Back to All Cheatsheet Libraries cheatsheets

MDM Fundamentals

Vendor-neutral device-management foundations — ADE, Android Enterprise, Autopilot, enrollment types — plus a comparison of 10 MDM platforms.

Showing results

Area	Term	What it means	Why it matters
Core	MDM	Mobile Device Management — the vendor-neutral protocol an OS exposes so a server can send configuration, apps, and commands to an enrolled device.	The device trusts the MDM server because of a signed enrollment profile. Everything else is built on that trust relationship.
Core	UEM	Unified Endpoint Management — MDM plus traditional desktop management (patching, software deployment, remote control) across every OS in one console.	Mostly a marketing evolution of MDM. Treat "UEM" as "MDM that also handles laptops properly".
Core	RMM	Remote Monitoring & Management — agent-based tooling aimed at IT service providers: patching, alerting, scripting, remote access, ticketing integration.	Overlaps MDM but comes from the MSP world. NinjaOne is the RMM-first example on this list.
Core	Configuration profile	A signed payload file (`.mobileconfig` on Apple) describing settings: Wi-Fi, VPN, certificates, restrictions, accounts.	The unit of configuration. Profiles are declarative — remove the profile and the setting reverts.
Core	Compliance policy	A set of conditions a device must meet (encryption on, OS version minimum, passcode set, not jailbroken).	Only becomes powerful when wired to Conditional Access — non-compliant device loses access to company data rather than merely being flagged.
Core	Agent vs agentless	Native MDM is agentless (built into the OS). Many vendors also install an agent for scripting and inventory the protocol doesn't expose.	Agents unlock power (arbitrary scripts) but add a component that can break or fall out of date.
Enrollment	Zero-touch	Device enrolls automatically on first boot, straight out of the box, with no admin touching it. Apple ADE, Android Zero-Touch, Windows Autopilot.	The whole point of modern deployment. Ship sealed hardware directly to the employee.
Enrollment	BYOD enrollment	User-initiated enrollment of a personally-owned device, granting limited management scoped to work data only.	You cannot wipe the whole device, and shouldn't want to. Use account-driven or work-profile enrollment instead.
Enrollment	Supervision	An elevated Apple management state, automatic on ADE-enrolled devices.	Unlocks restrictions unavailable otherwise and is required for Activation Lock bypass.
Enrollment	Enrollment token / bootstrap	The credential proving a device belongs to your tenant — an ADE serial assignment, an Android enrollment token/QR, an Autopilot hardware hash.	Whoever controls this controls the device. Treat these as sensitive.
Apple	ABM / ASM	Apple Business Manager / Apple School Manager — the free Apple portal linking hardware purchases, app licences, and Managed Apple IDs to your MDM.	Prerequisite for zero-touch on Apple. Set it up before choosing an MDM.
Apple	ADE	Automated Device Enrollment, formerly DEP. Devices purchased through Apple or a linked reseller auto-enrol into your MDM.	Enrollment can be made mandatory and non-removable — the user cannot opt out.
Apple	VPP / Apps and Books	Bulk App Store licence purchasing, assignable to devices or users and reclaimable when someone leaves.	Device-based assignment needs no Apple ID on the device at all — the cleanest model for corporate hardware.
Apple	APNs certificate	Apple Push Notification service certificate that lets your MDM wake devices to check in.	Expires every 12 months. Let it lapse and every Apple device silently stops responding. Renew with the same Apple ID or you must re-enroll everything.
Apple	DDM	Declarative Device Management — devices proactively enforce a declared state and report status, rather than waiting to be polled.	Where Apple is investing. Increasingly required for reliable software-update enforcement.
Apple	Activation Lock	Ties a device to an Apple ID via Find My so it can't be erased and reused.	The top cause of unusable returned hardware. Supervised devices can be bypassed via ABM; unsupervised ones cannot.
Android	Android Enterprise	Google's modern management framework, replacing the deprecated device-admin API.	Any vendor still relying on legacy device-admin is a red flag — that API is gone.
Android	Work Profile	A cryptographically separated container on a personal device. Work apps live inside it; personal data outside is invisible to IT.	The correct BYOD answer on Android. You can wipe the profile without touching personal data.
Android	Fully Managed (Device Owner)	Company-owned device under full control from initial setup.	Requires enrollment at factory-reset state — you cannot convert an in-use personal device.
Android	Zero-Touch Enrollment	Android's equivalent of Apple ADE, via a reseller-linked portal.	Requires buying from a Zero-Touch-participating reseller — check before purchasing.
Android	Managed Google Play	A curated, IT-controlled Play Store showing only approved apps.	Handles private in-house app distribution as well as public apps.
Windows	Autopilot	Microsoft's zero-touch provisioning. Devices registered by hardware hash configure themselves on first boot.	Registration ideally happens at the OEM or reseller; manual hash collection is tedious at scale.
Windows	Entra ID join	Formerly Azure AD join. The device gets an identity in Entra ID, enabling SSO and Conditional Access.	Hybrid join (Entra + on-prem AD) is far more fragile — go cloud-native where you can.
Windows	CSP	Configuration Service Provider — the Windows equivalent of a configuration-profile payload.	When a setting has no GUI toggle in Intune, you configure the CSP directly via a custom OMA-URI policy.
Windows	Conditional Access	Entra ID policy that gates access to apps and data on device compliance, location, risk, and identity.	This is what turns compliance reporting into actual enforcement.
Ops	Smart / dynamic groups	Device groups defined by criteria (OS version, model, installed app, department) rather than a manual list.	Scoping everything to dynamic groups is the difference between a fleet that maintains itself and one you hand-curate forever.
Ops	Self Service portal	An on-device catalogue where users install approved apps and run sanctioned actions themselves.	The single biggest reducer of helpdesk tickets. Jamf Self Service and Intune Company Portal are the reference implementations.
Ops	Extension attribute / custom inventory	A script that returns a value collected into device inventory (e.g. Activation Lock status, a specific file's presence).	Lets you build smart groups on facts the protocol doesn't natively report.
Ops	Remote wipe vs retire	Wipe erases the whole device. Retire/unenroll removes only company data, profiles, and managed apps.	Wiping a BYOD device is a serious mistake with legal consequences. Know which button you're pressing.

Zero-touch, platform by platform

Apple — ADE

ABM/ASMSupervisedNon-removableVPP

Buy through Apple or a linked reseller → devices appear in ABM → assign to your MDM → they enrol on first boot. The most mature and reliable zero-touch of the three. Requires an APNs certificate renewed annually.

Android — Zero-Touch

Work ProfileDevice OwnerManaged PlayQR enrol

Requires a Zero-Touch-participating reseller. QR-code and NFC enrollment are the practical fallbacks. Choose the mode deliberately: Work Profile for BYOD, Fully Managed for corporate hardware.

Windows — Autopilot

Entra IDHardware hashESPConditional Access

Devices registered by hardware hash provision themselves against Intune. The Enrollment Status Page blocks desktop access until required apps and policies land — use it, or users get a half-configured machine.

ChromeOS — Zero-Touch

Admin consoleForced re-enrolPer-device licence

Managed entirely from the Google Admin console; no separate MDM needed. Enrollment is sticky — a wiped Chromebook re-enrolls automatically. Requires a per-device Chrome Enterprise Upgrade licence.

Linux

No native MDMAgent-based

No OS-level MDM protocol exists. Management is agent-based (Intune has limited Linux support; NinjaOne and config-management tools like Ansible cover more). Set expectations accordingly.

tvOS / visionOS / watchOS

LimitedABM

Apple TV supports MDM and is common in conference rooms and digital signage. watchOS has essentially no management surface. Check vendor support explicitly — many don't cover tvOS well.

A platform-agnostic deployment checklist

Before you buy any hardware

Set up Apple Business Manager / Android Zero-Touch / Autopilot registration first. Retrofitting existing devices is far more work than buying correctly.
Link your reseller account so future purchases flow in automatically.
Confirm your chosen MDM supports every OS you actually have — including the awkward ones (tvOS, Linux, shared iPads).

Identity before devices

Decide the identity source (Entra ID, Google Workspace, Okta) and federate Managed Apple IDs to it.
A personal Apple ID on corporate hardware is a recurring Activation Lock and data-ownership problem — block it by policy.
Plan the offboarding path at the same time as onboarding. It's the half everyone forgets.

Baseline security from the first minute

Disk encryption with the recovery key escrowed to the MDM (FileVault / BitLocker).
Passcode/password policy, screen-lock timeout, firewall on.
OS update enforcement with a real deadline — deferred-forever updates are how fleets rot.
Wire compliance to Conditional Access so non-compliance actually blocks access rather than just appearing on a dashboard.

Make it maintainable

Scope everything to dynamic/smart groups, never manual device lists.
Ship a Self Service catalogue so users solve their own app requests.
Document your profiles and scripts in version control, not only in the vendor console.
Diarise the APNs certificate renewal. Every year. It is the single most common self-inflicted MDM outage.

Showing results

Vendor	Platforms	Strongest at	Weakest at	Best fit
Jamf Pro	macOS, iOS, iPadOS, tvOS	The deepest Apple management available. Same-day OS support, huge scripting surface, mature Self Service, enormous community.	Apple only. Priciest option. Genuine complexity — needs someone who owns it.	Apple-heavy organisations with dedicated Mac admins.
Microsoft Intune	Windows, macOS, iOS, Android, some Linux	Windows and Entra ID integration, Conditional Access, and it's frequently already paid for inside M365 E3/E5.	macOS support lags Apple releases and is shallower than Apple-native tools. Console complexity is significant.	Microsoft 365 organisations, Windows-majority fleets.
Mosyle	macOS, iOS, iPadOS, tvOS	Apple-only depth at markedly lower cost than Jamf. Strong education heritage; bundles identity, endpoint security, and app hardening.	Apple only. Smaller community and fewer third-party integrations than Jamf.	Apple fleets that want Jamf-class capability on a tighter budget; schools.
SimpleMDM	macOS, iOS, iPadOS, tvOS	Genuinely simple, clean API, fast to stand up. Excellent for automation-minded small teams.	Deliberately fewer features than Jamf/Mosyle. Not aimed at large complex estates.	Small-to-mid Apple fleets, startups, API-driven workflows.
Hexnode UEM	Windows, macOS, iOS, Android, Fire OS, tvOS	Very broad OS coverage and standout kiosk/rugged-device support. Good value for genuinely mixed estates.	Not the deepest on any single platform. Support quality reports vary by tier.	Mixed fleets, kiosk/frontline deployments, retail and logistics.
Cisco Meraki SM	Windows, macOS, iOS, Android, ChromeOS	One dashboard shared with Meraki networking. Device posture can drive network access directly — a genuinely unique integration.	Endpoint management is shallower than dedicated MDMs. The value case collapses if you don't run Meraki networking.	Existing Meraki network shops wanting one pane of glass.
Miradore	Windows, macOS, iOS, Android	A genuinely usable free tier, straightforward console, low barrier to entry.	Limited advanced automation and scripting. Free tier omits most of what larger estates need.	SMBs, first-time MDM adopters, proof-of-concept work.
NinjaOne	Windows, macOS, Linux + mobile MDM	RMM-first: patching, monitoring, alerting, remote control, scripting, backup. Consistently well-rated for usability and support.	Mobile MDM is newer and less deep than Apple/Android specialists. Agent-based by nature.	MSPs and internal IT wanting endpoint monitoring and patching as the primary job.
Rippling MDM	Windows, macOS + mobile	Device management welded to HR. Hiring someone provisions their laptop, accounts, and apps; terminating them reclaims all of it automatically.	Shallower pure-MDM tooling than specialists. Real value only lands if you use Rippling for HR/payroll.	Companies already running Rippling as their HRIS.
Google Workspace for Education	ChromeOS (native), plus iOS/Android endpoint management	Unbeatable for Chromebooks — management is native to the Admin console, free with the licence, and enrollment is sticky through wipes.	Weak for macOS and Windows. Not a general-purpose MDM.	Schools running Chromebook 1:1 programmes.

The four questions that actually decide it

What's your OS mix? Apple-only → Jamf/Mosyle/SimpleMDM. Windows-majority → Intune. Genuinely mixed → Hexnode or Intune. Chromebooks → Google Admin console, full stop.
What's your identity provider? Entra ID pushes hard toward Intune. Google Workspace pushes toward Google/Apple-native. Okta is neutral.
Are you IT or an MSP? MSPs need multi-tenancy, ticketing integration, and remote control — that's RMM territory (NinjaOne), not classic MDM.
Who will own it? Jamf and Intune reward a dedicated owner and punish neglect. SimpleMDM and Miradore are survivable as a part-time responsibility.

Test with your real hardware and your real identity provider

A trial on a spare laptop with a test account proves nothing. Enrol a genuine ADE/Autopilot device federated to your actual IdP — that's where integration problems surface.

Check how fast they support new OS releases

Apple ships a major macOS/iOS release every autumn and it will break things. Ask specifically: "on the day macOS 27 ships, what's supported?" Jamf's same-day support is a large part of its price premium.

Test the API before you commit

Anything you'll do more than twice should be automatable. Read the API docs, make a few real calls, and check whether it's a genuine first-class API or an afterthought wrapped around the console.

Model the real cost, including the hidden parts

Per-device vs per-user matters enormously when people carry a laptop and a phone. Ask about the onboarding fee, support tier costs, minimum commitments, and what happens at renewal — the second-year price is the one that counts.

Ask how you'd leave

A vendor that can't answer this cleanly is telling you something. Confirm you can export inventory and configuration, and understand what migrating means for enrolled devices in practice.

Migrating between MDMs

What migration actually involves

A device can only have one MDM. Migration means unenrolling from the old and enrolling into the new — there is no in-place transfer of the management relationship.
For ADE Apple devices: reassign the serials to the new MDM server in ABM, then the devices re-enrol. Existing devices generally need a wipe or a user-driven re-enrollment to pick it up cleanly.
Removing the old MDM's profiles typically removes the settings they enforced — including Wi-Fi and certificates. Plan for devices briefly losing network access if you're not careful about ordering.
FileVault/BitLocker recovery keys escrowed in the old MDM do not migrate. Export them first, or you lose recovery capability.
VPP app licences move with ABM, not the MDM — reassign the location token to the new MDM.

A safer migration sequence

1. Export everything from the old MDM: inventory, recovery keys, profiles, scripts, group definitions.
2. Build and fully test the new MDM's configuration on a pilot group before touching anything else.
3. Migrate a friendly department first. Fix what breaks. Then go wider in waves, never all at once.
4. Keep the old MDM's tenant alive (even read-only) until the last device is confirmed migrated and healthy.
5. Only then cancel — and remember the APNs certificate must be re-established with the new vendor using the same Apple ID.

Platform documentation

Apple Platform Deployment The authoritative reference for ADE, MDM, supervision, and every enrollment type. support.apple.com Android Enterprise Work Profile, Fully Managed, Zero-Touch, and Managed Google Play documentation. developers.google.com Windows Autopilot Zero-touch provisioning for Windows, including hardware-hash registration and the ESP. learn.microsoft.com ChromeOS device management Enrollment, policies, and the Chrome Enterprise Upgrade licence model. support.google.com Apple Business Manager The portal for device assignment, Apps and Books, and Managed Apple IDs. business.apple.com Mac Admins Slack The community, with dedicated channels for Jamf, Mosyle, Intune, SimpleMDM and more. macadmins.slack.com

Vendor cheatsheets in this library

Jamf ProSmart groups, policies, Self Service, extension attributes, scripting.build.ty1er.com Microsoft IntuneEntra ID, Autopilot, compliance policies, Conditional Access.build.ty1er.com MosyleApple-only management, education and business tiers.build.ty1er.com SimpleMDMLightweight, API-first Apple device management.build.ty1er.com Hexnode UEMBroad OS coverage with strong kiosk and rugged support.build.ty1er.com Cisco Meraki SMNetwork-integrated endpoint management.build.ty1er.com MiradoreFreemium cross-platform MDM for smaller estates.build.ty1er.com NinjaOneRMM-first endpoint monitoring, patching, and management.build.ty1er.com Rippling MDMDevice management tied to the employee lifecycle.build.ty1er.com Google Workspace for EducationChromebook management, Classroom, and the Admin console.build.ty1er.com MDM for EducationShared iPad, 1:1 programmes, and FERPA/COPPA/CIPA compliance.build.ty1er.com macOS (Mac Admin tabs)Activation Lock checks, network triage, dockutil/Munki onboarding.build.ty1er.com