Mobile device management (MDM) and Mobile application management (MAM) are the two approaches to enterprise mobility management (EMM), which has the goal of managing and securing your mobile endpoints including employee laptops, tablets, and phones.
Effectively managing remote devices in the modern workforce is vital for IT security as well as employee productivity: MDM and MAM help prevent mobile devices from becoming a vector for cyber attacks, and stop them from being used for non-work-related tasks.
This guide explains what mobile device management and mobile application management are, how these IT security solutions work differently, and which you should deploy to protect your employee devices and IT infrastructure (including some practical use cases to demonstrate how they are used).
What is mobile device management (MDM)?
Mobile device management is the act of monitoring and managing mobile and remote devices including phones, tablets, laptops, and even desktop computers for remote workers. As the whole device is remotely managed, it allows you to do things like remotely lock or wipe the device (if it is lost or stolen), remotely manage which apps are installed, monitor device activity, enforce policies such as forcing automatic updates and security rules, and ensuring full device encryption is enabled.
MDM provides the most control over remote devices as it is usually enforced at the device level, allowing you to control how it is used and monitor and manage it. While this makes it an excellent choice for managing and securing mobile endpoints owned by your business, most employees will not be thrilled to enable MDM on their personal devices, even if they are using them for work.
Apple’s iOS, iPadOS, and MacOS all include built-in MDM functionality, as do Windows and Android devices. For visibility and management of a mixed-fleet of devices from different vendors, NinjaOne offers cross-platform mobile device management with additional functionality and unified control over remote devices.
What is mobile application management (MAM)?
Mobile application management takes a step back from MDM and involves only monitoring and managing single applications rather than whole devices. A MAM approach to enterprise mobility management is usually seen in a favorable light by employees who are working from their personal devices (known as bring your own device, or BYOD).
For example, MAM may be used to ensure that all activity within company email and team chat apps is tightly controlled and monitored while allowing the rest of the device to remain in the employee’s control. This lets you secure data and ensure that those apps are being used correctly (for example, in the event of the device being stolen, only the contents of apps controlled by MAM can be wiped, leaving the rest of the device alone), but it does mean that you have no control over what else might be installed on the device, which may include malicious code accidentally installed by the user.
MAM can be deployed for apps that have integrated mobile management functionality. Some will provide their own built-in mobile application management, while others can integrate with MDM/MAM platforms like NinjaOne and InTune for central management.
Making the choice: Key differences between MDM and MAM
Deciding between device-level vs application-level monitoring and management for remote workers using corporate or BYOD devices has security, complexity, and cost implications for your business. It can also impact how effectively your staff can use their devices.
You should weigh up the following factors when making your decision between MDM and MAM:
- Security: As MDM lets you manage the entire device, protection is enhanced because security policies can be enforced across the whole device. This prevents unauthorized application and user behavior, that in an MAM environment may be able to monitor or interact with your business apps without you being aware.
- Control: MAM can only control what happens within a MAM-enabled application, whereas MDM can control everything from device settings to application permissions and can even remotely track and wipe devices.
- Flexibility: MDM severely restricts what end users can do. MAM allows users to manage their own devices outside of managed applications, which is usually preferable from their perspective.
- Deployment and management complexity: MDM has higher management overheads as users cannot perform many tasks on their own devices, forcing them to request support from your IT team each time they want to install an app or make a configuration change.
- User privacy: Users (justifiably) do not like MDM being deployed to their personal devices, as it provides their employer control over their private data on a device they paid for (imagine your employer deleting your family photos due to an MDM misconfiguration).
- User experience and satisfaction: MDM is considered invasive and in some cases may fall foul of regulations that guarantee employees’ right to disconnect.
- Cost implications and ROI: MDM involves higher costs due to increased infrastructure and oversight responsibilities, whereas MAM is simpler to deploy and manage as it covers a smaller surface area. ROI calculations for MDM are more difficult, so you must assess the value of the devices and data that you are protecting. Conversely, MAM encourages BYOD, which can reduce business expenses.
- Customer data concerns: You should ensure that customer data concerns (such as GDPR and CCPA) are met by your MDM or MAM implementation and policies. This covers both data about your employees, and any customer data that may be stored on employee devices.
Part of assessing which mobile management processes and policies to implement for your organization should be to take full inventory of your devices and other IT infrastructure to ensure that the solution you choose is compatible with your existing hardware and software.
Use cases and benefits for MDM
The benefits of mobile device management are best realized when the business owns all of the devices being managed and highly sensitive or valuable data is at stake.
Healthcare providers commonly deploy MDM due to the sensitive health information they deal with, and the mobility of their staff (leading to easily lost devices). MDM allows them to enforce device-level encryption, ensure that access is controlled with passwords or biometrics, and only allow vetted and secured applications to be installed. If a device goes missing, it can be remotely wiped to ensure that no protected healthcare information can be improperly accessed.
Use cases and benefits for MAM
Mobile application management is best deployed in scenarios where employees are expected to use their own devices for work.
One example would be a plumbing contractor with staff who need to be able to communicate and coordinate from their own devices while out on jobs. MAM would be ideal here, as their company email and collaboration apps can be locked down, monitored, and wiped if an employee leaves, while leaving the rest of the device untouched. Employees are much more comfortable with this setup, meaning that the business is less likely to have to supply them with devices for work use only.
You must carefully assess whether MAM is appropriate for your situation. While it’s sufficient for most businesses and the data they handle, there are critical applications where MDM should be deployed with strict rules — for example if you develop popular password management tools.
MDM and MAM: Integration and coexistence
Large organizations may find a mixed approach best suits them: mobile device management can be deployed for important staff who handle the most sensitive data, while mobile application management can be deployed more widely for those whose responsibilities are fewer and who can be restricted to accessing only the limited data they require.
This allows you to supply secure devices only to those who need them, and encourage the savings BYOD brings businesses by having staff utilize their own phones, tablets, and computers. Integrating both MDM and MAM in an enterprise environment also limits the deployment and management overheads associated with MDM to be focused only where they are required.
Enterprise mobility management (EMM) is vital to securing your remote workforce
Whichever approach you choose, you should make sure that your enterprise mobility management and IT security solutions are as frictionless as possible for your users. You do not want users trying to work around your cybersecurity protections because you’re enforcing restrictions that prevent them from using their own devices or performing their job roles effectively.
NinjaOne provides a mobile device management and mobile application management platform that gives you visibility and control over your mobile workforce — allowing you to protect your data while also allowing your workforce to operate effectively.
