What is mobile device management (MDM)? A plain-English guide

What is mobile device management? Mobile device management (MDM) is software that lets a company set up, control and secure its phones and tablets from one web console, without anyone having to hold the device. From that console an administrator can install apps, set Wi-Fi and password rules, lock a phone down to the apps the job needs, see where it is, and reset it if it goes missing.

We run Beathan MDM on more than 5,000 Android devices: rugged handsets carried by security guards, phones in logistics fleets, old Android 6 devices still working at universities, and the devices an oil and gas company's engineers take into the field. This post explains MDM from what we see on those devices every day.

Why do companies start using MDM?

Almost every client who comes to us has already handed out phones without MDM, and found out what happens next. The same four things come up again and again:

• Staff watch YouTube and browse on the company's data bundle, and the bill arrives before anyone notices.
• The device bought for the job turns into the phone used for chatting to relatives all day.
• Phones become Wi-Fi hotspots. A staff member shares the company data with colleagues who have no work device, or with the family at home. One client's employee did exactly that, and used a large amount of data before we switched on our URL filter app. It blocks any traffic leaving the device that is not on an approved list, so the hotspot stopped costing the company anything.
• Phones get lost and stolen, and without MDM there is no way to find them or wipe them.

You don't need bad staff for any of this to happen. Give someone a phone with no rules and they will use it the way they use their own.

What does MDM software actually do?

The purpose of MDM software is to do from a desk the jobs that would otherwise need someone standing next to the phone. In Beathan MDM that covers:

• Pushing an app to one phone, a group or the whole fleet, and rolling back to the previous version if an update breaks something.
• Kiosk mode, which limits a device to the apps you approve. The user cannot open anything else or change the settings, so a tablet bought for deliveries does not end up running games.
• Device settings: Wi-Fi networks, Bluetooth and GPS, password rules, screen and volume, and when Android updates may install.
• Live location on a map, plus the route for any period you pick, which you can export to a CSV file.
• Locking, rebooting or factory resetting a phone from the console.
• Seeing a device's screen to fix a problem for the user, once they approve the session on the phone.
• An inventory of every device: whether it is online, what hardware it is, which Android version and which apps it runs.

Picture forty phones on forty sites and one app that needs installing. Without MDM, someone visits forty sites. With it, it is one change in the console.

Location tracking can read like the dull item on that list. For one of our security clients it turned out to matter more than anything else on it. A guard on patrol was kidnapped, and he managed to hide his company phone behind his vest. Because the device was enrolled, it could be tracked to the place where he was being held, and he was recovered safely.

How does mobile device management work?

Mobile device management has three parts: a management server, a small agent app on each device, and the web console your administrators use.

1. Enrolment. Each device is enrolled once, in one of two ways. The quick one is a QR code: the phone is factory reset, you tap the welcome screen repeatedly until a scanner opens, and you scan the enrolment code. It takes about five minutes, and the device then downloads its configuration and installs or removes apps by itself. The other way is over a USB cable, which we use for devices that cannot take the QR route. The phone is set up normally without a Google account, USB debugging is switched on, and the MDM app is installed from a computer and made the device owner. Either way the MDM ends up in charge of the device, which is what lets it install and remove software later.
2. Check-in. From then on the device keeps in touch with the server and reports its status, including whether it is online, where it is and what is installed.
3. Policies. An administrator changes something in the console, say a new app or a new Wi-Fi network. The server sends the change to the devices it applies to, and they apply it.

The change travels to the phone instead of a person travelling to it. That is why the effort stays roughly the same at five devices or five thousand.

What does MDM mean on a work phone?

If your work phone has MDM on it, the company manages that device. It may arrive with apps already installed, only let you open certain apps, join the office Wi-Fi by itself, and be locked or reset if it is reported lost.

What your employer can see depends on how they set it up. Device details, the installed apps and location are common. In Beathan MDM, nobody can view your screen remotely until you approve it on the phone. Your IT team can tell you exactly what is switched on for your device.

Who needs mobile device management?

MDM starts to pay for itself when the devices belong to the company and the people using them are somewhere other than the IT office. Our own client list shows the pattern: guards on sites across the country, drivers and depots in logistics, engineers on oil and gas sites, and shared devices at universities that pass from hand to hand. Customer-facing tablets for check-in or ordering, which should only ever show one app, fit too.

It also suits companies that look after devices for other companies. Beathan MDM is multi-tenant, so one provider can run several customers side by side, each with its own profile, app store and users.

A business with three phones in one office can probably live without it. The case gets stronger with every device that lives somewhere you are not.

MDM, MAM and EMM: what is the difference?

MDM manages the whole device, from its settings and apps to its location, and can lock or wipe it. MAM (mobile app management) manages only the work apps and their data and leaves the rest of the phone alone, which is why it tends to be used on staff's personal phones. EMM (enterprise mobility management) is the umbrella name vendors use for the two together, plus related tools.

For company-owned devices, especially ones locked to a single job, MDM is the usual choice.

What should you look for in MDM software?

Start with the devices you already own. Beathan MDM runs on Android from 4.4 (KitKat) to Android 15, which is why those Android 6 devices at universities are still managed instead of thrown away. Then check that it does the jobs listed above, particularly kiosk mode, app rollback, location history, remote reset, and remote support that asks the user first.

Look at white labelling if you hand devices to customers. Beathan MDM can put your logo on the background and rename apps with your own names and icons. And ask what the price includes. With Beathan MDM it covers onboarding, enrolling your devices, setting up your app store and user roles, ongoing training, and support by phone, email and service desk.

Where to go next

If you run a fleet of Android phones or tablets and want to see this on your own devices, read about Android device management with Beathan MDM or tell us about your fleet.