What is MDM? How mobile device management has changed over the past 10 years

Ten years ago, getting a new starter up and running meant a laptop on an imaging bench, a technician with a USB stick and the best part of a day. Today, the same laptop can ship straight to someone’s home, set itself up the first time it is switched on and be ready to work before they have finished their coffee. 

That change is down to cloud-based MDM working alongside zero touch tools such as Windows Autopilot, which take a device that already has its operating system installed by the manufacturer and configure it automatically. Mobile device management has quietly gone from a niche tool for corporate phones to the backbone of how organisations look after every laptop, phone and tablet they own. This article explains what MDM is, how it has evolved over the past decade and where it is heading next. 

Key takeaways 

• MDM applies device-level controls centrally, such as settings, passcodes, updates and remote wipe, with the scope of control depending on how each device is enrolled. 
• Over the past 10 years, device setup has moved from imaging benches to cloud-based, zero touch enrolment, with the manufacturer installing the operating system and MDM configuring everything else. 
• Modern MDM covers Windows and Mac computers as well as phones, which is why it now sits at the centre of endpoint management. 
• What has not changed is that MDM works at the device level, which makes full enrolment a poor fit for many personal phones. 
• The next wave is already arriving: AI assistance inside tools such as Microsoft Intune and more advanced features included in standard licences.

What is mobile device management? 

Mobile device management is a way of controlling devices from one central console rather than one at a time. Once a device is enrolled, IT can push settings to it, require a passcode, encrypt it, install apps, keep it updated and, if it goes missing, lock or wipe it remotely. 

An MDM device is any phone, tablet or computer that has been enrolled in that system. From that point on it checks in regularly, receives its policies automatically and reports back on whether it meets your security standards. How much IT can control depends on the type of enrolment: a company-owned device can be fully managed, while personal enrolment options such as Apple User Enrolment or an Android work profile limit IT to a separate work space. 

That definition has not changed much in a decade. Almost everything about how MDM is delivered has. 

MDM in 2016 vs MDM in 2026 

Ten years of MDM: how we got here 

2016: separate tools and imaging benches 

In the mid 2010s, most organisations managed Windows PCs with on premises tools such as Configuration Manager, and treated mobile phones as a separate problem with a separate MDM product. New laptops were built from a standard image by IT, a separate step from MDM, before being handed over. Microsoft’s own cloud service, then called Windows Intune, had been around since 2011 and could manage Windows, iOS and Android devices, but most organisations used more established products to manage their phones. It worked, but it was slow, labour intensive and tied to the office. 

2017 to 2019: zero touch arrives 

The big shift came when devices learned to set themselves up. Microsoft introduced Windows Autopilot in 2017, letting a new Windows device enrol and configure itself straight out of the box. Apple’s automated enrolment and Android’s zero touch enrolment became mainstream for company-owned devices, and Microsoft introduced co-management so organisations could move workloads from Configuration Manager to Intune gradually. 

Personal devices got more attention too. In 2019 Apple introduced User Enrolment with iOS 13, separating work data from personal data on employee-owned iPhones. Android’s work profile did a similar job, creating a managed space for work apps alongside the user’s own. 

2020 to 2022: remote everything 

The pandemic turned zero touch from a nice idea into a necessity. IT teams suddenly had to set up, secure and support devices they might never see in person. Cloud-based MDM went from optional to essential almost overnight. Microsoft launched Windows 365 cloud PCs in 2021, managed through Intune, the same console as physical devices, and Apple announced declarative device management the same year, allowing devices to apply and report on settings more independently. 

2023 to 2026: consolidation and AI 

The last few years have been about bringing everything together. Microsoft launched the Intune Suite in 2023, adding advanced capabilities such as remote help and endpoint privilege management on top of core MDM. Windows 10 reached end of support in October 2025, pushing many organisations to refresh devices through modern, cloud-based deployment. In 2026, Microsoft began including several Intune Suite capabilities in Microsoft 365 E3 and E5, with Security Copilot integration in Intune for E5 customers. 

The result is that MDM today looks far less like a phone management tool and far more like the control centre for every endpoint in the business. 

How MDM works today 

Modern MDM follows the same lifecycle on every platform: 

• Enrol: devices register automatically through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise, or users enrol them through an app such as the Company Portal. 
• Configure: Wi-Fi, email, VPN and certificate settings are pushed automatically, so users do not have to set anything up. 
• Secure: passcodes, encryption, update rules and restrictions are enforced, and each device is marked as compliant or not. 
• Control access: in Microsoft environments, Conditional Access uses that compliance status to decide whether a device can reach company data.
• Retire: when a device is lost, stolen or replaced, IT can lock it, wipe it or remove company data from it.  

Microsoft’s own overview of Intune covers the full list of capabilities if you want to go deeper. 

What is an example of mobile device management? 

It is easiest to see what MDM does through real situations. 

A new starter working from home 

A firm orders a new Windows laptop for a trainee and ships it directly to their home. When they sign in, Autopilot enrols it, applies the firm’s security settings, installs Microsoft 365 and line of business apps and encrypts the drive. IT never touches it. Getting this right is a big part of a smooth device rollout. 

Faster, more consistent builds 

Law firm Burges Salmon worked with Virtual Engine to transform its Windows build process across more than 1,000 devices. The result was a reliable build with an average build time of 40 minutes, backed by an ongoing managed service. 

Moving from one MDM to another 

Organisations often outgrow their MDM tool or want to make better use of the Microsoft licences they already pay for. Burges Salmon also moved its mobile device management to Microsoft Intune with Virtual Engine. The firm initially hesitated to migrate its iPhones because of the potential impact on its people, but the transition was completed swiftly with minimal disruption. 

What has not changed: MDM still works at the device level 

For all the progress, one thing is the same as it was in 2016. MDM is designed to apply controls at the device level, and with full enrolment that means the whole device. That is exactly what you want for company laptops and phones, but it is a much harder sell on someone’s personal phone. Some third party MDM tools still require full enrolment for BYOD, which means the organisation could in theory wipe someone’s family photos along with their work email. 

A simple example shows the difference. If a member of staff has no PIN on their personal iPhone, MDM could force a PIN on the whole phone. Mobile application management (MAM), which protects organisational data within supported apps and can work with or without device enrolment, instead puts a PIN on Outlook and other work apps, leaving the rest of the phone alone. Both close the gap, but only one asks the user to hand over control of their device. For personal phones, Virtual Engine usually recommends MAM, and for senior leaders who hold the most sensitive data, a company-owned device under full MDM is often the better answer. 

The other lesson of the past decade is that MDM works best as one layer, not the whole answer. On its own, it can tell you a device is not compliant. It takes Conditional Access to stop that device reaching company data, and app protection to control what happens to data once it is there. Organisations that configure one layer and assume they are done often leave gaps they do not know about, particularly on laptops and desktops, which have more settings and more ways to sign in than phones. That is why Virtual Engine documents every design decision and has it signed off before anything is built, an approach set out in full in our BYOD Control Framework. 

Where MDM is heading next

• Based on what Microsoft and Apple have already announced, three trends are likely to shape MDM over the next few years:
• More AI assistance. Tools such as Security Copilot in Intune are designed to help IT teams investigate issues and understand configuration faster.
• More capability in standard licences. Features that were once paid add-ons are moving into mainstream Microsoft 365 plans, so many organisations will already own more than they use.
• More self-managing devices. Declarative management and cloud-native deployment mean devices increasingly keep themselves compliant rather than waiting for IT.
• What will not change is the need for good design. More features mean more settings, and more settings mean more room for gaps.

Is your MDM still stuck in 2016?

If any of these sound familiar, your device management has not kept pace:

• New devices still need hands-on setup before they reach users
• Windows PCs and mobile phones are managed in different tools
• Compliance is reported but not used to block risky devices
• Personal phones are either fully enrolled or not protected at all
• Nobody is sure which policies are still needed or why they were created

Our endpoint management service takes on day to day Intune administration alongside your team, and our endpoint security and compliance service includes a policy review to find the gaps.

Bring your device management up to date

Whether you are still imaging devices by hand, inheriting a messy Intune tenant or deciding how to handle personal phones, Virtual Engine can help you modernise how you manage every endpoint. Explore The BYOD Control Framework to see how modern device management fits into a joined-up approach to personal and company devices.