How to get the basics of mobile device management right the first time

What makes a good MDM product?

A good MDM product enables users to get the most out of their chosen device and platform. It should not be all things to all people, but rather a tool that brings accuracy to the complex IT infrastructure of mobile devices within the enterprise.

Jody Evans, product manager at Quest KACE, says MDM should be accessible, and preferably cloud-based to reduce a lot of the network and infrastructure issues that could occur with an on-premise system. 

“If your company has a footprint outside the main office, accessing the MDM solution from anywhere is of paramount importance,” he says.

An MDM product should be scalable enough to cope with all the devices that need managing, says Evans. “The feature set for a good MDM solution needs to be able to take into account multiple devices within its actions and not just be designed for a single-device focus.”

Lastly, it has to be secure. From a platform perspective, all data needs to be encrypted, both at rest and in transit. At the device level, restrictions should be available as part of the feature set, so that lost or stolen devices can be handled effectively, says Evans. “Enforcement of policies that can occur perpetually is desired, as opposed to setting restrictions at a single instance,” he adds.

How much can it cost?

Pricing for MDM products is typically set according to the number of devices being managed, or “per node” pricing, says Evans. 

“These prices can range from $1 to $6 per node per month, and can go even higher than that,” he says. “If MDM providers have tiered offerings, expect the node pricing to increase as you progress through their different offering levels.”

Evans points out that most MDM providers offer a free trial for their product, “so be sure to kick the tyres and use its features to see if it meets your needs”.

Evaluating the options

Some MDM providers deliver on-premise systems that require you to install and set them up, while others provide cloud-based solutions that can be accessible from anywhere. That leaves just the enrolment of devices to complete before your mobile devices can be managed.  

“Personal devices will need users to enrol their devices, while company-owned devices could be managed through their respective business channels, for example Apple DEP for Android for Work,” says Evans.

There are MDM offerings available that are dedicated solely to the Apple, Windows or Google platforms. This approach to MDM is called ecosystem management. By developing an MDM tool that supports one unique platform, such as the Apple ecosystem, it enables users to take advantage of the native features that Apple provides for users, while enabling IT to manage macOS, iOS and tvOS devices more efficiently.

Kieran O’Connor, senior regional sales manager at Jamf, says that as an alternative, there are also tools that look to manage multiple platforms with a single solution – an approach he calls unified endpoint management (UEM).

“Rather than focusing on enhancing the unique elements of each platform through MDM, UEM looks to be a one-size-fits-all tool,” says O’Connor. “While UEM enables organisations to manage multiple platforms with a single tool, it also minimises the unique features that users have come to love – and expect – from their platforms of choice.”

Implementing MDM

According to James Longworth, pre-sales consultant at Insight UK, the biggest mistake organisations make in implementing MDM is simply assuming that the default version of any system will work for them – instead of taking time to understand how it will affect users and their work.

“Down the line, this leads to frustrated workers and little reduction in risk,” says Longworth. “Instead, organisations need to take time to understand their workforce – how do they work, what devices do they already use, and what actual risks do they face? MDM should then be implemented to support the way people work, rather than hinder it. If you don’t think of the impact on the user, then any MDM implementation is doomed to failure.”

Quest KACE’s Evans says that when implementing MDM, enterprises should identify their goals and requirements. How will they use mobile devices within the work environment in the near term and in the future? Will they allow personal devices to be used, only provide company-issued devices to access company data, or have a mixture of both?

All the stakeholders should be “on the same page”, says Evans.

“This means that IT, HR, executive leadership and even regular employees need to weigh in on the policies they will implement regarding mobile device management,” he adds.

Revocation is essential, says Freeform Dynamics’ Betts, because a mobile worker might have masses of company data on his or her phone or tablet, and businesses don’t want that data going with them when they leave.

“A common way to do this kind of thing is via a sort of containerisation, where the company apps and data live in their own secure area,” he says. “Many devices have something like this built in now, for example via the Work Profile in newer Android versions. With iOS, it’s different – you use MDM to configure access to managed apps and data.”

When implementing MDM, enterprises should also consider its role in any IoT projects the organisation may have, says Betts.

“Not all IoT, or industrial IoT, devices are mobile, but they face almost all the same challenges as phones and tablets, plus a few more for good measure,” he says. “So any IoT project will need MDM or something very similar.”

To get an MDM deployment right the first time, it is absolutely critical to develop a strategic plan for deployment and implementation, says Jamf’s O’Connor. “Prepare by learning about the MDM tool – what its capabilities are and what specific elements your organisation needs,” he says. “MDM undoubtedly provides multiple benefits for both IT and end-users, but it is critical that the roll-out is well planned and executed to ensure that all benefit from it.”

Where is MDM heading?

Insight UK’s Longworth says future MDM products will put a focus on data, not applications or devices. “After all, this is where the threat to the business really lies – not from employees using unverified applications, but what data they can share or open up to vulnerabilities in the process,” he says.

As a result, he says, MDM will concentrate on preventing users accessing or sharing data that they shouldn’t, rather than locking them out of specific apps or restricting them to certain devices. “This will allow users to concentrate on doing their jobs without interruption, and IT teams to focus on the real risks to the organisation,” says Longworth.

Evans says MDM providers will need to account for PCs, IoT devices and other system management responsibilities, driving the market to a point of convergence where unified endpoint management (UEM) will be the main market of focus.

“An additional layer of emphasis that MDM providers will need is to provide solutions that help customers manage their business, not just manage their management systems,” he says, adding that this will continue over the next 12-18 months because the market shift will take the next three to five years to develop to a significant level of maturity.