In short
Mobile device management (MDM) software lets a business enrol company phones and tablets, apply security policies, deploy apps, keep work and personal data apart, and lock or wipe lost devices from one console. Common options include Microsoft Intune, Sophos Mobile, IBM MaaS360, Apple Business's built-in management and Samsung Knox Manage, alongside enrolment and management services from the networks.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What MDM software does
Every MDM product is built around the same core jobs:
- Enrolment. Bring phones under management, ideally automatically the first time they are switched on.
- Policies. Enforce a screen lock, encryption, a minimum operating system version and restrictions such as blocking unapproved apps.
- Apps and settings. Install and update work apps, and push email, Wi-Fi and VPN settings so staff do not have to set them up.
- Work and personal separation. Keep company apps and data apart from personal ones, which is what makes BYOD workable.
- Compliance. Spot phones that fall out of line, such as a missing update or a removed passcode, and act automatically.
- Lost, stolen and leavers. Locate, lock or wipe a device, or remove only company data from a personal phone.
For a small business, MDM is mostly about the last point: making sure a lost phone or a leaver does not take company data with them. For a larger fleet, the time saved on setting up and updating phones matters just as much. Forever Group runs a separate guide to the mobile device management service; this page compares the software.
MDM, UEM and mobile threat defence
You will see three overlapping terms:
- MDM (mobile device management) originally meant managing phones and tablets.
- UEM (unified endpoint management) means managing phones, tablets and computers from one console. Most of today's MDM products are really UEM products.
- MTD (mobile threat defence) is security software on the phone that detects phishing links, malicious apps, risky networks and compromised devices. It does not manage the phone; it tells your MDM when a device is at risk so access can be restricted.
Most businesses need MDM. Those with sensitive data, or staff who are likely targets for phishing by text and messaging apps, add MTD on top.
MDM software compared
The table compares the main device management tools for company phones by what they are, the platforms they cover and how they are licensed. It is not a ranking: the right tool depends on what you already use.
| Tool | What it is | Platforms | Licensing | Through Forever Group |
|---|---|---|---|---|
| Microsoft Intune | Microsoft's cloud endpoint management service | Android, iOS/iPadOS, macOS, Windows, Linux, ChromeOS | Microsoft licensing | See our Microsoft Intune page |
| Sophos Mobile | MDM and mobile threat defence in the Sophos console | Android, iPhone, iPad, Mac and Windows; threat protection also on ChromeOS | Per user, with any number of devices | We can supply licences |
| IBM MaaS360 | Cloud unified endpoint management in three editions | iOS, iPadOS, Android, Windows, macOS | Per managed device | We can supply licences |
| Apple Business built-in device management | Apple's own management, built into Apple Business | Apple devices | Part of Apple Business; check Apple's terms | We can help set it up |
| Samsung Knox Manage | Samsung's cloud device management, part of Knox Suite | Cross-platform, optimised for Samsung devices | Samsung licensing | We can help with Knox enrolment |
A few notes on each:
- Microsoft Intune is often the first option to look at for businesses already on Microsoft 365; our Forever Group page covers it in detail.
- Sophos Mobile comes as Mobile Device Management, Mobile Threat Defense, or Sophos Mobile with both. Its per-user licence covers a phone, tablet and laptop for one person. See Sophos Mobile licensing and our Sophos Mobile guide.
- IBM MaaS360 comes as Essentials, Deluxe and Enterprise, each including the one below. Its selective wipe removes corporate apps, email and settings while preserving personal data. See IBM MaaS360 licensing.
- Apple Business includes built-in device management with Blueprints for Apple devices, and can also link to a third-party MDM. See Apple Business Manager, now Apple Business.
- Samsung Knox Manage is Samsung's cross-platform device management, optimised for Samsung devices; separately, Knox Mobile Enrollment can feed Samsung devices into whichever MDM you already use.
Licensing per user or per device makes a real difference to cost when people carry more than one device; our sister site explains per-user vs per-device licensing.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Adding mobile threat defence
If you want protection against phishing texts, malicious apps and risky Wi-Fi on top of management, these mobile threat defence products work alongside your MDM:
- Lookout Mobile Endpoint Security, now marketed as Lookout Mobile AI Security, protects iOS, Android and ChromeOS devices against phishing, malicious apps, device compromise and network attacks, and passes each device's risk level to your MDM. See Lookout Mobile Endpoint Security licensing and Lookout mobile security.
- Check Point Harmony Mobile, which Check Point now calls Check Point Mobile Security, detects malicious apps, network attacks, phishing and risky device settings on iOS and Android, and works with your MDM. See Check Point Harmony Mobile.
- Sophos Mobile Threat Defense, available on its own or within Sophos Mobile.
For every device management and mobile security product we supply, including CrowdStrike Falcon for Mobile, ThreatDown, Bitdefender, Trend Micro and WatchGuard, see mobile device management and mobile security and mobile security software licensing.
Device management from the networks
The networks also offer device management and security services with their business lines. Each describes its own:
- EE Business offers device enrolment and management using tools from vendors including Jamf and Samsung. It can enrol devices into Apple Business Manager, Android zero-touch enrolment or Samsung Knox Mobile Enrollment so that they appear automatically in your MDM, and lists mobile threat defence and device lifecycle management among its services. See Jamf with EE Business and Ivanti with EE Business.
- Three Business offers Three Device Management, a cloud device management service for businesses with more than 25 devices, powered by Ivanti, covering iOS and Android. For up to 25 devices, Three Mobile Protect helps protect against phishing and malware with data caps and app controls. See Three Business security and device services.
- O2 Business offers mobile device management that you can run yourself or have O2 Business manage. See O2 Business.
- Vodafone Business offers security add-ons with its business plans. See Vodafone Business.
A network's service is a simple route when all your phones are on that network, and a separate MDM suits businesses that use more than one network, manage laptops as well as phones, or already run Microsoft Intune or another product. We supply both, and help you decide.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
How to choose MDM software
Work through these questions before you pick a product:
- What do you already use? If your business runs on Microsoft 365, Intune is usually the first option to look at. If you already use Sophos for endpoint protection, Sophos Mobile shares its console.
- Which devices? iPhone only, Android only or both, and whether you also want to manage laptops and tablets from the same place.
- How many, and how counted? Per-user licensing suits people with several devices; per-device licensing suits shared or single-purpose devices.
- Company-owned, BYOD or both? Check how each tool separates work and personal data and what it can see on a personal phone.
- Enrolment. Make sure the tool supports the zero-touch programmes you plan to use: Apple automated device enrolment, Samsung Knox Mobile Enrollment and Android zero-touch enrolment.
- Security needs. Decide whether you need mobile threat defence as well, and whether the product includes it or integrates with one.
- Who will run it? Some tools suit an in-house IT team; others are simpler for a small business with no IT staff.
Choose before you roll phones out. Apple notes that changing device management service part-way through a deployment may mean erasing each device and enrolling it again. Apple also suggests trialling a shortlist with a few test devices first, which is good advice for any MDM.
Getting phones into your MDM
Buying the software is the easy part. The work is in getting every phone enrolled and keeping it there.
- New company phones are best enrolled automatically, so they configure themselves the first time they are switched on. See zero-touch enrolment.
- iPhones go through Apple Business, which links to your MDM. See Apple Business Manager.
- Phones you already own can usually be enrolled manually, or added to Apple Business with Apple Configurator, or to Knox Mobile Enrollment with a QR code.
- Personal phones use a lighter enrolment (a work profile on Android, user enrolment on iPhone) so only work data is managed.
When you buy phones for your business, we can help register them for automatic enrolment where the supplier and device support it, so they reach staff ready to use.
How Forever Communications helps
We supply the business mobile lines, and through Forever Group the software to manage the phones, so we can look at the whole picture rather than one piece of it. We can:
- Talk through your phones, tablets and laptops, your current tools and how you want to handle BYOD
- Help you choose between a network's own service and a separate MDM, and between MDM products
- Quote for Sophos Mobile, IBM MaaS360 and mobile threat defence licences, and point you to our Microsoft Intune guidance
- Help set up Apple Business, Knox Mobile Enrollment and zero-touch enrolment so new phones arrive enrolled
- Quote for business mobile lines on the network that suits you
Prices depend on the product, edition and number of users or devices, so ask us for a quote. Contact us to talk about managing your company phones.
More on device management
How Forever Communications helps with business mobile
We help UK organisations choose, set up and run business mobile: plans, SIMs and eSIMs, phones, mobile broadband, 5G and the device management that keeps a fleet under control.
- Start with what you have: we look at your current contracts, end dates, users and devices before suggesting anything new
- Four networks, one conversation: we supply EE Business and Three Business, and can also supply O2 Business and Vodafone Business, so you can choose the network that works where your people work
- Airtime first, devices your way: we focus on getting your airtime costs down, so you can buy iPhone, Samsung Galaxy and other devices separately and set them up to enrol in your mobile device management
- Moving without losing numbers: we help you plan the switch and keep your existing business mobile numbers
- Beyond the phone: 5G for business, mobile broadband and data SIMs for sites, vehicles and backup connections
- Device management and mobile security: MDM and mobile threat defence from vendors such as IBM, Sophos, Check Point, CrowdStrike and Lookout, plus Jamf, Ivanti, Microsoft Teams Phone Mobile and Mobile Voice Recording with EE Business; see mobile device management and security
Forever Communications is part of Forever Group. Ask us for a quote and we will set out the plans and services that fit your team.
Frequently asked questions
What is the best mobile device management software?
There is no single best product. Microsoft Intune often suits businesses already on Microsoft 365, Sophos Mobile suits businesses using Sophos for other security, IBM MaaS360 suits mixed fleets that want per-device licensing, and Apple Business's built-in management suits Apple-only fleets. The right choice depends on your devices, existing tools and who will run it.
Is MDM the same as mobile threat defence?
No. MDM manages the phone: enrolment, settings, apps and wiping. Mobile threat defence is security software on the phone that detects phishing, malicious apps and risky networks, and tells your MDM when a device is at risk. Many businesses use both.
Can MDM see employees' personal data?
On a company-owned phone, MDM can see device information such as the model, operating system and installed apps, depending on the product and settings. On a personal phone enrolled with a work profile or user enrolment, the business manages only work apps and data. Tell staff clearly what the business can see in your company mobile phone policy.
Do I need MDM for a small number of company phones?
It is worth having even for a few phones, mainly so you can lock or wipe a lost phone and remove company data when someone leaves. Smaller fleets can use lighter options, such as Apple Business's built-in management for iPhones or a network's own service.
Can I use my own MDM with phones on a network's business plans?
Yes. Your MDM works whichever network the phones use, and networks such as EE Business can also register devices for automatic enrolment through Apple Business, Samsung Knox Mobile Enrollment or Android zero-touch enrolment, which then hand them to the MDM you choose. See zero-touch enrolment.
Still have a question about mobile device management software?
Ask us and a member of our team will reply by email.
