Mobile Device Management (MDM): Secure and Manage Your Business Mobile Fleet

Why Mobile Devices Need Management

Mobile devices — smartphones and tablets — are used by most business employees to access email, Teams, cloud files, and business applications. Unlike managed laptops, mobile devices often lack consistent security controls: devices may not have screen locks enforced, apps may not be managed, and if a device is lost or stolen there may be no way to remotely wipe business data.

Kaspersky blocked 2.8 million mobile malware incidents per month in 2024 — approximately 33.3 million mobile attacks in 2024 overall (broadly equivalent to the surge levels of early 2021). (Kaspersky)

Cyber Essentials Plus (CE+): Same 5 controls but with independent technical testing/audit (Computer Weekly)

Capita group: £14 million (Capita plc + Capita Pension Solutions) — data loss following cyber attack (Urmconsulting)

For businesses subject to data protection obligations, a lost unmanaged mobile device containing business email is a potential data breach. MDM addresses this by applying minimum security requirements to all devices that access business systems, and providing the capability to remotely wipe data if a device is compromised.

Company-Owned vs BYOD

MDM approaches differ depending on whether devices are company-owned or employee-owned (BYOD — Bring Your Own Device). Company-owned devices can be fully managed — security settings, installed applications, and even device configuration can be centrally controlled. Employee-owned BYOD devices require a more nuanced approach to respect personal privacy whilst still enforcing minimum security requirements for business data access.

Microsoft Intune supports both models. For BYOD, Mobile Application Management (MAM) policies can be applied to specific business applications — controlling whether data can be copied out of the Teams or Outlook app, for example — without managing the personal device itself. AMVIA configures the appropriate MDM or MAM policy based on your device ownership model.

Security Policy Enforcement

Intune allows AMVIA to enforce minimum security requirements on all enrolled devices: a screen lock PIN or biometric; encryption of device storage; a minimum operating system version; and restrictions on specific device capabilities where policy requires it. Devices that do not meet these requirements can be blocked from accessing corporate data via Conditional Access policies in Microsoft 365.

This compliance-based access control is a significant improvement over unmanaged access. Rather than simply trusting any device that has the right credentials, Conditional Access verifies that the device meets your security policy before allowing it to access business data.

App Deployment and Management

MDM enables centralised deployment of business applications to managed devices. AMVIA configures an app catalogue in Intune — staff can install approved applications from a managed list without needing IT to be involved for each deployment. Apps can also be force-installed on all devices — useful for mandatory security tools, authentication applications, or business-critical mobile apps.

App configuration policies can pre-configure applications with corporate settings — email account configuration, VPN settings, or app-specific security policies — reducing the manual setup required when a new employee enrolls their device.

Remote Wipe and Loss Response

When a device is lost or stolen, AMVIA can issue a remote wipe command through Intune. For company-owned devices, this performs a full factory reset. For BYOD devices enrolled via MAM, a selective wipe removes only corporate data and applications, leaving personal content intact. AMVIA's recommended procedure includes immediate account password reset alongside the device wipe to prevent credential-based access from the compromised device.

This capability is important not just for security but for demonstrating due diligence under UK GDPR if personal data was accessible on the device. The ability to demonstrate that a remote wipe was performed promptly is relevant to breach notification assessment.

AMVIA's Managed MDM Service

AMVIA configures and manages the Intune MDM environment as part of the managed mobile service. Device enrolment is handled through a self-service process that AMVIA documents and trains your team to follow for new devices. Policy updates and compliance reviews are managed centrally by AMVIA. Monthly reports confirm enrolled devices, compliance status, and any policy exceptions. AMVIA provides support for enrolment issues and MDM-related helpdesk queries.