MDM in business: choosing and introducing device management
What device management changes for employees, IT and management, what it costs, who Intune, Mosyle, Jamf and Iru are meant for, and how a migration realistically runs.
With MDM in business, meaning central device management, you can set up devices, distribute apps and enforce security policies. Whether Intune or another MDM fits depends on your devices, your existing licences and the way you work. I explain the questions I settle before an MDM is introduced or replaced.
Sources: Kandji, Apple in the Enterprise 2024; price from the ALSO Cloud Marketplace, NCE licence on an annual term with monthly billing, as of September 2026.
Without an MDM: every device a special case
Ten devices is not a technical threshold. What matters is the point at which manual setup, updates, encryption and handovers can no longer be done reliably on the side. That can happen at five devices or only at twenty.
A new employee starts, and someone spends half a day setting up the laptop by hand. Three months later nobody knows whether the drive is encrypted. When they leave, the machine comes back or it does not, and the personal iPhone holding company mail stays exactly where it is. That is how it works in many companies without full-time IT, because the devices are looked after on the side.
What an MDM changes in a business
The new device arrives in its original packaging, joins the wireless network and largely sets itself up. Apps, mail, printers and VPN are installed automatically, without IT having to handle the device first.
Encryption is enforced, keys are held centrally, updates are steered rather than hoped for. Configuration, wireless settings and certificates reach the device automatically, compliance status is readable at any time, and local administrator rights can be granted in a controlled way rather than permanently, depending on the system.
How company data on the devices is protected can be shown device by device: encryption, update status, screen lock and access rules. Cyber insurers and larger clients now ask for exactly that.
An MDM is not a tool for monitoring staff. It manages devices and, depending on the platform, records things like device model, operating system, compliance status and installed company software. Private content such as personal messages or photos is not part of ordinary device management. Which data is actually visible depends on the system and the enrolment model, and should be settled before rollout.
What it costs
- Microsoft 365 Business Premium includes Intune, so you need no separate MDM licence. €20.01* net per user and month on a one-year term with monthly payment; slightly less when paid annually in advance, around a fifth more without any commitment. Many companies are already paying this without using the device management it contains.
- Mosyle offers a free edition for up to 30 devices, which lacks anti-malware, the app catalogue for the Mac and temporary administrator rights. The full Fuse edition costs 3 US dollars* per Mac and 1.50 US dollars* per iPhone or iPad a month, billed annually, from 30 licences upwards. Even 15 Macs therefore come to around 90 US dollars* a month.
- Jamf and Iru quote their prices on request. For Jamf Now, resellers put the figure at around 4 US dollars* per device and month.
What does Apple Business Manager have to do with an MDM?
Apple Business Manager (now called simply “Apple Business” by Apple) is not itself an MDM. It assigns company-owned Apple devices to an organisation and to an MDM system, so new Macs, iPhones and iPads can be taken into device management the first time they are switched on.
The division of labour is simple: Apple Business Manager assigns the device to the firm and to the MDM, the MDM supplies configuration, apps and security policy. It is not compulsory — you can also add Apple hardware by hand. For automated provisioning of company-owned hardware it is the central piece, and only that route makes enrolment binding.
Intune or a specialised Apple MDM?
Anyone running Microsoft 365 and managing Windows and Macs together should look at Intune first. Where the estate is almost entirely Apple, Mosyle, Jamf or Iru may be the better answer depending on the requirements.
Business Premium is already in place, Windows and macOS sit side by side, and Entra ID, Conditional Access and Defender are meant to work together with device state.
The estate is almost only Macs, iPhones and iPads, there are deep macOS-specific requirements, or strongly Apple-shaped deployment and automation processes.
Not the feature list, but which platform actually dominates and what is required of security, software distribution and automation.
I look after mixed Microsoft 365 environments as well as companies working almost entirely on Macs. So Intune is not automatically my answer just because Microsoft 365 is already there.
Four systems, four audiences
Manages Windows, macOS, iOS and Android from one platform and ties device state directly to Entra ID, Conditional Access and Microsoft Defender. It provisions, configures and secures Macs automatically through Apple Business Manager.
A pure Apple MDM with very good automation, usually supporting new Apple features on release day. Of interest where specialised Apple management with modest administrative effort is wanted, in agencies, law firms or studios for instance.
The established name in Apple management, with the greatest functional depth for macOS, an active community and its own security products. That depth also brings more administrative effort, and pays off above all where the requirements and the internal or external expertise exist.
Since the rebrand in October 2025, a platform that bundles device management, endpoint detection and vulnerability management into a single agent, covering Windows and Android alongside Apple.
Five questions that decide the choice
- Which devices do you actually have? Mainly Windows with a few Macs: Intune. Almost entirely Apple: Mosyle, Jamf or Iru.
- What has already been paid for? With Business Premium, Intune is on the premises. A second MDM needs a good reason.
- Who will run it? Jamf Pro takes time. Mosyle and Intune need less of it.
- Should security be part of it? Endpoint protection and compliance in the same tool: Iru, or Intune with Microsoft Defender.
- How do new devices reach the company? On Apple through Apple Business Manager and Automated Device Enrollment, on Windows through Autopilot and the matching provisioning in Intune. A device’s life cycle starts at purchase, not after setup.
The tool is the smaller part. Which devices belong to the company, which to the staff? What is compulsory, what is advice? Without those answers every system produces either sprawl or resistance in the team.
A migration is a project, not a click
Apple allows only one MDM per device. On migration each device leaves the old system and enrols in the new one. How much work that is depends on the state of the individual device.
- New or wiped: after reassignment in Apple Business Manager the device enrols itself in the new MDM at the next setup assistant. That is the easy case.
- Already in production: reassignment alone does nothing here. From iOS 26, iPadOS 26 and macOS 26, Apple Business can trigger the move with a deadline, and the device migrates to the new MDM without being wiped, provided it is managed through Automated Device Enrollment. On older versions: if the old MDM profile is removable, you can re-enrol the device without data loss. If it is not, the old system has to release it, or the device is wiped.
- Manually enrolled: Apple Business Manager does not know these devices. You have to handle them one by one.
Profiles, apps and recovery keys are rebuilt in every case. That is why changing MDM is a migration project and not a click. What this means for Macs in detail is covered in the article on enrolling existing Macs in Intune.
Frequently asked questions
How many devices do you need before an MDM pays off?
There is no fixed minimum. From around ten business devices upwards, central management often already pays off. What matters is the point at which you can no longer handle setup, updates, encryption and handovers reliably on the side, and that can come at five devices or only at twenty.
Do I need a separate MDM licence with Microsoft 365 Business Premium?
No. Business Premium includes Intune, at €20.01* net per user and month on a one-year term with monthly payment. A second MDM then needs a good reason, such as an estate made up almost only of Macs, iPhones and iPads.
Can the company see private data through the MDM?
Private content such as personal messages or photos is not part of ordinary device management. Depending on the platform, an MDM records things like device model, operating system, compliance status and installed company software. Exactly what is visible depends on the system and the enrolment model, and you should settle that before rollout.
How long does an MDM migration take?
* Prices net, as of September 2026. Licence prices may have changed since.
Sources
- Managing devices with Intune, macOS included: Microsoft Learn – deploy macOS devices in Intune
- Apple Business Manager, automated device enrolment and re-enrolment: Apple – Platform Deployment, in particular Re-enrol devices in MDM
- Business Premium price: ALSO Cloud Marketplace, NCE licence on an annual term with monthly billing, as of September 2026. Product description: Microsoft 365 Business Premium
- Pricing and scope of the Apple MDMs: Mosyle Business – Pricing, Jamf – Pricing, Jamf Pro pricing in 2026 (SuperOps) for the figures Jamf does not publish
- Iru, formerly Kandji: Iru – Platform Overview on platform coverage, endpoint detection and vulnerability management, Computerworld on the rebrand
- Apple device adoption: Apple in the Enterprise 2024 (Kandji, Dimensional Research)
IT for a new company: preparing workstations, Microsoft 365 and telephony
What a new company's IT needs on the first working day, what can wait, which early decisions become expensive later and what to budget for laptops, licences and a domain.
Read article→
Reinforcing in-house IT: support for projects and ongoing work
When in-house IT needs external reinforcement, how I share the work with the team, and why responsibilities and access rights have to be settled from the start.
Read article→
What does IT support cost? Comparing services and billing
How a flat fee for IT support comes about, what it includes, why I rarely use prepaid hours and what to clarify when you compare quotes.
Read article→