Mobile Device Management (MDM) for Small Business
Protecting business information on a personal phone starts with deciding what the business needs to control. NetSys helps choose between device enrollment and supported app protection, explains the visibility staff should expect, and scopes ongoing management.
The short answer
Mobile device management (MDM) for small business means enrolling company laptops, phones and tablets in a management service, usually Microsoft Intune, so encryption, updates and access rules apply everywhere, and protecting work apps on personal phones without managing the whole device. NetSys sets it up, adds Jamf for Mac-heavy teams and runs it month to month.
List company phones and tablets separately from personal devices, shared equipment and contractor access. Record which applications people need, what happens when a device is unsupported, and whether a company-owned alternative is available. The management decision should support the job and explain its effect on the person using the device.
A written BYOD policy should describe enrollment, visible device information, required apps, support boundaries and the process for departure or loss. Technical controls must match that policy. For the platform implementation and Windows provisioning work, our Intune management service provides a separate deployment scope.
Test work access and the exit process on each platform
Agree the ownership model, supported apps and access rules, then test a representative company device and personal-device scenario. Check what administrators can see, what users are asked to accept and what a supported removal action actually does. Record exceptions and explain which conditions can block access. Train support staff to select an appropriate action for the device’s ownership and platform instead of treating every lost phone as a full-wipe case.
What the mobile device management scope should define
Ownership and enrollment choices
Pick the management model before applying controls.
- Company-owned, shared, personal and contractor device groups
- Supported platforms, versions, apps and enrollment prerequisites
- Staff notice, support boundaries and alternatives for incompatible devices
Work applications and access
Protect the business tasks the device must support.
- Supported app-protection and data-transfer restrictions
- Platform-appropriate passcode, encryption and update requirements
- Device or app access conditions, exceptions and remediation ownership
Privacy and staff communication
Explain the actual visibility of the chosen configuration.
- Device and managed-app information visible to administrators
- A pilot demonstration of the staff enrollment and support experience
- An agreed policy for personal use, support access and change notices
Loss, departure and retirement
Distinguish a requested action from completed removal.
- Named contacts for reporting loss and authorizing device actions
- Account-access response alongside supported retire, selective-wipe or reset actions
- Status checks, recovery considerations and documented unresolved devices
Policies matched to real devices and working arrangements
Tell us which devices the company owns, which personal devices reach business data and the applications staff need. We will scope the management model, staff communication, pilot and continuing support.
Who does the work: meet the NetSys team on our About page.
- Device enrollment and app protection compared before choosing a tool
- Privacy information explained by ownership type and platform
- Offboarding steps designed with support, account access and action-status checks
Mobile Device Management in practice
- Private schools
Private K-8 school
Management of 180 student devices and 35 faculty laptops, content filtering, account security, and classroom Wi-Fi support.
- Healthcare
Home healthcare agency
Mobile device protection for 73 phones and tablets, secure email access, and remote removal of company data from lost devices.
- Construction and trades
Commercial HVAC service company
Management of 90 technician tablets, mobile security policies, remote device locking, and standardized application deployment.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
BYOD management: three ways to protect work data on personal phones
BYOD management is a choice about how much of a personal device the company touches. Intune offers three levels, and most small businesses use more than one:
| Option | What the company controls | What the company does not manage | Usually fits |
|---|---|---|---|
| App protection only, no enrollment | Work data inside protected apps such as Outlook, Teams and OneDrive: an app PIN, no copying into personal apps, and removal of work data from those apps | The rest of the phone: photos, messages and personal apps | Staff phones that only need email, Teams and files |
| A work profile (Android) or user enrollment (iPhone) | A separate work area with its own apps and settings | The personal side of the device | Staff who need more work apps, or Wi-Fi and VPN settings |
| Full enrollment of a company device | The whole device: settings, apps, encryption, updates and a full wipe | Nothing: the device belongs to the company | Company phones, tablets and laptops |
Microsoft notes that app protection works with or without enrollment, that Conditional Access should be used alongside it so the policies are enforced, and that Android devices need the Company Portal app installed even without enrollment.
MDM for laptops: what Intune sets on every company laptop
Mobile device management covers Windows and Mac laptops as much as phones. On a managed laptop, these are the settings that matter most:
| Setting | What it does | Why it matters |
|---|---|---|
| Zero-touch setup | Windows Autopilot or Apple Business enrollment configures the laptop at first sign-in | A new hire's laptop can ship from the supplier straight to their door |
| Disk encryption | BitLocker on Windows, FileVault on Mac, with recovery keys held centrally | A lost laptop is a lost device, not a data breach |
| Updates | Operating system and app updates on a schedule, with a deadline | An unpatched laptop is one of the most common ways in for an attacker |
| Compliance and Conditional Access | A laptop that falls out of compliance loses access to company email and files | The rule enforces itself, without anyone chasing users |
| Local admin rights | Everyday accounts run without administrator rights | Malware and unapproved software have a much harder time installing themselves |
| Retire and wipe | Company data removed, or the laptop reset, from the console | Departures and losses have a defined response, confirmed once the device checks in |
Intune, Jamf or both
Most small businesses need only Intune. The choice turns on how many Macs you run and what your Mac users need:
| Your fleet | What we set up | Why |
|---|---|---|
| Mostly Windows, some Macs, on Business Premium | Intune for every device, with Windows Autopilot and Apple Business (formerly Apple Business Manager) enrollment | Intune is already licensed in Business Premium and manages Windows, Mac, iPhone, iPad and Android from one console |
| Mac majority, or Mac users with heavy workloads | Jamf for the Macs and Intune for Windows and phones, joined through Jamf's device compliance integration | Jamf goes deeper on Apple devices, and compliance still feeds your Conditional Access rules |
| Personal phones that open work email | Intune app protection on Outlook, Teams and the Office apps | Company data is protected and removable without enrolling the whole phone |
Jamf is licensed per device on top of Microsoft 365, while Intune adds no license cost for users on Business Premium. Our Intune vs Jamf guide covers the trade-offs.
MDM onboarding checklist
The order we follow when a small business moves its devices under management:
- Inventory: every laptop, phone and tablet sorted into company-owned, shared and personal
- Licensing: Intune confirmed in your Microsoft 365 plan, plus device licenses for shared equipment with no assigned user
- Apple push certificate: created under a company Apple ID and renewed every year, since a lapse breaks management of every Apple device
- Zero-touch enrollment: Windows Autopilot for PCs, Apple Business (formerly Apple Business Manager) for Macs and iPhones
- Compliance rules: encryption, passcode and OS version, tied to Conditional Access in report-only mode first
- Pilot and staff notice: a small group enrolls first, and everyone is told in writing what the company can see
- Exit test: a retire and a selective wipe run on test devices before anyone relies on them
Setup and ongoing management are quoted per business. The MDM cost guide explains the license side, device by device.
Mobile Device Management FAQs
What is mobile device management (MDM)?
Mobile device management (MDM) is the software and process for enrolling company laptops, phones and tablets so the business can apply settings, security rules and apps to them, see whether they comply, and lock or wipe them if they are lost. In Microsoft 365 the MDM is Intune, which covers Windows, macOS, iPhone, iPad and Android. Its companion, mobile application management (MAM), protects work apps and their data on personal phones that are not enrolled.
Which MDM software should a small business use?
For a business on Microsoft 365 Business Premium, start with Intune: it is already licensed, manages Windows, Mac, iPhone, iPad and Android from one console, and feeds device compliance into Conditional Access. Add Jamf when Macs are the majority or Mac users have heavy workloads, joined to Intune so compliance still counts. Other MDM products exist, and our guide to MDM software for small business compares them.
What happens to devices when an employee leaves?
The account goes first: it is disabled and its sessions revoked, so nothing keeps working on any device. Company laptops and phones are then retired or reset and reassigned, and on a personal phone only the data inside the protected work apps is removed, leaving photos and personal apps alone. Each action is checked for completion, because a command sent to a device that is offline has not happened yet.
Do personal phones have to be fully enrolled?
Not always. Intune app-protection policies can protect supported work apps without full device enrollment in supported scenarios. Enrollment provides additional device controls. Choose based on the application, platform and access requirement, then test the user experience. An Android work profile is one option, not a universal description of how iPhone, Windows and Mac management works.
Can the company see personal photos or messages?
Microsoft states that Intune enrollment does not expose personal photos, message content or browsing history. Administrators can see device details, and app visibility differs with the platform and ownership configuration. Explain the actual configuration and any separately installed support or security tools in the staff policy; do not promise that the company can see no information about a personal device.
Can you immediately wipe a lost device?
We can scope the supported response, but remote actions depend on platform support, the device or app checking in and its condition. Retire, selective app-data removal and full reset have different effects. A request in the console is not proof that an offline device completed it. Account-access controls and follow-up checks belong alongside any device action; a fixed minutes-to-wipe promise would be misleading.
Will removing work access delete personal data?
The intended outcome depends on the selected action and management model. Supported app-selective removal targets business data in protected apps; a full factory reset can remove personal and business data. The approved process should distinguish them, confirm ownership and test representative devices. Review backups and recovery needs before destructive actions.
What determines mobile device management pricing?
Count the device platforms and ownership groups as well as users. Enrollment cleanup, application support, staff communication, licensing and offboarding requirements affect setup and ongoing work. Intune Plan 1 is included in Microsoft 365 Business Premium, but that does not include every add-on or the NetSys engineering service. The proposal should identify these separately.
Can MDM manage laptops as well as phones?
Yes. Despite the name, mobile device management covers Windows and Mac laptops too. Intune enforces BitLocker or FileVault encryption, pushes updates and apps, and keeps a non-compliant laptop away from company email through Conditional Access. New Windows laptops can ship straight from the supplier and configure themselves at first sign-in with Autopilot.
Does a small business need MDM?
Yes, if company email or files reach laptops and phones. Without it, a lost device or a departing employee can leave with company data, and nothing stops an unpatched machine from signing in. App protection is often enough for personal phones, while company-owned devices should be fully enrolled and managed.
Which BYOD management tools does a small business need?
For a business on Microsoft 365, usually just two things it may already own: Intune app protection policies for the work apps on personal phones, and Conditional Access to make sure those apps are the only way in. Business Premium includes both. A written BYOD policy that tells staff what the company can and cannot see completes it. Separate BYOD software is rarely needed unless the fleet is mostly Apple and managed with Jamf.
Can we require a PIN on work apps without enrolling staff phones?
Yes. An Intune app protection policy can require a PIN or fingerprint to open work data in apps such as Outlook, Teams and OneDrive, block copying that data into personal apps, and encrypt it, all without enrolling the phone. If the phone is lost or the person leaves, the work data can be removed from those apps while photos and personal apps stay untouched. The app applies the removal when it next checks in.
What should a BYOD policy say?
Which devices may reach company data and how: app protection only, a work profile or full enrollment. What the company can see on a personal device, and what it cannot, in plain words. Which apps are required, what happens when a device is lost, and what happens to work data when someone leaves. Who to call for support, and where support stops. Staff should sign it before enrollment, and the technical settings should match it exactly.
Sources and technical references
- Microsoft: app protection with and without enrollment
- Microsoft: information visible after enrollment
- Microsoft: retire actions and device check-in
- Microsoft: Intune licensing
- Microsoft: the Apple MDM push certificate, required for Apple devices and renewed yearly
- Microsoft: integrating Jamf Pro with Intune for device compliance
- Apple: Apple Business user guide (formerly Apple Business Manager)
- Microsoft: Windows Autopilot overview
Guides on this topic
- Plan Intune implementation and Windows provisioning
- Coordinate device access with tenant security
- Scope ongoing accounts and tenant administration
- Questions to answer in a BYOD policy
- offboarding a departing employee
- home care agency IT questions
- MDM cost per device: Intune and the alternatives
- Intune vs Jamf for a mixed Windows and Mac fleet
- Windows Autopilot: zero-touch laptop setup for small business
- MDM software for small business: products and a selection checklist
- Intune wipe vs retire vs fresh start: which action to use
- Intune Plan 1 vs Plan 2 vs Suite: Pricing Explained
Choose a management model staff can understand.
Share the device types, ownership arrangements and business apps you need to protect. We will define the policy, implementation and support responsibilities.