Back to All Cheatsheet Libraries cheatsheets

Miradore

Cross-platform MDM with a genuinely usable free tier — the low-friction way to establish device visibility from zero.

Concept	What it is	Notes
Device	An enrolled endpoint — Windows, macOS, iOS/iPadOS, or Android.	Inventory collection is solid across all four, and is available on the free tier.
Business Policy	A rule set applied automatically to devices matching criteria — the main automation mechanism.	Paid feature. This is the difference between managing devices and just watching them.
Configuration Profile	Settings payloads — Wi-Fi, VPN, passcode, restrictions, certificates.	Standard per-platform payloads; the depth is adequate rather than exhaustive.
Application management	Deploy and remove apps, including VPP and Managed Google Play integration.	Works well for store apps; custom packaging is more limited than Intune or Jamf.
Enrollment	ADE for Apple, Android Enterprise, Windows enrollment, plus email/link enrollment.	Covers the zero-touch paths, though setup is more manual than the specialists.
Reporting	Inventory, compliance, and hardware/software reports.	Genuinely good for the price point, and a common reason organisations adopt it initially.
Security actions	Lock, wipe, reset passcode, locate.	Available even on the free tier — the baseline capability most organisations need first.

Capability	Free tier	Paid tiers
Device inventory	✔ Unlimited devices	✔
Basic security actions (lock/wipe)	✔	✔
Configuration profiles	Limited	✔ Full
Business Policies (automation)	—	✔ The main upgrade reason
Application deployment	Limited	✔
Encryption management	—	✔ BitLocker / FileVault key escrow
Patch management	—	✔
Support	Community / docs	✔ Vendor support

Miradore fits when…

You currently have no device management at all and need to establish visibility quickly.
You're an SMB where per-device pricing on the specialists is hard to justify.
You need a proof of concept to demonstrate value before requesting budget.
Inventory and reporting are the immediate requirement; deep configuration can come later.

Look elsewhere when…

You need deep platform-specific control — Jamf or Mosyle for Apple, Intune for Windows.
Conditional Access or identity-driven enforcement is a requirement.
You need extensive scripting and custom automation.
Kiosk or rugged-device management is central — Hexnode is much stronger there.

Free tiers are a business decision, not a guarantee

Free tiers get restructured, reduced, or withdrawn — this has happened across the industry repeatedly.
Don't architect a critical dependency on free-tier capability without a migration plan.
Export inventory periodically so you're never locked in by data you can't retrieve.
Verify current tier boundaries directly with the vendor; documentation and third-party comparisons go stale fast.

Apple certificate expiries apply regardless of tier

The APNs push certificate expires every 12 months. Renew with the same Apple ID or re-enroll every Apple device.
ABM/ADE and VPP tokens expire annually as well.
A free tier doesn't exempt you from Apple's rules — this catches people who assumed lower commitment meant lower maintenance.

Android enrollment mode is still a one-way decision

Fully Managed (Device Owner) mode requires enrolling from a factory-reset state. You cannot convert a Work Profile device later.
Decide Work Profile vs Fully Managed before handing out hardware.

Plan the upgrade path early

Starting on Miradore is reasonable; growing out of it is common and expected.
Migrating MDM means unenrolling and re-enrolling every device — see MDM Fundamentals for the safer sequence.
Export encryption recovery keys before migrating. They don't transfer between MDMs, and losing them means losing recovery capability.