{"id":99,"date":"2026-10-23T21:07:44","date_gmt":"2026-10-23T19:07:44","guid":{"rendered":"https:\/\/theitlead.com\/blog\/?p=99"},"modified":"2026-10-23T21:07:44","modified_gmt":"2026-10-23T19:07:44","slug":"mobile-device-management-software","status":"publish","type":"post","link":"https:\/\/theitlead.com\/blog\/mobile-device-management-software\/","title":{"rendered":"Best Mobile Device Management Software for Small IT Teams"},"content":{"rendered":"\n<div class=\"ok-byline\"><div class=\"ok-who\"><span class=\"ok-avatar\" aria-hidden=\"true\">MB<\/span><div><strong>Reviewed by Max Benz<\/strong><span>Updated <time datetime=\"2026-10-18\">October 18, 2026<\/time> \u00b7 30 min read<\/span><\/div><\/div><ul class=ok-chips><li class=\"ok-chip ok-chip--ok\">Prices read on vendor pages, October 18, 2026<\/li><li class=\"ok-chip ok-chip--ok\">Ratings from Capterra (G2 blocked automated access)<\/li><li class=\"ok-chip ok-chip--ok\">No sponsored placements in this comparison<\/li><\/ul><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Mobile device management (MDM) software lets IT teams enroll phones, tablets and laptops, push settings and apps to them, enforce security rules and wipe them remotely from one console. For a small IT team the right pick depends less on the feature list than on the fleet: Apple only, a Microsoft 365 shop, or a mix of Windows, Android and Apple. This page compares nine MDM tools on platforms, price status, enrollment path and what it takes to run each one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Six of the nine publish a price on their own site. Three are quote only, and the tables below say so instead of guessing, which is more useful than a made-up number. Two tools have a free plan, and a third offers a free tier for three devices.<\/p>\n\n\n\n<nav class=\"ok-toc\" aria-label=\"On this page\"><p class=\"ok-toc__h\">On this page<\/p><ol><li><a href=\"#our-picks-by-fleet-type\">Our picks by fleet type<\/a><\/li><li><a href=\"#mdm-software-compared\">MDM software compared<\/a><\/li><li><a href=\"#what-mobile-device-management-software-does\">What mobile device management software does<\/a><\/li><li><a href=\"#how-a-device-gets-enrolled\">How a device gets enrolled<\/a><\/li><li><a href=\"#how-we-chose-these-tools\">How we chose these tools<\/a><\/li><li><a href=\"#best-mdm-software-for-apple-fleets\">Best MDM software for Apple fleets<\/a><\/li><li><a href=\"#best-mdm-software-for-microsoft-365-shops\">Best MDM software for Microsoft 365 shops<\/a><\/li><li><a href=\"#best-mdm-software-for-mixed-fleets\">Best MDM software for mixed fleets<\/a><\/li><li><a href=\"#best-mdm-software-when-you-already-run-a-directory-or-an-rmm\">Best MDM software when you already run a directory or an RMM<\/a><\/li><li><a href=\"#what-mdm-software-costs-and-what-is-free\">What MDM software costs and what is free<\/a><\/li><li><a href=\"#how-to-remove-mdm-from-a-device\">How to remove MDM from a device<\/a><\/li><li><a href=\"#what-mdm-leaves-open-who-owns-the-accounts-behind-it\">What MDM leaves open: who owns the accounts behind it<\/a><\/li><li><a href=\"#which-tool-to-pick\">Which tool to pick<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ol><\/nav>\n\n\n\n<dl class=\"ok-stats ok-wide\"><div class=\"ok-stat\"><dt>MDM tools compared<\/dt><dd>9<\/dd><\/div><div class=\"ok-stat\"><dt>publish a price on their own site<\/dt><dd>6<\/dd><\/div><div class=\"ok-stat\"><dt>have a free tier<\/dt><dd>3<\/dd><\/div><div class=\"ok-stat\"><dt>lowest published price per device per month, Apple devices only<\/dt><dd>$1<\/dd><\/div><\/dl>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"our-picks-by-fleet-type\">Our picks by fleet type<\/h2>\n\n\n\n<ul class=\"ok-picks ok-wide\"><li class=\"ok-pick\"><a href=\"#microsoft-intune\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/intune.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if you already pay for Microsoft 365 Business Premium or E3<\/span><span class=\"ok-pick__name\">Microsoft Intune<\/span><span class=\"ok-pick__text\">Plan 1 is already in those licenses, and Windows Autopilot, Conditional Access and phones sit in one console.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 Capterra<\/span><span class=\"ok-chip\">$8\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#mosyle-business\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/mosyle.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best low-cost choice for an Apple-only fleet<\/span><span class=\"ok-pick__name\">Mosyle Business<\/span><span class=\"ok-pick__text\">Free for up to 30 devices, then $1 per device per month on an annual plan.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 Capterra<\/span><span class=\"ok-chip\">Free to 30, then $1\/device\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#jamf-pro\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jamf.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for deep Apple control<\/span><span class=\"ok-pick__name\">Jamf Pro<\/span><span class=\"ok-pick__text\">Smart Groups and PreStage enrollments reward an admin who will learn them, and the price is on request.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.7 Capterra<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#iru-formerly-kandji\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/iru.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best Apple-first option with fast setup<\/span><span class=\"ok-pick__name\">Iru (formerly Kandji)<\/span><span class=\"ok-pick__text\">Kandji, renamed Iru in October 2025, builds everything around Blueprints and patches apps automatically.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.9 Capterra<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#hexnode-uem\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/hexnode.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best mixed fleet with published prices<\/span><span class=\"ok-pick__name\">Hexnode UEM<\/span><span class=\"ok-pick__text\">Apple, Android, Windows and Linux from $2.2 per device per month, with a 14 day trial.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 Capterra<\/span><span class=\"ok-chip\">From $2.2\/device\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#scalefusion\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/scalefusion.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for kiosks and rugged devices<\/span><span class=\"ok-pick__name\">Scalefusion<\/span><span class=\"ok-pick__text\">Single-app and multi-app kiosk mode on Android and iPad from the entry tier.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.8 Capterra<\/span><span class=\"ok-chip\">From $2\/device\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#manageengine-mobile-device-manager-plus\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/manageengine-mdm.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if you want to host it yourself<\/span><span class=\"ok-pick__name\">ManageEngine Mobile Device Manager Plus<\/span><span class=\"ok-pick__text\">Runs in the cloud or on your own server, with a free tier for 25 devices.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 Capterra<\/span><span class=\"ok-chip\">Free to 25, then from $645\/yr<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#jumpcloud\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if you want a directory and MDM from one vendor<\/span><span class=\"ok-pick__name\">JumpCloud<\/span><span class=\"ok-pick__text\">Priced per user at $9 a month, with MDM available alone at $5.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">From $9\/user\/mo annually<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#ninjaone\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/ninjaone.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for MSPs that already run NinjaOne<\/span><span class=\"ok-pick__name\">NinjaOne<\/span><span class=\"ok-pick__text\">Phones and tablets join the endpoint console, but the mobile price isn't published.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.7 Capterra<\/span><span class=\"ok-chip\">Quote based<\/span><\/span><\/a><\/li><li class=\"ok-pick ok-pick--ours\"><a href=\"#the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Our product \u00b7 for the gap MDM leaves<\/span><span class=\"ok-pick__name\">The IT Lead<\/span><span class=\"ok-pick__text\">Records who owns each service account behind your tools. It doesn't manage devices.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\">Access code<\/span><\/span><\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"mdm-software-compared\">MDM software compared<\/h2>\n\n\n\n<div class=\"ok-compare ok-wide\" data-filter=\"1\"><div class=\"ok-scroll\"><table><thead><tr><th scope=\"col\">Tool<\/th><th scope=\"col\">Type<\/th><th scope=\"col\">Platforms<\/th><th scope=\"col\">Price as published (USD)<\/th><th scope=\"col\" data-sort=num>Rating<\/th><\/tr><\/thead><tbody><tr data-cat=\"Cloud MDM from Microsoft\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/intune.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Microsoft Intune<\/span><\/th><td><span class=\"ok-job\">Cloud MDM from Microsoft<\/span><\/td><td class=\"ok-muted\">Windows, macOS, iPhone, iPad, Android and Linux through Entra ID<\/td><td>$8 per user per month for Plan 1; included in Microsoft 365 Business Premium and E3<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(Capterra, 42)<\/span><\/td><\/tr><tr data-cat=\"Apple-only MDM\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jamf.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Jamf Pro<\/span><\/th><td><span class=\"ok-job\">Apple-only MDM<\/span><\/td><td class=\"ok-muted\">Mac, iPhone, iPad and Apple TV with zero-touch enrollment<\/td><td>Quote only; Jamf Now is free for up to 3 devices<\/td><td data-v=\"4.7\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7 <span class=\"ok-muted\">(Capterra, 547)<\/span><\/td><\/tr><tr data-cat=\"Apple-first MDM\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/iru.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Iru (formerly Kandji)<\/span><\/th><td><span class=\"ok-job\">Apple-first MDM<\/span><\/td><td class=\"ok-muted\">Mac, iPhone and iPad with Blueprints, plus newer Windows and Android support<\/td><td>Quote only, annual contract<\/td><td data-v=\"4.9\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.9 <span class=\"ok-muted\">(Capterra, 500)<\/span><\/td><\/tr><tr data-cat=\"Apple-only MDM\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/mosyle.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Mosyle Business<\/span><\/th><td><span class=\"ok-job\">Apple-only MDM<\/span><\/td><td class=\"ok-muted\">Mac, iPhone, iPad, Apple TV and Vision Pro, with a free tier<\/td><td>Free for up to 30 devices; Premium $1 per device per month, billed annually, 30 licenses minimum<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(Capterra, 88)<\/span><\/td><\/tr><tr data-cat=\"Cross-platform UEM\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/hexnode.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Hexnode UEM<\/span><\/th><td><span class=\"ok-job\">Cross-platform UEM<\/span><\/td><td class=\"ok-muted\">Apple, Android, Windows, Linux and ChromeOS from tiered plans<\/td><td>Pro $2.2, Enterprise $3.2, Ultimate $4.7 per device per month, 10% off annual billing; Ultra on request; 15 devices minimum<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(Capterra, 154)<\/span><\/td><\/tr><tr data-cat=\"UEM with kiosk and rugged focus\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/scalefusion.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Scalefusion<\/span><\/th><td><span class=\"ok-job\">UEM with kiosk and rugged focus<\/span><\/td><td class=\"ok-muted\">iOS, Android, Windows, macOS and Linux with kiosk mode<\/td><td>UEM Essential $2 per device per month, billed annually; 10 devices minimum<\/td><td data-v=\"4.8\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.8 <span class=\"ok-muted\">(Capterra, 114)<\/span><\/td><\/tr><tr data-cat=\"Budget MDM, cloud or on premises\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/manageengine-mdm.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>ManageEngine Mobile Device Manager Plus<\/span><\/th><td><span class=\"ok-job\">Budget MDM, cloud or on premises<\/span><\/td><td class=\"ok-muted\">iOS, Android, Windows, macOS and ChromeOS with a free tier<\/td><td>Free up to 25 devices; cloud Standard $645 per year for 50 devices, Professional $1,195 per year for 50<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(Capterra, 937)<\/span><\/td><\/tr><tr data-cat=\"Directory-led device management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>JumpCloud<\/span><\/th><td><span class=\"ok-job\">Directory-led device management<\/span><\/td><td class=\"ok-muted\">Directory, SSO and MDM for Apple, Android, Windows and Linux in one console<\/td><td>Device Management $9, SSO $11, Device Identity Management $13 per user per month, billed annually<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(4,121)<\/span><\/td><\/tr><tr data-cat=\"RMM with an MDM module\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/ninjaone.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>NinjaOne<\/span><\/th><td><span class=\"ok-job\">RMM with an MDM module<\/span><\/td><td class=\"ok-muted\">iOS, iPadOS, macOS and Android in the same console as endpoint management<\/td><td>Quote based; the platform range is $1.50 to $3.75 per device per month and the page does not say if MDM is included<\/td><td data-v=\"4.7\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7 <span class=\"ok-muted\">(Capterra, 298)<\/span><\/td><\/tr><tr data-cat=\"Service account ownership reviews\" class=ok-ours><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>The IT Lead <span class=\"ok-chip ok-chip--ours\">Our product<\/span><\/span><\/th><td><span class=\"ok-job ok-job--ours\">Service account ownership reviews<\/span><\/td><td class=\"ok-muted\">Collects owner attestations for service accounts and keeps the review trail<\/td><td>Access code<\/td><td data-v=\"0\"><span class=\"ok-muted\">No reviews yet<\/span><\/td><\/tr><\/tbody><\/table><\/div><p class=\"ok-note\">Prices come from each vendor's own pages, read on October 18, 2026. Ratings are Capterra, with the number of ratings in brackets. NinjaOne's rating covers the whole platform, mostly its RMM, and the Intune rating comes from a small listing under its old Microsoft Endpoint Manager name.<\/p><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-mobile-device-management-software-does\">What mobile device management software does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MDM software enrolls a device, configures it and secures it. Enrolling means the device joins your management server, usually during first-time setup. Configuring means pushing Wi-Fi, VPN, email and app settings. Securing means enforcing a passcode and encryption, blocking risky settings, locating a lost device and wiping it. The server reaches Apple devices through Apple's push notification service, so the device must be able to contact it and the server's push certificate has to be valid.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mdm-vs-mam-vs-emm-vs-uem\">MDM vs MAM vs EMM vs UEM<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The four acronyms describe how much of the device or its data the tool controls. NIST's guidance on mobile device security separates them like this.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Term<\/th><th>What it controls<\/th><th>Does the device have to enroll?<\/th><\/tr><\/thead><tbody><tr><td>MDM<\/td><td>The device: settings, apps, restrictions, remote wipe<\/td><td>Yes<\/td><\/tr><tr><td>MAM<\/td><td>Only the apps that reach company data<\/td><td>No, per NIST<\/td><\/tr><tr><td>EMM<\/td><td>An MDM, MAM and other mobile security tools in one suite<\/td><td>Yes for the MDM part<\/td><\/tr><tr><td>UEM<\/td><td>Another name for EMM in NIST's wording; vendors use it for suites that also manage laptops<\/td><td>Yes for the MDM part<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In practice you buy a UEM product and use its MDM features on phones and its laptop features on Windows and Mac. NIST SP 800-124 Rev. 2 has the formal definitions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"what-mdm-can-and-cannot-do-on-a-personal-device\">What MDM can and cannot do on a personal device<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A personally owned phone gets a lighter kind of management. On iPhone and iPad, Apple's User Enrollment keeps organizational data in a separate, cryptographically protected volume. The organization can manage its own apps and accounts, apply a limited set of restrictions and remove its own data, but it never manages the user's personal account or data. The user can unenroll at any time by signing out of the Managed Apple Account, which removes the organizational data and apps.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On Android, a work profile does the same job: work apps and data are separated from personal ones, and a wipe on a personally owned device removes only the work profile. A full factory reset is reserved for devices the company owns.<\/p>\n\n\n\n<aside class=\"ok-callout ok-callout--watch\"><p><strong>Remote wipe has two meanings<\/strong> NIST describes a full-device wipe, typically used on company-owned devices, and an enterprise wipe that deletes only work settings, data and apps, typically used on a personal device. Decide which one your policy promises before you enroll employees' own phones, because Apple's User Enrollment doesn't allow a full Erase All Content and Settings from the MDM at all.<\/p><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-a-device-gets-enrolled\">How a device gets enrolled<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zero-touch enrollment is the feature that decides how much hands-on work a new device costs you. Each platform has its own gate, and the gate is something you set up outside the MDM tool. If you skip it, you're enrolling by hand, which gets old quickly past a few dozen devices.<\/p>\n\n\n\n<ol class=\"ok-flow ok-wide\" style=\"--cols:4\"><li class=\"ok-flow__col\"><span class=\"ok-flow__step\">Apple devices<\/span><strong class=\"ok-flow__title\">Apple Business and Automated Device Enrollment<\/strong><ul><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jamf.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Jamf Pro<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/iru.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Iru (formerly Kandji)<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/mosyle.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Mosyle Business<\/li><\/ul><div class=\"ok-flow__note\"><strong>Prerequisite<\/strong> the device was bought from Apple, an authorized reseller or carrier, or added with Apple Configurator, and an already set up iPhone or iPad must be erased first<\/div><\/li><li class=\"ok-flow__col\"><span class=\"ok-flow__step\">Android devices<\/span><strong class=\"ok-flow__title\">Zero-touch or QR code enrollment<\/strong><ul><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/scalefusion.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Scalefusion<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/hexnode.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Hexnode UEM<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/manageengine-mdm.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>ManageEngine Mobile Device Manager Plus<\/li><\/ul><div class=\"ok-flow__note\"><strong>Prerequisite<\/strong> zero-touch needs an authorized reseller and Android 8.0 or later, while QR code and sign-in URL work without one<\/div><\/li><li class=\"ok-flow__col\"><span class=\"ok-flow__step\">Windows PCs<\/span><strong class=\"ok-flow__title\">Windows Autopilot into the MDM<\/strong><ul><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/intune.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Microsoft Intune<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/hexnode.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Hexnode UEM<\/li><li><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/scalefusion.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Scalefusion<\/li><\/ul><div class=\"ok-flow__note\"><strong>Prerequisite<\/strong> Microsoft Entra ID, an MDM subscription and devices registered with Autopilot, on Windows 10 or 11 Pro, Enterprise or Education<\/div><\/li><li class=\"ok-flow__col ok-flow__col--ours\"><span class=\"ok-flow__step\">Across all<\/span><strong class=\"ok-flow__title\">Keep the accounts behind enrollment alive<\/strong><ul><li><span class=\"ok-fav ok-fav--sm ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>The IT Lead<\/li><\/ul><div class=\"ok-flow__note\"><strong>Catches<\/strong> the Apple push certificate that must be renewed every year with the account that created it<\/div><\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The Apple push certificate deserves its own owner. Apple says it must be renewed annually and tells admins to record which Apple account created it, because that account is needed for renewal. MDM vendors warn that creating a new certificate instead of renewing the old one leaves enrolled devices orphaned and forces re-enrollment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Network access matters too, but it's the easier one to forget. Apple devices reach Apple's push service on TCP port 5223, with port 443 as a fallback. If your guest or kiosk network blocks that port, management commands won't arrive.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-we-chose-these-tools\">How we chose these tools<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The list is built for small IT teams and MSPs managing roughly 10 to 500 devices. Each tool is judged on six points:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Platforms managed.<\/strong> Which of iOS and iPadOS, macOS, Android, Windows, ChromeOS and Linux it actually enrolls, and which are handled only through other products.<\/li><li><strong>Enrollment path.<\/strong> Whether zero-touch enrollment is available through Apple Business, Android zero-touch or Autopilot, and from which plan.<\/li><li><strong>Personal devices.<\/strong> Whether it supports User Enrollment and work profiles, and from which plan.<\/li><li><strong>Price transparency.<\/strong> A published price per device or per user, a minimum order, a free tier or a trial.<\/li><li><strong>Effort to run.<\/strong> Cloud or self-hosted, and how much scripting or admin time reviewers say it takes.<\/li><li><strong>Review evidence.<\/strong> A Capterra rating with a count and one recurring praise and complaint. G2 blocked automated access when we read the review sites, so we used Capterra throughout.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">We did not research IBM MaaS360, SOTI MobiControl or Miradore for this edition. Tools that only secure data without managing the device, such as secure browser or enclave products, are not MDM and are left out.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"best-mdm-software-for-apple-fleets\">Best MDM software for Apple fleets<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All three tools in this group manage Apple devices well and treat other platforms as secondary or not at all. Apple's own deployment model sets the pattern: you buy devices through Apple Business, assign them to an MDM server, and the device enrolls itself during Setup Assistant.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"jamf-pro\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jamf.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"jamf-pro\">Jamf Pro<\/h3><p class=\"ok-card__sub\">Jamf Pro manages Apple devices only. It is known for Smart Groups, PreStage enrollments and a large integration marketplace, and Jamf Now covers very small teams.<\/p><\/div><span class=\"ok-job\">Apple-only MDM<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7<span class=\"ok-muted\"> \u00b7 547 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">The reference choice for Apple-only fleets, as long as you have an admin who will invest in learning it.<\/p><p>An admin links Jamf Pro to Apple Business or Apple School Manager, then builds a PreStage enrollment that sets what the user sees in Setup Assistant and which settings are enforced. Devices bought through Apple are assigned to the Jamf MDM server in Apple's portal and scoped to a PreStage. When the user powers the device on and connects, it enrolls without anyone touching it and receives its apps and profiles. A user-initiated path covers personally owned devices.<\/p><p>The depth is in the automation. Smart Groups and Extension Attributes sort devices by almost any attribute, so a policy can follow a device as its state changes. Self Service+ lets users install approved apps themselves, and compliance benchmarks apply security baselines. Jamf connects to Microsoft Entra, Google Workspace, Okta and a marketplace of further integrations.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your fleet is Apple only and you want deep Mac, iPhone and iPad control and automation<\/li><li>you have an admin who will learn Smart Groups, PreStages and scripting<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you manage any Windows or Android devices and want one console<\/li><li>you need a public per-device price and a light console for a few dozen devices<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>easy enrollment and app deployment, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>a steep learning curve, scripting for common tasks and price, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/164492\/Jamf-Pro\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 547 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-jamf-screenshot.png\" alt=\"The Jamf Pro dashboard shows Policy Statuses tiles for compliance scripts and FileVault with completion rings, plus Patch Management Statuses for macOS, Chrome and Firefox.\" width=\"1400\" height=\"826\" loading=\"lazy\" decoding=\"async\"><figcaption>Jamf Pro dashboard with policy and patch management statuses (Source: Jamf)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>The business pricing page leads to a contact form for two bundles, Jamf for Mac and Jamf for Mobile, and says they are for cloud customers. Jamf Now is the self-serve product for organizations with fewer than 25 employees, and its product page says up to three devices are free. Jamf doesn't show a price above that on its own pages.<\/p><p>Capterra reviewers back up the skip-if. One reviewer with fewer than 300 iPads and Apple TVs says the price is \"a bit much\", another needed scripts for auto-updates and dock configuration, and a third ran other tools for Windows and Chromebooks. A free 14 day trial is offered.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only; Jamf Now is free for up to 3 devices<\/dd><\/div><div><dt>Platforms<\/dt><dd>macOS, iOS and iPadOS, tvOS, visionOS<\/dd><\/div><div><dt>Pricing<\/dt><dd>Contact sales (Jamf Now: 3 devices free)<\/dd><\/div><div><dt>Hosting<\/dt><dd>Cloud for the current bundles<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"iru-formerly-kandji\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/iru.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"iru-formerly-kandji\">Iru (formerly Kandji)<\/h3><p class=\"ok-card__sub\">Kandji was renamed Iru in October 2025. It is an Apple-first MDM built around Blueprints and automatic app patching, with newer Windows and Android support.<\/p><\/div><span class=\"ok-job\">Apple-first MDM<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.9<span class=\"ok-muted\"> \u00b7 500 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Kandji's Apple-first MDM, renamed Iru in October 2025 and built around Blueprints.<\/p><p>The admin configures Apple's push service, connects Apple Business or School Manager and creates a token for Automated Device Enrollment. In Apple's portal the devices are assigned to Iru Endpoint as the MDM server. In Iru the admin selects devices awaiting enrollment and assigns each a Blueprint, which is a set of apps, settings and policies. Blueprint Routing rules can do the assignment automatically, and the first matching rule wins. The user turns on the Mac or iPhone, it enrolls in Setup Assistant and the Blueprint deploys. Personally owned devices enroll manually with an enrollment code.<\/p><p>Iru ships one-click CIS Level 1 and Level 2 templates for Mac, managed OS updates and Auto Apps that patch hundreds of Mac and Windows applications. A Migration Agent moves Macs over from another MDM. Windows and Android support is newer than the Apple side, and Google Play handles Android app distribution.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your team is mostly Macs and iPhones and wants fast setup with onboarding help<\/li><li>you want CIS compliance templates and automatic app patching without writing many scripts<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you run a mixed fleet where Windows and Android need the same depth as macOS<\/li><li>you need a published price before talking to sales<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>easy setup with responsive support and onboarding, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>cost for small teams and limits in alerts and reporting, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/181954\/Iru\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 500 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-iru-screenshot.png\" alt=\"The Iru (formerly Kandji) Library screen lists Library Items such as Auto Apps and profiles with a sidebar for Devices, Blueprints and Library, plus filters and an Add Library Item button.\" width=\"1400\" height=\"718\" loading=\"lazy\" decoding=\"async\"><figcaption>Iru Library overview with Library Items and filters in the admin console (Source: Iru)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Pricing is a quote with an annual contract, and Iru doesn't publish a minimum order. Third-party sources disagree on one, from about 25 to 100 devices, so ask before you plan around a small pilot. A free 14 day trial is offered, and onboarding and migration help is included in the price according to Iru's pricing page.<\/p><p>EDR, vulnerability management, workforce identity and compliance automation are separate licensed modules, so check which ones a quote includes. Older guides and some listings still use the Kandji name.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only, annual contract<\/dd><\/div><div><dt>Platforms<\/dt><dd>macOS, iOS and iPadOS, tvOS, visionOS, Windows, Android<\/dd><\/div><div><dt>Pricing<\/dt><dd>Quote only, annual contract<\/dd><\/div><div><dt>Renamed<\/dt><dd>Kandji to Iru in October 2025<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"mosyle-business\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/mosyle.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"mosyle-business\">Mosyle Business<\/h3><p class=\"ok-card__sub\">Mosyle Business manages Apple devices only. It has a free plan for up to 30 devices and low per-device prices above that.<\/p><\/div><span class=\"ok-job\">Apple-only MDM<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 88 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">The cheapest way to manage a small Apple fleet, with a free plan under 30 devices.<\/p><p>Devices bought through Apple Business Manager or Apple School Manager enroll with Automated Device Enrollment. Mosyle says it supports all ADE configurations, installs required apps, applies security controls and creates user accounts that authenticate against Google Workspace, Microsoft 365, LDAP or Active Directory during setup. On a Mac, its Embark screen shows a progress bar while this happens. Personally owned devices enroll with Apple's User Enrollment.<\/p><p>Other capabilities include remote scripting with a script catalog, OS update enforcement with deadlines, managed apps and Books, a catalog of roughly 400 Mac apps outside the App Store, hardening templates mapped to CIS, SOC 2 and PCI, and macOS login with Google, Microsoft, Okta or Ping accounts.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your fleet is all Apple and you want the lowest per-device cost<\/li><li>you have fewer than 30 devices and want a free plan<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need to manage Android or Windows devices<\/li><li>you want live phone support rather than tickets<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>easy setup and good value for Apple fleets, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>slow ticket-based support, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/183343\/Mosyle-Business\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 88 reviews<\/dd><\/dl><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>The free plan covers up to 30 devices. The Premium plan is $1 per Mac, iPhone, iPad or Vision Pro per month, billed annually, with a minimum of 30 licenses. Fuse plans are $1.50 per month per iOS, iPadOS or visionOS device and $3 for macOS. tvOS and watchOS management is included at no extra charge.<\/p><p>Which features sit in which plan isn't clear from the pricing page, so ask for a feature list before you buy. Organizations switching from another Apple MDM can qualify for a longer trial and a first-year credit, according to Mosyle's pricing page. Mosyle manages no Android or Windows devices.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Free for up to 30 devices; Premium $1 per device per month, billed annually, 30 licenses minimum<\/dd><\/div><div><dt>Platforms<\/dt><dd>macOS, iOS and iPadOS, tvOS, visionOS, watchOS<\/dd><\/div><div><dt>Free tier<\/dt><dd>Up to 30 devices<\/dd><\/div><div><dt>Minimum<\/dt><dd>30 licenses on paid plans, annual<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"best-mdm-software-for-microsoft-365-shops\">Best MDM software for Microsoft 365 shops<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your company already pays for Microsoft 365 Business Premium or E3, you may own an MDM without having turned it on.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"microsoft-intune\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/intune.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"microsoft-intune\">Microsoft Intune<\/h3><p class=\"ok-card__sub\">Intune is Microsoft's cloud MDM and app management service. Plan 1 ships inside Microsoft 365 Business Premium and E3, so many small teams already own it.<\/p><\/div><span class=\"ok-job\">Cloud MDM from Microsoft<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 42 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">The default choice when Microsoft 365 is already paid for, and the one with the most licensing detail to read.<\/p><p>IT sets up the prerequisites once: the Apple push certificate and token for Automated Device Enrollment, a link to managed Google Play and Windows automatic enrollment. After that, each platform has an enrollment policy. A corporate Windows PC registers with Autopilot, the user connects and signs in, and the PC joins Microsoft Entra and receives apps and policies. An iPhone bought through Apple Business syncs its serial number to Intune, gets an enrollment policy and enrolls in Setup Assistant. Personal devices enroll through the Company Portal app or use app protection only, with no enrollment.<\/p><p>Compliance policies check things like BitLocker, Secure Boot, firewall, Defender and passcode, and Conditional Access can block a noncompliant device from company apps. Intune can also protect data inside apps on unenrolled iOS and Android devices, which suits personal phones where employees refuse full enrollment.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you already pay for Microsoft 365 Business Premium or E3 and want Windows, Android and iPhone in one console<\/li><li>you want Windows Autopilot setup and Conditional Access tied to Entra ID<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>your fleet is mostly Macs and you want Apple-specific depth without learning a large admin console<\/li><li>you have no Microsoft 365 licensing and want simple per-device pricing<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>Autopilot deployment and one admin portal save time, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>support is slow and the console is complex and changes often, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/230703\/Microsoft-Endpoint-Manager-MEM\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 42 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-intune-screenshot.png\" alt=\"The Microsoft Intune admin center shows an Android Enterprise compliance policy with Monitor tab, device status bar and Compliant, Noncompliant, Others and Total counts.\" width=\"1400\" height=\"674\" loading=\"lazy\" decoding=\"async\"><figcaption>Intune compliance policy monitoring view in the admin center (Source: Microsoft)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Plan 1 costs $8 per user per month standalone and is included in Microsoft 365 E3 and Business Premium. Plan 2 adds $4, and the Intune Suite is $10 and includes Plan 2 plus advanced modules. Remote Help ($3.50), Endpoint Privilege Management ($3), Advanced Analytics ($5), Enterprise App Management ($2) and Cloud PKI ($2) are priced separately, and third-party app patching needs Enterprise App Management or another tool. A 30 day trial is available.<\/p><p>Two licensing traps are worth knowing. Windows automatic enrollment needs Entra ID P1 or P2, and device-only licenses don't support app protection or Conditional Access. The Capterra figure comes from a listing of only 42 ratings under the old Microsoft Endpoint Manager name.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>$8 per user per month for Plan 1; included in Microsoft 365 Business Premium and E3<\/dd><\/div><div><dt>Platforms<\/dt><dd>Windows, macOS, iOS and iPadOS, Android, Linux<\/dd><\/div><div><dt>Plan 1<\/dt><dd>$8 per user per month standalone<\/dd><\/div><div><dt>Included in<\/dt><dd>Microsoft 365 Business Premium and E3<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"best-mdm-software-for-mixed-fleets\">Best MDM software for mixed fleets<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mixed fleets need one console that handles Android kiosks, Windows PCs and iPhones without a separate tool for each. These three trade polish for breadth and price.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"hexnode-uem\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/hexnode.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"hexnode-uem\">Hexnode UEM<\/h3><p class=\"ok-card__sub\">Hexnode covers Apple, Android, Windows, Linux and ChromeOS devices and sells tiered plans that start at 15 devices, with kiosk and BYOD options.<\/p><\/div><span class=\"ok-job\">Cross-platform UEM<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 154 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Broad platform coverage and published prices, with features unlocked tier by tier.<\/p><p>Corporate Apple devices bought through Apple Business or School Manager enroll automatically in Setup Assistant. The admin assigns devices to the Hexnode MDM server in Apple Business and syncs them in the console, and devices that were already set up have to be factory reset to pick up the profile. Personal devices use User Enrollment with a Managed Apple Account, or the older profile-driven method through an enrollment link. Apple Business and Samsung Knox Mobile Enrollment are available from the Pro plan.<\/p><p>The plan ladder is the thing to understand. Pro adds kiosk mode, app management and location tracking. Enterprise adds geofencing, OS updates, directory integrations and web content filtering. Ultimate adds scripting, Windows Autopilot, FileVault and advanced reporting. macOS and Windows patching, BitLocker and desktop remote control exist only in the quote-based Ultra plan.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you manage a mixed fleet that includes Android kiosks and Windows PCs<\/li><li>you want a 14 day trial and published per-device prices<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need macOS and Windows patching, which sits in the quote-based Ultra plan<\/li><li>you value fast reporting and quick support responses over breadth<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>one dashboard for iPhones, Android, Windows and Apple TV, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>slow reports and uneven support response, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/146405\/Hexnode-MDM\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 154 reviews<\/dd><\/dl><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Pro is $2.2, Enterprise $3.2 and Ultimate $4.7 per device per month, with 10% off for annual billing. The pricing page doesn't say whether the displayed figures assume monthly or annual billing, so confirm before you budget. The minimum is 15 devices, and the 14 day trial needs no card. Technician seats rise with the plan, from two on Pro to five on Ultra.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Pro $2.2, Enterprise $3.2, Ultimate $4.7 per device per month, 10% off annual billing; Ultra on request; 15 devices minimum<\/dd><\/div><div><dt>Minimum<\/dt><dd>15 devices<\/dd><\/div><div><dt>Trial<\/dt><dd>14 days, no card<\/dd><\/div><div><dt>Platforms<\/dt><dd>Apple, Android, Windows, Linux, ChromeOS, Fire OS<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"scalefusion\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/scalefusion.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"scalefusion\">Scalefusion<\/h3><p class=\"ok-card__sub\">Scalefusion is a per-device UEM for iOS, Android, Windows, macOS and Linux with strong kiosk and rugged-device support. BYOD enrollment, patching and the API sit in higher tiers.<\/p><\/div><span class=\"ok-job\">UEM with kiosk and rugged focus<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.8<span class=\"ok-muted\"> \u00b7 114 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">A per-device UEM that is strongest on company-owned Android tablets and iPad kiosks.<\/p><p>For company-owned Apple devices the admin assigns the Scalefusion MDM server in Apple Business Manager, or in Apple Configurator. The device then boots through Setup Assistant, fetches its settings from Apple and shows the Remote Management screen, which completes enrollment. Android Enterprise, zero-touch and Apple Business enrollment come with the entry tier, along with single-app and multi-app kiosk mode on Android and iPad.<\/p><p>The tiers decide what you can do. UEM Growth ($3.50) adds BYOD enrollment, a private app store and Wi-Fi, APN and VPN settings. UEM Business ($9) adds Windows Autopilot, OS and patch management, LDAP, dynamic groups and an API. UEM Enterprise ($10) adds webhooks, an on-premises connector and PowerShell scripting. OEM integrations cover Samsung Knox, Zebra, Lenovo, Bluebird, Kyocera and Janam.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you manage company-owned Android tablets or iPad kiosks and want public per-device pricing<\/li><li>you have 10 to a few hundred devices and can pick the tier you need<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need BYOD enrollment or patching at the entry tier, since those start at the $3.50 and $9 tiers<\/li><li>you buy licenses in small increments and want simple billing<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>responsive support and a simple dashboard, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>licenses bought in blocks and a licensing model that is hard to follow, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/156745\/MobiLock-Pro\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 114 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-scalefusion-screenshot.png\" alt=\"The Scalefusion dashboard Remote Support screen shows a live view of a managed device with session details, device name, model, profile name and a left menu with Devices, Enrollment Configurations and Device Profiles and Policies.\" width=\"1400\" height=\"770\" loading=\"lazy\" decoding=\"async\"><figcaption>Scalefusion remote support screen in the admin dashboard (Source: Scalefusion)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>The entry tier costs $2 per device per month, billed annually, with a minimum of 10 devices and a 14 day trial with all features. The Business and Enterprise tiers show annual totals of $108 and $120 per device on the pricing page. Mobile threat defense needs a separate Check Point Harmony subscription. Linux and ChromeOS appear in the product navigation, but the pages we read don't show which plan includes them.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>UEM Essential $2 per device per month, billed annually; 10 devices minimum<\/dd><\/div><div><dt>Entry price<\/dt><dd>$2 per device per month, annual<\/dd><\/div><div><dt>Minimum<\/dt><dd>10 devices<\/dd><\/div><div><dt>Trial<\/dt><dd>14 days<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"manageengine-mobile-device-manager-plus\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/manageengine-mdm.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"manageengine-mobile-device-manager-plus\">ManageEngine Mobile Device Manager Plus<\/h3><p class=\"ok-card__sub\">Mobile Device Manager Plus manages iOS, Android, Windows, macOS and ChromeOS devices, runs in the cloud or on your own server and has a free tier for 25 devices.<\/p><\/div><span class=\"ok-job\">Budget MDM, cloud or on premises<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 937 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Low-cost MDM you can run in the cloud or on your own server.<\/p><p>For Android, the admin sets up managed Google Play, opens Enrollment Settings in the console, chooses enrollment with the Android Device Policy app and sends invites. Users install the app and enroll, and the admin syncs the apps afterwards. A work profile can be enrolled with a QR code, and enrollment can require a one-time passcode or Active Directory credentials. Bulk enrollment by CSV and self-enrollment are also supported.<\/p><p>Standard covers app and device distribution, restriction profiles, kiosk mode, geotracking and remote commands. Professional adds content management, OS update policies, conditional access, remote control and geofencing. Endpoint Central is a separate, larger product that adds patching and asset management. We didn't find an Apple enrollment walkthrough in the documentation we read, so test Apple device enrollment during the trial.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want low cost and the option to host the server yourself<\/li><li>you want a free tier and a 30 day trial that is not capped by device count<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you want a modern, uncluttered admin console<\/li><li>you need Linux device management, which the product page does not confirm<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>good value and easy bulk enrollment, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>a cluttered, dated interface with a learning curve, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/132201\/ManageEngine-Mobile-Device-Manager-Plus\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 937 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-manageengine-mdm-screenshot.png\" alt=\"The ManageEngine Mobile Device Manager Plus Configure Profile screen for an Android profile shows a policy list and Passcode settings such as complexity and auto-lock time.\" width=\"1400\" height=\"737\" loading=\"lazy\" decoding=\"async\"><figcaption>ManageEngine MDM Android profile configuration with passcode policy (Source: ManageEngine)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>The tool is free for up to 25 devices. In the cloud, Standard costs $645 a year for 50 devices, $1,195 for 100, $2,845 for 250 and $5,245 for 500. Professional costs $1,195, $2,245, $5,195 and $9,595 for the same bands. Extra technicians cost extra. The headline \"from $9.9 per device\" on the product page matches the on-premises annual rate for 50 devices, not the cloud rate. A 30 day trial covers unlimited devices.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Free up to 25 devices; cloud Standard $645 per year for 50 devices, Professional $1,195 per year for 50<\/dd><\/div><div><dt>Free tier<\/dt><dd>25 devices<\/dd><\/div><div><dt>Smallest paid band<\/dt><dd>50 devices<\/dd><\/div><div><dt>Deployment<\/dt><dd>Cloud or on premises<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"best-mdm-software-when-you-already-run-a-directory-or-an-rmm\">Best MDM software when you already run a directory or an RMM<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These two don't start from the phone. They add device management to a platform that your team may already log into every day.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"jumpcloud\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"jumpcloud\">JumpCloud<\/h3><p class=\"ok-card__sub\">JumpCloud bundles Apple MDM and Android management into its directory and identity platform and prices per user instead of per device.<\/p><\/div><span class=\"ok-job\">Directory-led device management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 4,121 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">One console for directory, single sign-on and devices, priced per user instead of per device.<\/p><p>The admin uploads an Apple push certificate so JumpCloud acts as the MDM server. Company-owned devices in Apple Business use Automated Device Enrollment, other devices use Device Enrollment, and personal devices use User Enrollment once the admin allows it and the user enrolls through the user portal. On Android, the admin registers an enterprise and enrollment starts from the Android Device Policy app, with no JumpCloud agent on the phone.<\/p><p>The Android side offers 21 policies covering passcode, Wi-Fi, VPN, kiosk, system updates and runtime permissions. Admins can lock, reset the passcode, restart or erase a device, or remove only the work profile. Profile-based User Enrollment isn't supported on iOS and iPadOS 18.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want directory, SSO and device management from one vendor with a public per-user price<\/li><li>you run Mac, Windows and Linux and want MDM for phones as an add-on<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need the deepest mobile controls, which reviewers say are still evolving<\/li><li>you only need mobile management and have no use for the directory layer<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>easy onboarding and unified management of identity and devices, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>Windows group policy gaps, MFA gaps with LDAP and a learning curve, per G2's summary of reviewer themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/jumpcloud\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 4,121 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-jumpcloud-screenshot.png\" alt=\"The JumpCloud Admin Portal Add Device screen on the Android tab shows a Create Enrollment Token button and a setting that lets users enroll personal Android devices through the User Portal.\" width=\"1440\" height=\"1080\" loading=\"lazy\" decoding=\"async\"><figcaption>JumpCloud Android device enrollment screen in the Admin Portal (Source: JumpCloud)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>The Device Management plan is $9 per user per month billed annually or $11 billed monthly, and it includes MDM. The SSO plan at $11 doesn't include MDM. MDM can also be added alone for $5 a month annually or $6 monthly. A 30 day trial is available. Because pricing is per user, compare it with per-device tools by counting devices per person. The full plan and billing breakdown is in our <a href=\"\/blog\/jumpcloud-pricing\/\">JumpCloud pricing guide<\/a>.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Device Management $9, SSO $11, Device Identity Management $13 per user per month, billed annually<\/dd><\/div><div><dt>Entry price<\/dt><dd>$9 per user per month, annual<\/dd><\/div><div><dt>MDM add-on<\/dt><dd>$5 per user per month, annual<\/dd><\/div><div><dt>Trial<\/dt><dd>30 days<\/dd><\/div><div><dt>Public Device Management<\/dt><dd>$9\/user\/mo annual<\/dd><\/div><div><dt>Public SSO<\/dt><dd>$11\/user\/mo annual<\/dd><\/div><div><dt>Public Device Identity Management<\/dt><dd>$13\/user\/mo annual<\/dd><\/div><div><dt>Platform packages<\/dt><dd>Contact Sales<\/dd><\/div><div><dt>Legacy free<\/dt><dd>Only eligible pre-February 2024 accounts<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"ninjaone\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/ninjaone.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"ninjaone\">NinjaOne<\/h3><p class=\"ok-card__sub\">NinjaOne adds MDM for iOS, iPadOS, macOS and Android to its RMM platform, with Apple Business Manager integration and multi-tenant management for MSPs.<\/p><\/div><span class=\"ok-job\">RMM with an MDM module<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7<span class=\"ok-muted\"> \u00b7 298 Capterra reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">A fit for MSPs and IT teams who already manage endpoints in NinjaOne and want phones in the same place.<\/p><p>The admin picks an ownership type per enrollment. Android has \"For personal and work\" and \"For work\", and Apple has \"Unsupervised\" for personal devices and \"Supervised\" for company-owned ones. Apple Business is an optional connection for supervised and zero-touch setups, and company-owned Android devices must be new or factory reset. Policies live under Administration, Policies, MDM Policies and are assigned from the device page.<\/p><p>Apple and Android policies cover passcode, restrictions, apps and network settings, and Android adds security and enforcement categories. Admins can lock, wipe, locate and update devices, and deploy apps silently on both platforms. Supervised mode can block the App Store. Policy changes may need a device restart. Windows and Linux are handled through the RMM, not the MDM, and the MDM is multi-tenant, which is the reason MSPs look at it.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you already run NinjaOne for endpoints and want phones and tablets in the same console<\/li><li>you are an MSP that needs policies and app deployment across several clients<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you want a published mobile price before talking to sales<\/li><li>your fleet is Apple heavy and you need the deepest MDM controls<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>reliable patching, remote access and automation, per Capterra reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>extra effort to set up policies and automation, per a Capterra reviewer<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.capterra.com\/p\/184229\/NinjaOne\/reviews\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Capterra<\/a>, 298 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/mdm-ninjaone-screenshot.png\" alt=\"The NinjaOne Administration page shows an Add a mobile device dialog with Android and Apple tabs and fields for organization, location, device role, Android Enterprise connection and enrollment profile.\" width=\"1180\" height=\"902\" loading=\"lazy\" decoding=\"async\"><figcaption>NinjaOne mobile device enrollment dialog in the admin console (Source: NinjaOne)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>NinjaOne's pricing page gives a platform range of $1.50 to $3.75 per device per month by volume and lists MDM as a product, but it doesn't say whether MDM is included or an add-on. Ask for the mobile line item in writing. The Capterra rating covers the platform as a whole and the sampled reviews talk about RMM, so it says little about the MDM module.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote based; the platform range is $1.50 to $3.75 per device per month and the page does not say if MDM is included<\/dd><\/div><div><dt>Mobile OS<\/dt><dd>iOS, iPadOS, macOS, Android<\/dd><\/div><div><dt>Pricing<\/dt><dd>Quote based<\/dd><\/div><div><dt>Windows and Linux<\/dt><dd>Through the RMM, not MDM<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-mdm-software-costs-and-what-is-free\">What MDM software costs and what is free<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MDM software costs depend on the pricing basis. Six of the nine tools publish a price, and the published numbers use three different bases: per device per month (Mosyle, Hexnode, Scalefusion), per user per month (Intune, JumpCloud) and per device band per year (ManageEngine). Jamf, Iru and NinjaOne are quote only. The lowest published price is Mosyle's $1 per device per month, which covers Apple devices only.<\/p>\n\n\n\n<div class=\"ok-calc\" data-calc=\"{&quot;min&quot;: 30, &quot;max&quot;: 250, &quot;default&quot;: 50, &quot;unit&quot;: &quot;devices&quot;, &quot;label&quot;: &quot;Devices to manage&quot;, &quot;period&quot;: &quot;year&quot;, &quot;items&quot;: [{&quot;label&quot;: &quot;Mosyle Premium&quot;, &quot;sub&quot;: &quot;$1 per device per month, annual, 30 licenses minimum, Apple only&quot;, &quot;per&quot;: 12, &quot;min_units&quot;: 30}, {&quot;label&quot;: &quot;Scalefusion UEM Essential&quot;, &quot;sub&quot;: &quot;$2 per device per month, annual, 10 devices minimum&quot;, &quot;per&quot;: 24, &quot;min_units&quot;: 10}, {&quot;label&quot;: &quot;Hexnode Pro&quot;, &quot;sub&quot;: &quot;$2.2 per device per month, 15 devices minimum, annual discount not applied&quot;, &quot;per&quot;: 26.4, &quot;min_units&quot;: 15}, {&quot;label&quot;: &quot;Microsoft Intune Plan 1&quot;, &quot;sub&quot;: &quot;$8 per user per month, one device per user assumed&quot;, &quot;per&quot;: 96}, {&quot;label&quot;: &quot;JumpCloud Device Management&quot;, &quot;sub&quot;: &quot;$9 per user per month, annual, one device per user assumed&quot;, &quot;per&quot;: 108}, {&quot;label&quot;: &quot;ManageEngine Standard (cloud)&quot;, &quot;sub&quot;: &quot;annual price by device band: 50, 100, 250&quot;, &quot;per&quot;: 0, &quot;tiers&quot;: [{&quot;upto&quot;: 50, &quot;add&quot;: 645}, {&quot;upto&quot;: 100, &quot;add&quot;: 1195}, {&quot;upto&quot;: 250, &quot;add&quot;: 2845}]}]}\"><div class=\"ok-calc__q\">Devices to manage: <strong data-n>50 devices<\/strong><\/div><ol class=\"ok-bars\"><li><span class=\"ok-bars__label\">Mosyle Premium<small>$1 per device per month, annual, 30 licenses minimum, Apple only<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:11.1%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$600<small> per year<\/small><\/span><\/li><li><span class=\"ok-bars__label\">ManageEngine Standard (cloud)<small>annual price by device band: 50, 100, 250<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:11.9%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$645<small> per year<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Scalefusion UEM Essential<small>$2 per device per month, annual, 10 devices minimum<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:22.2%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$1,200<small> per year<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Hexnode Pro<small>$2.2 per device per month, 15 devices minimum, annual discount not applied<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:24.4%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$1,320<small> per year<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Microsoft Intune Plan 1<small>$8 per user per month, one device per user assumed<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:88.9%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$4,800<small> per year<\/small><\/span><\/li><li><span class=\"ok-bars__label\">JumpCloud Device Management<small>$9 per user per month, annual, one device per user assumed<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:100.0%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$5,400<small> per year<\/small><\/span><\/li><\/ol><p class=\"ok-note\">Yearly list prices from vendor pages, October 18, 2026. Entry tiers only: each vendor's higher plans cost more, and Jamf, Iru and NinjaOne aren't shown because they don't publish a price.<\/p><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"is-there-a-free-mdm\">Is there a free MDM?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, a free MDM exists, but with limits. Mosyle's free plan covers up to 30 Apple devices, ManageEngine's free tier covers up to 25 devices on any supported platform, and Jamf Now's product page says up to three devices are free. Google Workspace also includes basic mobile management by default, which covers password rules, account wipe and Android app management; advanced management is an upgrade. Free trials run 14 days for Hexnode, Scalefusion, Jamf Pro and Iru, and 30 days for Intune, JumpCloud and ManageEngine.<\/p>\n\n\n\n<aside class=\"ok-callout ok-callout--tip\"><p><strong>Count users and devices separately<\/strong> Intune and JumpCloud charge per user, and the other tools charge per device. A team where everyone carries a phone and a laptop pays for one license on the per-user tools and two on the per-device ones. Add your own device count before you compare the quotes.<\/p><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-remove-mdm-from-a-device\">How to remove MDM from a device<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Whether MDM can be removed depends on who owns the device and how it enrolled. On a company-owned iPhone or Mac enrolled through Automated Device Enrollment, the admin chooses whether users can remove the enrollment profile. If removal is blocked on a supervised device, only the management service can remove it. Vendors report that a wiped device still assigned to an MDM server in Apple Business enrolls again in Setup Assistant, so a factory reset doesn't free it.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Enrollment type<\/th><th>Who can remove management<\/th><th>What leaves with it<\/th><\/tr><\/thead><tbody><tr><td>Company iPhone or Mac, Automated Device Enrollment<\/td><td>The admin, or the user if the admin allows it<\/td><td>Everything the profile installed; the admin can also erase the device<\/td><\/tr><tr><td>Apple device enrolled with a profile<\/td><td>The user can remove the profile<\/td><td>All configuration profiles, settings and managed apps tied to it<\/td><\/tr><tr><td>Personal iPhone with User Enrollment<\/td><td>The user, at any time, by signing out of the Managed Apple Account<\/td><td>Organizational data and apps only<\/td><\/tr><tr><td>Android fully managed<\/td><td>The admin<\/td><td>A wipe is a factory reset<\/td><\/tr><tr><td>Android with a work profile<\/td><td>The admin or the user<\/td><td>A wipe removes only the work profile<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For a leaver, choose the action first. In Intune, Wipe is a factory reset that removes all personal and organizational data, while Retire removes company data and leaves personal data on the device. Retire is the right action for a personal phone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-mdm-leaves-open-who-owns-the-accounts-behind-it\">What MDM leaves open: who owns the accounts behind it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An MDM setup rests on a handful of accounts and tokens that nobody reviews: the account that created the Apple push certificate, the integration that links the MDM to a directory, the service account a sync job runs under. The Apple certificate alone expires every year and can only be renewed by the account that created it. When the admin who set it up has left, that account is often the last thing anyone finds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The IT Lead covers that gap. It imports service accounts from a CSV, asks the nominated owner to confirm ownership and purpose by email and keeps the review trail. It doesn't manage devices, rotate passwords or connect to your MDM, and it reads from CSV today. For the device inventory side, see our guide to <a href=\"\/blog\/it-asset-management-software\/\">IT asset management software<\/a>. For the vaulting side of the same problem, see our guide to <a href=\"\/blog\/privileged-access-management-software\/\">privileged access management software<\/a>.<\/p>\n\n\n\n<aside class=\"ok-product ok-wide\" id=\"the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div><p class=\"ok-product__eyebrow\">What these tools don&#x27;t answer<\/p><p class=\"ok-product__head\">Know who owns every service account, and when it was last reviewed.<\/p><p>The IT Lead imports service accounts from CSV, nominates owners, collects their attestations and keeps a review trail an auditor can follow. Built for small IT teams and MSPs.<\/p><\/div><a class=\"ok-product__cta\" href=\"https:\/\/theitlead.com\/\">See how it works<\/a><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-tool-to-pick\">Which tool to pick<\/h2>\n\n\n\n<ul class=\"ok-rows\"><li><span>Microsoft 365 Business Premium or E3 already in place<\/span><strong class=\"ok-go\">Microsoft Intune, with Plan 1 included in the license<\/strong><\/li><li><span>Fewer than 30 Apple devices and no budget<\/span><strong class=\"ok-go\">Mosyle free plan<\/strong><\/li><li><span>An Apple-only fleet with an admin who will script<\/span><strong class=\"ok-go\">Jamf Pro, after a quote<\/strong><\/li><li><span>Mostly Macs and iPhones, fast setup<\/span><strong class=\"ok-go\">Iru (formerly Kandji), after a quote<\/strong><\/li><li><span>Windows, Android and Apple with published prices<\/span><strong class=\"ok-go\">Hexnode, from $2.2 per device per month<\/strong><\/li><li><span>Company-owned Android tablets or kiosks<\/span><strong class=\"ok-go\">Scalefusion<\/strong><\/li><li><span>A server you can host yourself<\/span><strong class=\"ok-go\">ManageEngine Mobile Device Manager Plus<\/strong><\/li><li><span>An MSP already on NinjaOne or a team on JumpCloud<\/span><strong class=\"ok-go\">NinjaOne or JumpCloud, to avoid a second console<\/strong><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"faq\">FAQ<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is mobile device management software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Mobile device management software lets IT enroll phones, tablets and laptops in a central console, push settings and apps to them, enforce security rules such as a passcode and encryption, and locate or wipe a lost device. Most products also support personal devices through a work profile or a limited enrollment type.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is there a free MDM software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, there is free MDM software, with limits. Mosyle's free plan covers up to 30 Apple devices, ManageEngine Mobile Device Manager Plus is free for up to 25 devices, and Jamf Now's product page says up to three devices are free. Google Workspace includes basic mobile management at no extra charge.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the most popular MDM software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>We found no independent market-share figure for the most popular MDM software that we could verify. By Capterra rating count among the nine tools here, ManageEngine Mobile Device Manager Plus has the most ratings at 937, followed by Jamf Pro at 547 and Iru at 500.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can MDM be permanently removed?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>On a personal device the user can usually unenroll, which removes the organization's data and apps. On a company-owned Apple device enrolled through Automated Device Enrollment, the admin decides whether the user can remove the profile, and a wiped device assigned in Apple Business enrolls again at setup.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How much does MDM software cost?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>MDM software prices range from $1 per device per month for Apple-only Mosyle to $9 per user per month for JumpCloud. Intune Plan 1 is $8 per user per month and is included in Microsoft 365 Business Premium and E3. Jamf, Iru and NinjaOne give quotes only.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need MDM for personal phones?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You don't always need MDM for personal phones. Mobile application management protects company data inside apps without enrolling the device, which Microsoft supports for unenrolled iOS and Android devices. MDM adds enrollment, app deployment and device compliance, but on a personal device it controls far less.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<ul class=\"ok-related ok-wide\"><li><a href=\"\/blog\/it-asset-management-software\/\"><span>Software<\/span>Best IT asset management software for small IT teams<\/a><\/li><li><a href=\"\/blog\/privileged-access-management-software\/\"><span>Software<\/span>Best privileged access management software for small IT teams<\/a><\/li><li><a href=\"\/blog\/jumpcloud-pricing\/\"><span>Pricing<\/span>JumpCloud pricing: plans, modules, billing rules and real costs<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Mobile device management software compared for small IT teams: nine tools, published prices, enrollment paths, free tiers and who should skip each.<\/p>\n","protected":false},"author":1,"featured_media":100,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-99","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software"],"_links":{"self":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/99","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/comments?post=99"}],"version-history":[{"count":1,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/99\/revisions"}],"predecessor-version":[{"id":108,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/99\/revisions\/108"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media\/100"}],"wp:attachment":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media?parent=99"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/categories?post=99"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/tags?post=99"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}