A sales manager leaves her phone in a taxi. It holds a year of customer email, the CRM app and a saved VPN profile. Whether that becomes a minor inconvenience or a reportable breach depends on what the company enforced before the phone was lost: a passcode, encryption, and the ability to erase company data remotely.
Mobile device management (MDM) is how organizations enforce those controls across hundreds or thousands of phones and tablets. On the CompTIA Security+ SY0-801 exam it sits under objective 4.1, which expects you to apply mitigating controls in a scenario. This lesson covers how devices are enrolled, the policies MDM enforces, how it handles jailbroken and rooted devices, how containerization and mobile application management (MAM) protect data on devices the company doesn't own, full versus selective wipe, and how BYOD and corporate-owned deployments differ.
MDM gives the organization one console to enforce policy on every mobile device
An MDM platform has three parts. The management server, usually a cloud service such as Microsoft Intune or Jamf, is where administrators define policies. The device's built-in management framework carries them out: Apple's MDM protocol on iPhone, iPad and Mac, and the Android Enterprise APIs on Android, sometimes with a companion agent app. A push notification service tells devices to check in for new commands.
Through that channel the server can push configuration such as Wi-Fi, email and VPN profiles with their certificates; enforce restrictions; install and remove managed apps; read device state such as OS version, encryption status and jailbreak indicators; and send commands to lock, locate or wipe.
Many products now manage laptops and desktops from the same console under the name unified endpoint management (UEM). The exam's term is MDM, and the controls are the same.
MDM also feeds access decisions. The platform marks each device compliant or noncompliant against policy, and the identity provider can require a compliant device before granting access to email and business apps, a setup usually called conditional access. That link is what turns MDM settings into enforcement: a device that falls out of compliance loses access until it's fixed.
Enrollment decides how much control the organization gets
A device has to be enrolled before MDM can manage it, and the enrollment method sets how much control the organization has.
Corporate-owned devices normally use automated enrollment. Apple's Automated Device Enrollment, run through Apple Business Manager, and Android zero-touch enrollment register devices to the organization at purchase. When a new phone is switched on and reaches the internet, it enrolls itself during setup, before the user ever sees a home screen. Apple devices enrolled this way can be supervised, which unlocks the strictest restrictions, and the management profile can be made non-removable. A factory reset doesn't escape it either; the device enrolls again at the next setup, which also makes a stolen corporate phone hard to resell.
Personally owned devices use enrollment the user starts, and it's deliberately limited. The user installs a company portal app or signs in with a work account. Apple's User Enrollment and Android's work profile each create a separate managed space on the device, which the organization can manage without seeing the user's personal apps, photos or messages, and without the ability to wipe the whole device.
Enrollment is also when users should accept the acceptable use and BYOD policies, so they know what the company can and can't see and do.