What Is Mobile Device Management?

Mobile device management enforces configuration and policy on phones, tablets and increasingly laptops. It is the mechanism by which an organisation retains some control over data on devices it may not own and cannot physically reach.

Corporate and personal devices need different models

On a corporate-owned device, full management is reasonable: enforce encryption and passcodes, control which applications may be installed, restrict data movement, and wipe the device if it is lost.

On a personally owned device the same approach fails — legally in some jurisdictions, and practically because staff object to their employer holding the ability to erase their photographs.

Application-level management addresses this by containerising corporate data: policy applies to the managed applications and their data, personal use is untouched, and a wipe removes only the corporate container. It is the model that survives contact with employee expectations.

What it genuinely delivers

Enforced encryption and screen locks, which is what protects data on a device left in a taxi. Conditional access integration, so device compliance becomes an input to whether corporate resources are reachable at all. Application control. Selective wipe on departure or loss. And a baseline inventory of which devices reach corporate data.

The conditional access link is the highest-value connection. A device that falls out of compliance losing access to corporate data is enforcement rather than reporting.

The gaps worth knowing

Devices that are not enrolled are entirely outside it, which is why blocking access from unmanaged devices matters more than any policy applied to managed ones. Jailbroken or rooted devices can subvert controls, and detection is an ongoing contest. And data that leaves the managed container — screenshotted, copied, forwarded — is beyond its reach.

Enrolment is where policy meets consent

Personal device enrolment requires staff to accept management software on hardware they own, and resistance is reasonable rather than obstructive. Clarity about what the organisation can and cannot see is what makes programmes succeed.

Most modern platforms genuinely cannot read personal messages, photographs or browsing on a personally owned device under application-level management. Saying so explicitly, in writing, addresses the objection that otherwise drives people toward unmanaged access.

Where the organisation does retain broader capability, that should be equally explicit — and it is a strong argument for choosing the containerised model instead.

Operating system version support is the constraint that creeps up. Devices too old to receive security updates cannot be made safe by any policy, and a minimum version requirement enforced through conditional access is the mechanism that prevents an estate quietly accumulating unpatched hardware.

A common mistake worth avoiding

Whatever else is on the list, the answer worth establishing first is whether unmanaged devices can still reach corporate data. It is a question that can be settled in a day, it requires no procurement, and the answer determines whether the rest of the programme is addressing the largest exposure or a smaller one that happened to be easier to see.

Where to start

Check whether unmanaged devices can currently reach corporate email. In many organisations they can, which means the management programme covers the compliant devices and not the risk.

See securing the remote workforce. GuardsArm runs security risk assessments.