Mobile / UEM & Device Management
Manages and secures mobile and endpoint fleets.
Overview
UEM/MDM enforces configuration, patching, and encryption across laptops, phones, and tablets; mobile threat defense adds on-device threat detection. Essential for BYOD and distributed workforces. Licensed per managed device. Often paired with conditional-access identity policies.
Device hygiene and control for distributed and BYOD fleets.
Advantages
- Intune bundled with M365
- Jamf best-in-class for Apple
- unifies config, patch, and remote wipe
- supports BYOD.
Trade-offs
- Intune weaker outside Microsoft/Apple depth
- mobile threat defense often a separate add-on
- BYOD privacy friction.
Open-source option
Open-source UEM is emerging, not turnkey. Fleet (osquery-based, cross-platform, primarily posture/inventory) and Headwind MDM (Apache-2.0, Android-only device management, self-hostable — now listed below) both cover real pieces of the space, but mature Apple/Windows UEM with full app, compliance and zero-touch workflows remains commercial (Intune, Jamf, Omnissa). Also note: since 2026, Google Play Protect blocks Headwind's custom launcher builds on standard GMS-certified Android devices, narrowing its practical footprint to AOSP/custom-ROM fleets.
Vendors & tools in this area
Unified endpoint management (UEM), independent since the VMware EUC spin-off.
Visit site →Self-hostable, Apache-2.0 Android MDM — the concrete open-source option behind this area's 'partial' verdict.
Visit site →Cross-platform UEM (iOS/Android/Windows/macOS/Linux/ChromeOS) with strong kiosk-mode support.
Visit site →