Mobile Device Management for Small Business: FAQ

Mobile device management for small business means enrolling the company's laptops, phones and tablets in a management service, usually Microsoft Intune, so passcodes, encryption, updates and access rules apply everywhere, and protecting work apps on personal phones without managing the whole phone. Intune is already included in Microsoft 365 Business Premium and lists at $8.00 per user per month on its own as of October 2026, so for most small businesses the real work is the setup, not the license.

Phones and tablets now hold as much company email, files, and login access as any laptop, and most small businesses manage them with nothing at all. This FAQ covers what mobile device management (MDM) does, what it costs, how it handles personal phones, and whether your business actually needs it in 2026.

By Latoya Reed for The NetSys Group, which has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, working on site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, Connecticut, and remote-first everywhere else.

Mobile device management best practices for small business

The order we follow, drawn from Microsoft's device guidance for Business Premium and our own onboarding checklist:

1. Sort every device. List each laptop, phone and tablet as company-owned, shared or personal, because each group gets a different level of control.
2. Fully enroll what the company owns. Microsoft recommends full MDM enrollment for company-owned devices. Personal phones can be protected with app protection policies instead, with enrollment restrictions that keep them out of full management.
3. Use zero-touch enrollment. Windows Autopilot for PCs and Apple Business, formerly Apple Business Manager, for Macs and iPhones, so new devices arrive already managed.
4. Write compliance rules. Encryption (BitLocker or FileVault), a passcode, a minimum operating system version and no jailbroken devices. Microsoft's recommended Windows settings also require Secure Boot, a firewall, a TPM and antivirus.
5. Tie compliance to access. Conditional access policies require MFA to enroll a device, block unknown platforms, and require a compliant device or a protected app before company mail opens. Start them in report-only mode.
6. Write the policy and tell staff. A BYOD policy that says what the company can see and do on each kind of device, shared in writing before enrollment, with a small pilot group first.
7. Renew the Apple push certificate every year. Create it under a company Apple ID, not a personal one, because a lapse breaks management of every Apple device at once.
8. Test the exit before you need it. Run a retire and a selective wipe on test devices, and pair every device action with disabling the account, because a command sent to an offline device has not happened yet.
9. Review non-compliant devices on a schedule. A device that has failed compliance for weeks is either lost, unused or a person working around the rules, and each needs a different answer.

Frequently asked questions about mobile device management

What is mobile device management?

Mobile device management is software that lets you set rules on the phones, tablets, and laptops that touch company data. From one console you can require a passcode and encryption, push email settings, block risky apps, and wipe a device if it is lost. It turns a pile of personal and company gadgets into something you can actually secure.

Does a small business really need it?

If staff read company email or open shared files on their phones, yes. Without MDM you have no way to enforce a screen lock, no way to remove access when someone leaves, and no way to wipe a stolen phone. For a five-person office that may feel heavy, but it is the difference between a lost phone being an annoyance and being a data breach.

What does Microsoft Intune cost?

Microsoft Intune, the most common MDM for businesses already on Microsoft 365, lists at $8.00 per user per month for Intune Plan 1 on its own as of October 2026, according to Microsoft's Intune pricing page. It is already included in Microsoft 365 Business Premium ($22.00 per user per month, paid yearly), E3, and E5, so many owners on Business Premium are paying for it without knowing. It is not included in Business Basic, Business Standard, or Office 365 plans. Our guide to MDM cost per device compares Intune with the published prices of other platforms.

Can we manage personal phones without controlling the whole device?

Yes. This is where app protection policies, sometimes called mobile application management, come in. Instead of managing the entire personal phone, you protect only the company apps on it. Work email lives in a container you can wipe, while the employee's photos, texts, and personal apps stay private and untouched. It is the usual answer for bring-your-own-device teams, and our BYOD policy FAQ covers the written rules that go with it.

Can MDM wipe a lost or stolen phone?

Yes, and you can choose how much to remove. A full wipe resets a company-owned device to factory state. A selective wipe pulls only the company account and data, leaving a personal phone otherwise intact. Either way, the command reaches the phone the next time it checks in, so disable the person's account and sign-in sessions at the same time; a wipe sent to a phone that is switched off has not happened yet.

What is the difference between MDM and MAM?

MDM manages the whole device: passcode, encryption, apps, and settings, which fits company-owned hardware. MAM, mobile application management, manages only the work apps and their data, which fits personal phones. Most small businesses run both: full MDM on devices they own, app protection on the personal phones staff use for work.

How long does it take to set up?

For a typical small business already on Microsoft 365, a basic Intune rollout takes a few days to a couple of weeks, depending on how many devices and policies you need. The first step is defining sensible policies, such as required passcodes, encryption, and which apps can hold company data. Enrolling devices after that is quick.

What happens to a device when an employee leaves?

With MDM in place, offboarding follows a set order. The account goes first: disable it and revoke its sessions so nothing keeps working on any device. Company laptops and phones are then retired or reset and reassigned, and on a personal phone only the data inside the protected work apps is removed, with each action checked for completion. Without MDM, that data can walk out the door with them. Our IT offboarding checklist covers the full departure process.

What is included when NetSys manages mobile devices?

We set up Intune for laptops, phones and tablets, add Jamf for Mac-heavy teams, and run the service month to month. The scope covers the ownership and enrollment decisions for each device group, app protection and access rules for work apps, a plain written explanation of what administrators can see on each kind of device, and the loss, departure and retirement process, including who may authorize a wipe. Our Intune vs Jamf comparison explains when the second tool earns its place.

How does MDM onboarding work?

We inventory every device, confirm Intune in your Microsoft 365 plan and add device licenses for shared equipment, create the Apple push certificate under a company Apple ID, and set up zero-touch enrollment through Windows Autopilot and Apple Business. Compliance rules go in next, tied to conditional access in report-only mode first. A small pilot group enrolls after everyone is told in writing what the company can see, and a retire and a selective wipe are tested before anyone relies on them. The remaining devices then enroll in waves.

What affects the cost of MDM for a small business?

Count device platforms and ownership groups as well as users. Enrollment cleanup, the apps to support, staff communication, licensing and your offboarding requirements all move the setup and ongoing work. Intune Plan 1 is included in Microsoft 365 Business Premium, but that license does not include every add-on or the engineering work, so a proposal should list them separately. NetSys quotes per business, month to month, without a published rate card.

Who handles support and escalations for lost devices?

NetSys engineers. Named contacts in your business, agreed during onboarding, report a lost device and authorize the response, and the help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern, with monitoring and emergency service 24/7. Each remote action is followed by a status check, and a device that has not confirmed the action stays on an open list until it does.

Mobile device management with NetSys

The full scope of what we run, from enrollment and BYOD work-profile separation to conditional access and lost-device response, is laid out on our mobile device management service page, and our Intune management page covers the Microsoft side.

Book a call if you want mobile devices locked down without turning IT into a second job. We'll scope an MDM setup that fits your team and your Microsoft 365 plan.