Organizations with highly mobile workforces should consider using a Mobile Device Management (MDM) platform to manage and control company endpoints.
Control Type: Technical
Control Function: Preventive
In previous documentation, workgroups and active directory domains were mentioned as common ways to manage endpoint devices in an organization. In the 2020s, more organizations are moving towards mobile first, decentralized digital environments. Rather than big desktops that reside inside the organization’s facilities, employees are starting to use lightweight laptops and docking stations so that they can transfer between an in-office setup, home use, and on the road work. To manage devices that are not always resident on an organization’s local network, a new technology has emerged called Mobile Device Management, commonly abbreviated as MDM.
Mobile Device Management (MDM) provides a way for organizations to continue asserting control over mobile devices even when they leave the office. MDM is provided to organizations via the cloud and is similar in concept to a domain, but with more flexibility. Mobile devices are enrolled in the business MDM platform and attached to the primary user’s digital identity, which has been connected to the MDM platform. A common example of this is Microsoft Entra ID combined with Microsoft Intune, both being cloud services under the same Microsoft umbrella. Employee identities are configured in Entra ID and are usually used for a variety of business services like email and Software as a Service (SaaS) applications. Intune is Microsoft’s MDM offering, and it allows the administrators of the Entra ID domain to create profiles for company devices. These profiles can be configured with extremely granular settings and configurations in the same way as Group Policy on local domains. Once company devices are enrolled under an Intune profile, employees sign in with their Entra ID accounts to access the operating system. Since MDM platforms are cloud-based, devices can connect and provide organization-controlled functionality regardless of the network being used.
There are multiple other MDM platforms besides Intune, each one leaning towards a specific device vendor. JAMF is an MDM platform for Apple devices, including macOS, IOS, and iPadOS. If an organization has an Apple-centric environment, then it will probably want to use JAMF or Mosyle. Apple Configurator is a more basic Apple device configuration software, allowing MDM profiles to be created and pushed out to devices on which employees can log in with their company AppleIDs. Some MDM solutions have increased convenience stemming from cross-platform support. For example, InTune allows organizations to enroll not just Windows devices, but also Android, IOS, iPadOS, and Ubuntu Linux. This makes it an attractive option for businesses with a mix of different operating systems in their environments.
One devices are enrolled under MDM, IT administrators can manage, monitor, and configure the devices on a very granular level. Administration of an MDM system is done through the solution’s administrative center on the web. Applications, security settings, customizations, scripts, and support services can all be performed on devices by admins, regardless of where the devices are. This is where the true power of MDM shines in modern work environments.
Organizations do not have to fully embrace a strict MDM environment. Microsoft offers a hybrid infrastructure solution where on-premises Active Directory domains can be combined with Entra ID. Identities are federated between the two platforms, allowing employees to log in with a single set of credentials on both solutions, making it appear to them as if they are using a single platform. This is an attractive solution for organizations that want to keep their on-premises infrastructure while also allowing for increased device mobility.
Implementing an MDM solution requires proper preparation, as it can be a complex piece of technology to implement without an already established cloud presence. A risk assessment and cost-benefit analysis should be conducted to determine the viability of MDM. If an organization does decide to embrace MDM, it must ensure that it is properly implemented, either by skilled IT staff or a third party IT consultant if necessary.
