What MDM Does
Mobile device management lets you control company phones, tablets and laptops from one central console. With it you can:
- Require a PIN or biometric lock and device encryption
- Push company apps, Wi-Fi, VPN and email settings automatically
- Keep the operating system up to date
- Locate, lock or wipe a lost device
- Remove only the company data from a personal phone when someone leaves
- Block access to company email and files from devices that do not meet the rules
Company-Owned Devices vs BYOD
The first decision is who owns the device.
- Company-owned devices can be fully managed. You control the apps, settings and updates, and can wipe the whole device.
- Bring your own device (BYOD) needs a lighter touch. Instead of managing the whole phone, you protect only the company apps (Outlook, Teams, OneDrive) with app protection policies. Staff keep their privacy; you keep control of company data.
Most UAE SMEs end up with both: managed laptops and company phones for some roles, and app protection on personal phones for everyone else.
Which MDM Tool?
If you already use Microsoft 365, start with Microsoft Intune. It is included in Microsoft 365 Business Premium and in the larger enterprise plans, so many companies already pay for it without using it. It manages Windows, iPhone, iPad, Android and Mac, and works with Conditional Access to block devices that are not compliant. Other good options exist for Apple-only fleets or rugged Android devices, but for most offices Intune is the simplest choice.
Setting Up MDM: Step by Step
- 1. Write a short device policy. Who gets a company device, what is allowed on personal phones, and what happens when someone leaves.
- 2. Check licences. Make sure each user has a plan that includes Intune.
- 3. Connect Apple and Android. Set up the Apple push certificate, Apple Business Manager for company iPhones and Macs, and Android Enterprise for Android devices.
- 4. Create compliance policies. Minimum OS version, PIN required, encryption on, and no jailbroken or rooted devices.
- 5. Create app protection policies for BYOD. Block copy and paste from Outlook to personal apps, require a PIN for company apps, and allow selective wipe.
- 6. Turn on Conditional Access. Only compliant devices or protected apps can reach email and files.
- 7. Pilot with a small group, fix any issues, then roll out to everyone with a short guide for staff.
Common Mistakes
- Fully enrolling personal phones, which upsets staff and raises privacy concerns
- Paying for Business Premium but never switching Intune on
- Policies with no Conditional Access, so unmanaged devices can still log in
- No offboarding step, so leavers keep company email on their phones
- Forgetting laptops: Windows and Mac devices need the same protection as phones
MDM and Data Protection in the UAE
UAE data protection rules and many client contracts expect you to protect personal and business data, including on mobile devices. Encryption, a lock screen, the ability to wipe lost devices and records of which devices hold company data are simple, visible controls that help show you take this seriously. They also help with cyber insurance questionnaires.
Bringing It Together
Decide your company and BYOD rules, use Intune if you have Microsoft 365, protect the apps on personal phones, fully manage company devices, and use Conditional Access to enforce it. VOWTECH sets up and manages mobile device management and Microsoft 365 for businesses in Abu Dhabi and Dubai.