Mobile Device Management (MDM) for Small Business
Protecting business information on a personal phone starts with deciding what the business needs to control. NetSys helps choose between device enrollment and supported app protection, explains the visibility staff should expect, and scopes ongoing management.
The short answer
Mobile device management (MDM) for small business means enrolling company laptops, phones and tablets in a management service, usually Microsoft Intune, so encryption, updates and access rules apply everywhere, and protecting work apps on personal phones without managing the whole device. NetSys sets it up, adds Jamf for Mac-heavy teams and runs it month to month.
List company phones and tablets separately from personal devices, shared equipment and contractor access. Record which applications people need, what happens when a device is unsupported, and whether a company-owned alternative is available. The management decision should support the job and explain its effect on the person using the device.
A written BYOD policy should describe enrollment, visible device information, required apps, support boundaries and the process for departure or loss. Technical controls must match that policy. For the platform implementation and Windows provisioning work, our Intune management service provides a separate deployment scope.
Test work access and the exit process on each platform
Agree the ownership model, supported apps and access rules, then test a representative company device and personal-device scenario. Check what administrators can see, what users are asked to accept and what a supported removal action actually does. Record exceptions and explain which conditions can block access. Train support staff to select an appropriate action for the device’s ownership and platform instead of treating every lost phone as a full-wipe case.
What the mobile device management scope should define
Ownership and enrollment choices
Pick the management model before applying controls.
- Company-owned, shared, personal and contractor device groups
- Supported platforms, versions, apps and enrollment prerequisites
- Staff notice, support boundaries and alternatives for incompatible devices
Work applications and access
Protect the business tasks the device must support.
- Supported app-protection and data-transfer restrictions
- Platform-appropriate passcode, encryption and update requirements
- Device or app access conditions, exceptions and remediation ownership
Privacy and staff communication
Explain the actual visibility of the chosen configuration.
- Device and managed-app information visible to administrators
- A pilot demonstration of the staff enrollment and support experience
- An agreed policy for personal use, support access and change notices
Loss, departure and retirement
Distinguish a requested action from completed removal.
- Named contacts for reporting loss and authorizing device actions
- Account-access response alongside supported retire, selective-wipe or reset actions
- Status checks, recovery considerations and documented unresolved devices
Policies matched to real devices and working arrangements
Tell us which devices the company owns, which personal devices reach business data and the applications staff need. We will scope the management model, staff communication, pilot and continuing support.
Who does the work: meet the NetSys team on our About page.
- Device enrollment and app protection compared before choosing a tool
- Privacy information explained by ownership type and platform
- Offboarding steps designed with support, account access and action-status checks
Mobile Device Management in practice
- Private schools
Private K-8 school
Management of 180 student devices and 35 faculty laptops, content filtering, account security, and classroom Wi-Fi support.
- Healthcare
Home healthcare agency
Mobile device protection for 73 phones and tablets, secure email access, and remote removal of company data from lost devices.
- Construction and trades
Commercial HVAC service company
Management of 90 technician tablets, mobile security policies, remote device locking, and standardized application deployment.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
Intune, Jamf or both
Most small businesses need only Intune. The choice turns on how many Macs you run and what your Mac users need:
| Your fleet | What we set up | Why |
|---|---|---|
| Mostly Windows, some Macs, on Business Premium | Intune for every device, with Windows Autopilot and Apple Business Manager enrollment | Intune is already licensed in Business Premium and manages Windows, Mac, iPhone, iPad and Android from one console |
| Mac majority, or Mac users with heavy workloads | Jamf for the Macs and Intune for Windows and phones, joined through Jamf's device compliance integration | Jamf goes deeper on Apple devices, and compliance still feeds your Conditional Access rules |
| Personal phones that open work email | Intune app protection on Outlook, Teams and the Office apps | Company data is protected and removable without enrolling the whole phone |
Jamf is licensed per device on top of Microsoft 365, while Intune adds no license cost for users on Business Premium. Our Intune vs Jamf guide covers the trade-offs.
MDM onboarding checklist
The order we follow when a small business moves its devices under management:
- Inventory: every laptop, phone and tablet sorted into company-owned, shared and personal
- Licensing: Intune confirmed in your Microsoft 365 plan, plus device licenses for shared equipment with no assigned user
- Apple push certificate: created under a company Apple ID and renewed every year, since a lapse breaks management of every Apple device
- Zero-touch enrollment: Windows Autopilot for PCs, Apple Business Manager for Macs and iPhones
- Compliance rules: encryption, passcode and OS version, tied to Conditional Access in report-only mode first
- Pilot and staff notice: a small group enrolls first, and everyone is told in writing what the company can see
- Exit test: a retire and a selective wipe run on test devices before anyone relies on them
Setup and ongoing management are quoted per business. The MDM cost guide explains the license side, device by device.
Mobile Device Management FAQs
Do personal phones have to be fully enrolled?
Not always. Intune app-protection policies can protect supported work apps without full device enrollment in supported scenarios. Enrollment provides additional device controls. Choose based on the application, platform and access requirement, then test the user experience. An Android work profile is one option, not a universal description of how iPhone, Windows and Mac management works.
Can the company see personal photos or messages?
Microsoft states that Intune enrollment does not expose personal photos, message content or browsing history. Administrators can see device details, and app visibility differs with the platform and ownership configuration. Explain the actual configuration and any separately installed support or security tools in the staff policy; do not promise that the company can see no information about a personal device.
Can you immediately wipe a lost device?
We can scope the supported response, but remote actions depend on platform support, the device or app checking in and its condition. Retire, selective app-data removal and full reset have different effects. A request in the console is not proof that an offline device completed it. Account-access controls and follow-up checks belong alongside any device action; a fixed minutes-to-wipe promise would be misleading.
Will removing work access delete personal data?
The intended outcome depends on the selected action and management model. Supported app-selective removal targets business data in protected apps; a full factory reset can remove personal and business data. The approved process should distinguish them, confirm ownership and test representative devices. Review backups and recovery needs before destructive actions.
What determines mobile device management pricing?
Count the device platforms and ownership groups as well as users. Enrollment cleanup, application support, staff communication, licensing and offboarding requirements affect setup and ongoing work. Intune Plan 1 is included in Microsoft 365 Business Premium, but that does not include every add-on or the NetSys engineering service. The proposal should identify these separately.
Can MDM manage laptops as well as phones?
Yes. Despite the name, mobile device management covers Windows and Mac laptops too. Intune enforces BitLocker or FileVault encryption, pushes updates and apps, and keeps a non-compliant laptop away from company email through Conditional Access. New Windows laptops can ship straight from the supplier and configure themselves at first sign-in with Autopilot.
Does a small business need MDM?
Yes, if company email or files reach laptops and phones. Without it, a lost device or a departing employee can leave with company data, and nothing stops an unpatched machine from signing in. App protection is often enough for personal phones, while company-owned devices should be fully enrolled and managed.
Sources and technical references
- Microsoft: app protection with and without enrollment
- Microsoft: information visible after enrollment
- Microsoft: retire actions and device check-in
- Microsoft: Intune licensing
- Microsoft: the Apple MDM push certificate, required for Apple devices and renewed yearly
- Microsoft: integrating Jamf Pro with Intune for device compliance
- Apple: Apple Business Manager User Guide
- Microsoft: Windows Autopilot overview
Guides on this topic
- Plan Intune implementation and Windows provisioning
- Coordinate device access with tenant security
- Scope ongoing accounts and tenant administration
- Questions to answer in a BYOD policy
- offboarding a departing employee
- home care agency IT questions
- MDM cost per device: Intune and the alternatives
- Intune vs Jamf for a mixed Windows and Mac fleet
- Windows Autopilot: zero-touch laptop setup for small business
- Intune Plan 1 vs Plan 2 vs Suite: Pricing Explained
Related services
Choose a management model staff can understand.
Share the device types, ownership arrangements and business apps you need to protect. We will define the policy, implementation and support responsibilities.