Skip to content 
Mobile Device Management (MDM)
Company phones, tablets and increasingly also laptops are managed centrally. This saves IT a lot of work – but can become a stumbling block during decommissioning. Here you will learn what Mobile Device Management is, what it can do and which steps are necessary before selling or returning devices.
In brief
Mobile Device Management (MDM) is software with which companies centrally set up, manage, secure and, when needed, lock or erase mobile endpoints such as smartphones, tablets and laptops. For this, the devices are registered in the MDM solution and receive policies, apps and settings remotely. During decommissioning, devices must be removed from the MDM and from the manufacturer programs, otherwise they often cannot be reused.
What can an MDM do?
An MDM solution is the control center for mobile devices. IT defines which settings apply and distributes them to all registered devices. Typical functions:
- Set up devices automatically without IT having to handle each device
- Enforce security policies, such as PIN requirements and encryption
- Install, update and remove apps
- Locate lost devices, lock them or erase them via Remote wipe Erasing
- Separate business and private data, for example with BYOD
Well-known solutions are, for example Microsoft Intune or MDM systems for Apple and Android devices. Today, people also often speak of Unified Endpoint Management (UEM) when the same solution additionally manages PCs and Macs.
Coupling to manufacturer programs
So that devices register themselves with the company when first switched on, they are additionally stored in manufacturer programs. For Apple, this is the Apple Business Manager, for Android Zero-Touch enrollment, for Windows Autopilot.
| Binding | Effect | Before decommissioning |
|---|---|---|
| MDM enrollment | Device receives policies and apps | Unenroll and remove in the MDM console |
| Automatic enrollment with the manufacturer | Device registers with the company again after every reset | Release in the manufacturer portal |
| Activation lock or account lock | Device cannot be set up again without account credentials | Remove the lock, for supervised devices often via the MDM |
Automatic enrollment is the trickiest binding: even after a factory reset, the device remains tied to the company. It is then unusable for buyers, and the resale value falls. How to release company iPads step by step is described in our guide Selling tablets without an MDM lock.
What to note when retiring devices
- Reconcile inventory: Which devices are registered in the MDM and in the manufacturer portal? Compare the serial numbers with the decommissioning list.
- Release bindings: Remove devices from the MDM, release them in the manufacturer portal and make sure the Activation Lock is lifted.
- Erase with certification: A factory reset alone is not proof. For accountability, you need an erasure certificate per device.
- Document: Record when which device was released and erased.
What applies specifically to smartphones is explained in the guide retiring company phones.
Relation to Second IT
Second IT erases smartphones and tablets with a certified erasure solution from Blancco and issues a digitally signed erasure certificate with serial number for each device. Devices that can be reused are refurbished and remarketed. More about data erasure for mobile devices.
Frequently asked questions about Mobile Device Management
Does a factory reset remove the MDM?
A factory reset removes the MDM profile from the device. However, if the device is automatically enrolled through a manufacturer program such as Apple Business Manager, it registers with the company again during setup. It must therefore be released in the manufacturer portal beforehand.
What is the difference between MDM and UEM?
MDM originally stands for the management of smartphones and tablets. Unified Endpoint Management (UEM) extends this to all endpoints, that is, also PCs, Macs and in some cases printers or IoT devices. In practice, the two terms are often used interchangeably.
Can a device with an MDM lock be sold?
As long as the binding exists, the device is hardly usable for buyers and has significantly less value. Remove the binding before handover. Only the company with which the device is registered can release it.
Is a factory reset enough as erasure proof for company devices?
No. A factory reset alone is not proof. For accountability, you need an erasure certificate per device. Also record when which device was released from the MDM and from the manufacturer portal and erased.
Which manufacturer programs additionally tie devices to the company?
For Apple, it is Apple Business Manager, for Android Zero-Touch enrollment and for Windows Autopilot. Devices stored there register themselves with the company when first switched on. Before decommissioning, they must be released in the respective manufacturer portal.
Erase and recover company phones and tablets with certification.
Send us your device list. You will receive your offer in 48 hours on average.