-owned versus personal devices

This is the decision that shapes everything else.

✓

Company-owned devices

These can be fully managed. You control the settings, the apps, and you can wipe the whole device when someone leaves. This is the simpler, safer option for anyone handling sensitive data.

Personal devices (BYOD)

"Bring your own device" needs a lighter touch. You manage the work account and work apps, not the person's photos and messages. Both Apple and Android support this separation:

On Android, a work profile keeps work apps in a separate container.
On iPhone and iPad, Apple offers User Enrollment for personal devices, which limits what the organization can see and manage.

Tell staff what you can see

Before asking anyone to enroll a personal phone, explain in writing what the company can see and do (for example: see the device model and OS version, require a passcode, wipe work data) and what it can't (for example: read personal messages or see personal photos). Check the specific product's documentation so you describe it accurately. Trust matters more than any single setting.

Your main options

Help me choose

Where should you start?

Do you buy and ship laptops to staff regularly?

Start with what you already pay for

Google Workspace includes endpoint management. The basic level is on by default for mobile devices and lets you see devices and remove a departed user's account from them. More advanced controls depend on your Workspace edition. See managing company devices in Google Workspace.
Microsoft 365 business plans vary. Some include Microsoft Intune, Microsoft's device management service, and some don't. Check the current plan comparison before you buy anything extra.

When you have Macs or iPhones

Apple Business Manager is a free Apple service that links company-purchased Apple devices to your organization, so they enroll in your MDM automatically. Buying through Apple or an authorized reseller that supports it makes this much easier. Apple also offers Apple Business Essentials in some countries as a combined device management subscription; check current availability.

Dedicated MDM tools

As fleets grow, companies often move to a dedicated tool. Common names include Microsoft Intune, Jamf (Apple-focused), Kandji, and JumpCloud. They differ a lot in features and pricing models, so compare them on your actual device mix.

A starting baseline

Whatever tool you use, aim for this on every device that touches company data:

Screen lock with a passcode, PIN, or biometric, and a short auto-lock time
Disk encryption turned on (FileVault on Mac, BitLocker or Device Encryption on Windows, on by default on modern phones with a passcode)
Automatic updates for the operating system and browser
Find My / remote locate enabled on company-owned devices
No shared logins on the device; each person has their own user account
Company data wiped when the device is lost, sold, or its user leaves

Rolling it out

Inventory your devices. List every laptop and phone used for work, who uses it, and whether the company or the person owns it.

Decide your rules. Write them into your security policy, including what happens with personal devices.

Turn on what your suite already includes, starting with company-owned devices.

Enroll personal devices after explaining what you'll manage. Start with the people who handle the most sensitive data.

Test a remote wipe on a spare or test device, so you know it works before you need it.

Add it to onboarding and offboarding. New devices enroll on day one. Departing staff return devices, or their work data is wiped. See security steps when someone leaves.

Common mistakes

Managing laptops but not phones. Phones often have full access to email and files.
Wiping a personal device fully. Use selective (work-data-only) wipe for personal devices unless the person has agreed otherwise.
Buying devices on personal accounts. A laptop bought on someone's personal Apple ID or retail account is harder to bring under company control later.
Never checking the compliance report. MDM shows you which devices fail your rules. Look at it monthly.

Frequently asked questions

Can MDM read my staff's personal messages?

Not under a properly configured work-profile or User Enrollment setup. These are designed to separate work data from personal data. The exact visibility depends on the product and enrollment type, so check its documentation and share that with staff.

Is MDM worth it for a team of five?

Turning on the basic management your email suite already includes is worth it at any size, because it lets you remove company data from a lost phone. Dedicated MDM usually makes sense once you're buying and shipping laptops regularly.

Do we need antivirus as well?

Modern operating systems include built-in protection, which is a reasonable baseline for many small companies. Some insurers and clients ask about endpoint detection and response (EDR) tools. See cyber insurance.