Mobile device management (MDM) is the software and practice of enrolling phones and tablets into an organisation’s control, applying their settings and apps, and acting on them remotely for their whole working life. Evaluate it in three passes: which devices and ownership models it must serve, who holds policy authority and management data, and whether each lifecycle step works on the models you actually run. MDM governs the device and its configuration; it does not inspect attacks inside an individual app. Otukan device management runs Android fleets through Android Enterprise and Apple fleets through Apple’s device management framework.
Fleet scope
Ownership decides the enrolment mode
Who owns the device determines how much of it management may reach. Each platform has its own modes, and a mode on one platform tells you nothing about the other.
| Ownership | Android | Apple devices | What management reaches |
|---|---|---|---|
| Company-owned, work only | Fully managed device | Supervised device through Automated Device Enrollment | Settings, apps, restrictions and wipe for the whole device |
| Personally owned | Work profile | User Enrollment | Work apps and work data only |
| Shared or single-purpose | Dedicated device | Supervised device with Single App Mode or Shared iPad | Approved apps and a locked-down interface |
Operating systems and models
A fleet rarely runs one model or one OS version. List the models, the OS versions in service and the enrolment channel each group arrives through, then test policy on each combination rather than assuming that one model’s behaviour carries to the next.
Operating model
Policy authority
Decide who writes policy, who approves exceptions and who may run a remote wipe. Otukan separates these roles, so a help-desk operator can locate a device without being able to erase it, and every action is recorded in an audit trail against a named administrator.
Integrations
MDM rarely stands alone. It usually reads groups from your directory, issues device certificates through your certificate services, pulls apps from managed app stores and passes compliance state to your security tooling. Ask which of these links your workflow depends on, and test each one.
Owned versus partner functions
Three parties share the work. The platform provider supplies the management framework and bulk-enrolment channels. The MDM service turns your policy into device commands and records the result. Your team owns policy, approvals and the fleet itself. With Otukan you also decide where management data lives and when supplier support may reach your tenant.
For data residency and administrator control, see data and administrative control.
Lifecycle
- Provisioning. A new device joins through bulk enrolment or a documented manual route and receives its group’s policy and apps before first use.
- Change. A policy update reaches the group and each device reports whether it applied.
- Recovery. A lost device is locked or wiped remotely, and a reset company-owned device returns to management at setup.
- Offboarding. Work apps, data and certificates are removed, and the device leaves inventory with a record of who retired it.
Verify each step on your real models before you roll out across sites.
How Otukan applies mobile device management
Otukan enrols Android fleets through Android Enterprise and Apple fleets through Apple’s device management framework, applies policy per device group and shows on each device whether that policy arrived. Lock, restart and wipe run from the console, and reset company-owned devices return to management where the platform allows it. You decide where management data lives and when supplier support may reach your tenant. Device makers can also offer Otukan management to their own customers, with a separate tenant for each.
The full product is covered on mobile device management. Mobile application management, which governs app data rather than the whole device, is covered on what is mobile application management. More definitions are in the mobile security glossary.