Modern device management allows you to remotely monitor, provision, patch and secure your network endpoints to improve user experience, ensure productivity and protect your organization.
During the last thirty years, the concept of device management has been evolving away from legacy management models. This has all been aimed at finding a way to meet the monitoring, security, productivity and user experience demands that have always been a concern for every information technology (IT) department.
One post-legacy-models approach to modernizing device management introduced by operating system (OS) vendors? The concept of the Active Directory (AD) with centralized Group Policies (GPOs). Another approach involved third-party vendors adding device management solutions that supplied capabilities or functionalities the OS vendor couldn’t provide.
These approaches to device management were limited by three things:
When the first version of Apple’s iPhone OS (iOS) was launched, its management capabilities were based on profiles rather than permissions. This created a revolution in device management:
Learn More: Ivanti Mobile Device Management Solutions
The MDM concept evolved into enterprise mobile management (EMM) due to an initiative by Gartner in 2014 to merge several existing strategies, as laid out in their 2014 Magic Quadrant for Mobile Device Management (MDM).1
This new term merges other sub-categories and strategies that were previously considered separate:
Google eventually adopted an EMM management model with the launch of Android 5 and Android Enterprise (AE), providing native capabilities in their OS to manage it, deploy software, apply restrictions and safely allow access to corporate services.
Although there are different AE deployment models like iOS models, the high-level idea of centralized management and a sandboxed app model is the same. This is meant to ensure that an app cannot compromise the kernel of the device OS.
This approach to device management proved to be more efficient and compelling; usually, a single solution could provide the right level of security, control and visibility across all devices. At the same time, the organization can still provide its employees with secure access to corporate services, especially in the field.
Let’s pause a moment to assemble and define all the acronyms being deployed thus far and add in a new one: UEM.
|
MAM |
Mobile application management: Device management model focused on controlling the apps that access corporate data, but not the rest of the device. |
|
MCM |
Mobile content management: Management model focused on providing access to content for collaboration on devices. |
|
MIM |
Mobile information management: Management model focused on controlling the lifecycle of corporate data to keep it encrypted while controlling which apps can transmit it, but not the rest of the device. |
|
MDM |
Mobile device management: Management model focused on controlling devices and apps interacting with native MDM API, which is the only one with permissions granted to control and modify the kernel of the OS. |
|
EMM |
Enterprise mobile management: Term introduced in 2014 by Gartner as an effort to merge several of these models together. Theoretically, an EMM consists of an MDM and a MAM. |
|
UEM |
Unified endpoint management: The natural evolution of EMM is UEM, where a single console can manage a wide range of device types such as smartphones, tablets, desktops, laptops, servers, IoT devices, etc. This is possible because all of them share the same logic of a sandboxed OS, managed by a centralized (unified) management solution. |
The truth is, MDM and MDM are as close as twins. The meaning of the acronym has changed, and with good reason.
Remember the architecture Apple launched upon the IT world with the introduction of iOS? It was developed with education organizations in mind, but Apple plainly intended to jump into the enterprise market that had been ruled by historical players like Microsoft.
As part of this strategy, the iOS model has been gradually extended to macOS devices like desktops and laptops, and the device management API has been evolving on each version. Apple has increasingly moved macOS toward becoming a mobile-like managed OS with embedded security and managed native APIs.
The result of this (and similar moves by other providers, as we’ll see below) has been a nomenclature shift: what had been called “mobile device management” was now being applied within a network ecosystem where MDM tools were managing other (often remote) endpoints that weren’t mobile.
So today, devices like laptops and desktops — including those that are part of “bring your own device” (BYOD) scenarios — are enrolled in what we call “modern device management” systems that apply to all endpoints, not just mobile devices.
When Windows 10 was born, it was a shrewd approach on the part of Microsoft to introduce an “MDM/EMM”-like management model to modernize how IT has been managing devices since olden times. This was significant because Windows, despite inroads from competitors like Apple, is still installed on over 36% of endpoint devices.2
Windows 10 was not an evolution of Windows 7 and 8. Rather, it was an evolution of Windows Phone 8 and 10, where an MDM API was available to manage all aspects of a device, such as DLP, restrictions, software distribution and so on.
What was the sea change here? Windows 10 had adopted the approach taken by mobile OS to alleviate the task of onboarding and provisioning devices to its EMM solution. Suddenly, IT admins could manage Windows, macOS, iOS and Android devices from the same centralized platform.
At the same time, when Internet of Things (IoT) device providers started to adopt the “big four” OS for their purposes — such as Windows IoT, which also provides MDM/EMM capabilities, and Android AOSP, used in TVs, boxes, kiosks, dedicated devices and so on — the same device management capabilities began applying.
This is the point at which EMM evolved into unified endpoint management (UEM), where an IT department uses the technologies we’ve mentioned to centralize management of all devices across its network and display all insights and information about them through “a single pane of glass,” meaning from a single console.
That’s possible because UEM platforms are open to interacting with other solutions that use APIs to integrate into the UEM model. This allows solution providers to extend the services that modern managed devices can consume without compromising its sandboxed OS.
The importance of being able to manage varied devices that use varied operating systems becomes apparent when one considers the chart below.
Distribution of operating systems (OS) among enterprise endpoints in North America, Western Europe and Asia Pacific, as of 2022. Source: Statista
As we’ve just seen, MDM allows a network to automatically register and provision devices connected to the network. This removes a huge amount of repetitive work from the IT team, unburdening them to focus on other, more strategic challenges. Other benefits of MDM?
These latter benefits became vital when the pandemic arrived in early 2020. Most companies had to pivot fast and adopt a BYOD and laptop-based strategy (versus a historical fixed-desktop workplace) across the corporate network, protected by corporate perimetral security.
Today, users are still working remotely and demand the ability to connect from anywhere, anytime. So there’s a growing demand for secure network access to a mix of SaaS and on-premises solutions that can deliver service 24/7.
Because of this, other MDM-related concepts have taken center stage, such as Zero Trust Access, which dictates that a strict security level should be maintained regardless of whether a device is inside of the corporate network, or partially or fully managed.
Watch a Demo: Ivanti Neurons for UEM
The important concept to understand about modern device management as it’s applied to a desktop/laptop OS such as Windows or macOS? It’s that any restriction applied by the network administrators will always win out, even if the user has local admin rights.
This is a big point since most software is developed to run smoothly on any OS. When user permissions are restricted, this adds complexity in figuring out how to make software work properly without having to decrease the level of security.
Just as a network admin can set which apps are allowed to run on iOS and Android and provide different levels of autonomy for the user (depending on profiles), today’s Windows 10/11 and macOS admins can do the same. This removes the complexity of limiting user permissions to adopt the desired security.
The result is that Windows and macOS devices are automatically provisioned upon registration, allowing only the right software to run and removing any need for “hands-on” interaction from IT.
For example:
Learn More: More IT Jargon Explained
Right now, many vendors already provide apps that aim to complete MDM/EMM-focused management. The intention? To extend the level of control, provide more features, retrieve and analyze security data and fill in the gaps a modern device management API can’t address alone.
As with other device management advances, many of these innovations made their debut in the mobile OS realm, most notably in the form of management agent apps that provide capabilities such as:
In the case of Windows and macOS, these apps work in tandem with UEM-native configurations, accomplishing tasks that are critical but not included as part of the MDM API. This is especially conspicuous on desktop/laptop OS, such as Windows 10/11 and macOS, where several key actions still aren’t available as part of their MDM API. Examples include:
The solution to this disparity between mobile and desktop/laptop modern device management is to develop and deploy a mixture of both models. One that’s optimized to run smoothly wherever it’s deployed and includes even greater functionality. It’s what some analysts and vendors have predictably anointed “MDM 2.0.”
In this model, every device within the network is registered to a single, centralized UEM solution. Active and passive scans automatically discover, provision or patch them all, detecting any devices that aren’t managed or aren’t securely up to date and presenting security risks. The device fleet is also optimized to operate seamlessly with all the company’s service providers such as Office365, Salesforce, SAP and so on.
1 Messmer, Ellen. “Gartner Magic Quadrant Shifts Focus from MDM to Enterprise Mobility Management.” Network World, June 10, 2014. https://www.networkworld.com/article/2361467/gartner-magic-quadrant-shifts-focus-from-mdm-to-enterprise-mobility-management.html.
2 Taylor, Petroc. “Enterprise Device OS Distribution 2022.” Statista, February 27, 2023.
https://www.statista.com/statistics/741497/worldwide-enterprise-endpoint-operating-system-distribution