Mobile device management, usually shortened to MDM, is the pairing of an operating system protocol with a server-side service that lets an organisation configure, restrict, update, lock and erase phones, tablets and computers it does not physically hold. It exists because a handset issued to an employee carries company email, credentials and data, and the employer needs to enforce a passcode, push an application or wipe a lost device without collecting hardware from every desk. The same control plane reaches settings advertisers depend on. On a fully managed iPhone, one restriction switches off app tracking altogether, whatever the person holding the phone might prefer.

How an enrolled iPhone takes instructions

Apple's implementation is the most thoroughly documented. A device enrols either by installing a profile or automatically at setup, when the hardware was bought through Apple or an authorised reseller. After that the management server never contacts the device directly. It asks the Apple Push Notification service (APNs) to wake it, and the push carries almost nothing: according to Apple's developer documentation, the JSON message holds only a PushMagic string under an mdm key. The device then polls the server, processes the queued command, reports the result and checks for more.

Settings travel as configuration profiles, property list (plist) payloads grouped by function. The Restrictions payload alone exposes 209 keys, according to the independent Apple Device Policy Explorer, and many work only on supervised devices, a higher-control state used mainly for corporate hardware. The APNs certificate must be renewed yearly with the Apple Account that created it, according to Kandji's documentation; a lapse cuts the server off from every enrolled device.

In June 2021 Apple introduced Declarative Device Management (DDM). Instead of issuing a command and checking back, the server declares a desired state, and the device applies it, maintains it and reports changes itself. Support began with user enrolments on iOS 15 and reached every enrolment type with iOS 16 and macOS Ventura, according to Apple. As of September 2026, Apple's public schema repository corresponds to iOS 26.4.

Android and Windows take other routes

Google's Device Administration API arrived with Android 2.2 in 2010. Android 5.0 added the fully managed device(device owner) and the work profile (profile owner), which walls work apps and data into a separate container on a personal phone. Google deprecated device admin for enterprise use in Android 9 and removed those functions in Android 10, where the affected policies throw a SecurityException.

Windows speaks the Open Mobile Alliance Device Management (OMA DM) protocol, exchanging instructions in SyncML, an XML-based language. Configuration service providers (CSPs) on the device map each instruction to a registry key or file. The task scheduler makes the client poll the server at intervals, and Windows accepts one MDM server at a time, according to Microsoft. OMA DM version 1.1.2 was approved in December 2003; version 1.2.1, published in June 2008, remains the current approved release.

Enrolment modes and operators

Ownership decides the mode. Corporate hardware is typically enrolled at first boot and supervised, giving administrators wide powers to erase, lock and restrict. Employee-owned phones used for work are treated more lightly. Apple's User Enrollment, announced in 2019 for iOS 13, keeps managed data on a separate encrypted volume destroyed at unenrolment, and withholds the serial number and IMEI from the server, which receives an enrolment ID instead. The employer, in return, cannot erase the whole phone and can enforce only a six-digit passcode.

IT and security teams run these systems, using software from vendors such as Microsoft Intune, Jamf, Workspace ONE and Hexnode, and increasingly from the platform owners. Apple's deployment guide notes that not every restriction is available in every management service.

Where advertising meets the management layer

MDM sits above the consent prompts on which mobile advertising strategy rests. Apple's key forceLimitAdTracking, available since iOS 7, limits ad tracking and, according to Apple's schema, also disables app tracking and the Allow Apps to Request to Track setting. A second key, allowApplePersonalizedAdvertising, added in iOS 14 and macOS 12, limits Apple's own personalised ads. Both are forbidden under User Enrollment, so only fully managed hardware can carry them.

Such a phone never displays the App Tracking Transparency (ATT) prompt. The Identifier for Advertisers (IDFA) stays unavailable, and attribution falls back to SKAdNetwork. Consent is already a minority outcome: Adjust put average opt-in at 38 per cent in the first quarter of 2026, as PPC Land's mobile measurement partner explainer records. No public dataset shows how many devices carry the managed restriction.

Android's identifier survives on different terms. Google said in 2022 it would bring Privacy Sandbox to Android and eventually retire the advertising ID, yet the Attribution Reporting API was withdrawn on October 17, 2025, and ChatGPT Ads now accepts the Google Advertising ID for audiences. Google also calculates no match rate for lists of mobile device identifiers.

Managed status can remove ads entirely: Apple Maps shows none to educational Managed Apple Accounts. On desktops, enterprise policy is one of the few settings that sticks; Chrome's Gemini Nano model returns after deletion unless disabled through flags or enterprise policy tooling.

Origins and evolution

Research In Motion launched the BlackBerry in 1999, and BlackBerry Enterprise Server pushed Exchange mail and policy to handsets, which industry histories describe as the first system able to control devices on the move. Operators and manufacturers later standardised over-the-air management through OMA DM.

2010 was the turning point. Apple added MDM to its mobile platform, Google shipped device administration, and Microsoft launched Windows Intune in April, renaming it Microsoft Intune in 2014. Gartner published its first Magic Quadrant for mobile device management in 2011, recast the category as enterprise mobility management (EMM) in 2014, and on July 23, 2018 replaced it with unified endpoint management (UEM), advising infrastructure leaders to plan for the switch.

Apple's Device Enrollment Program (DEP) launched in 2014, and Apple Business Manager merged it with the Volume Purchase Program in 2018. Sources disagree on the later rename to Automated Device Enrollment: Fleet places it in December 2019, while Scalefusion dates the old portal's retirement to January 14, 2021.

Why it matters for the marketing community

For most of its life MDM was IT plumbing. That changed on March 24, 2026, when Apple announced Apple Business, combining device management, email, brand tools and Maps advertising in a free product that launched on April 14 in more than 200 countries and regions. Device management had been a paid Business Essentials tier sold only in the United States. The console replaced Business Connect, Business Manager and Business Essentials, and a business must claim its location there before buying Maps ads. An organisation's IT administrator and its local marketer now share one Apple account, with custom roles determining who can touch what. Apple's Irish and South African announcement pages omit the line about reaching local customers found in the United States version, a gap that mirrors the North American limit on Maps ads.

Agencies meet the same control plane from the other side. Google Ads has required passkeys for sensitive actions since July 15, 2026, and the passkey explainer notes that enterprise single sign-on is no substitute and shared logins cannot carry device-bound credentials. AI tools follow the pattern: OpenAI's ChatGPT Work, announced on July 9, 2026, gives administrators control over browser and network access.

Limitations, criticisms and disputes

The protocol's power is also its risk. In July 2018 Cisco Talos disclosed a campaign that had enrolled 13 iPhones in India into an open-source MDM server and pushed modified WhatsApp and Telegram builds that exfiltrated messages, contacts and location. Logs showed activity since August 2015. Apple revoked five associated certificates. Because enrolment needs user approval at each step, Talos suspected social engineering or physical access.

User Enrollment is a negotiated answer to privacy on employee-owned phones, not a settled one: it narrows employer visibility by weakening control. Fragmentation draws complaints too, since capabilities differ by vendor and many restrictions require supervision. Iru, a management vendor, says Apple has signalled deprecation of legacy commands from the 26 releases; Apple's schema does mark keys such as forceOnDeviceOnlyDictation deprecated in 26.4.

The tracking switch also interacts with a contested framework. France fined Apple 150 million euros over ATT in March 2025, Germany has given Apple four months to redesign the prompt, and a four-year study found ATT moved 0.07% of apps to paid downloads. Those disputes concern the prompt's design. A managed restriction removes the prompt altogether.

Not the same as

Mobile application management (MAM) governs specific apps and their data rather than the device; Citrix's MAM-only mode was untouched by Android's device admin deprecation.

EMM and UEM are broader categories. EMM added app and content control; UEM extends one console to PCs and other endpoints.

Mobile measurement partner (MMP) attributes installs through a tracking SDK and has no authority over device settings. Master data management shares the abbreviation but concerns enterprise records.

Manufacturer control differs as well. An original equipment manufacturer can alter phones remotely, typically to sell lock-screen inventory rather than enforce employer policy.

Recent developments

Maps campaign creation opened on August 14, 2026 with a 15 per cent credit capped at 1,000 US dollars a month. Weeks earlier Apple rewrote its advertising terms to cover platforms it does not own, and on July 30 reported a June quarter advertising record without disclosing revenue. New hardware is joining the managed estate: when Snap opened SPECS glasses pre-orders on September 16, 2026, it said it was working with device management vendors on enterprise controls, naming none.

Timeline

  • 1999: Research In Motion launches the BlackBerry, managed through BlackBerry Enterprise Server
  • December 2003: OMA DM version 1.1.2 approved
  • June 2008: OMA DM version 1.2.1 published
  • 2010: Apple adds MDM to its mobile platform; Android 2.2 introduces the Device Administration API
  • April 2010: Microsoft launches Windows Intune
  • 2011: Gartner publishes its first Magic Quadrant for mobile device management software
  • 2014: Apple launches the Device Enrollment Program; Gartner renames the category enterprise mobility management; Windows Intune becomes Microsoft Intune
  • 2014: Android 5.0 ships with device owner and work profile modes
  • July 2018: Cisco Talos discloses a malicious MDM campaign against 13 iPhones in India
  • July 23, 2018: Gartner publishes its first Magic Quadrant for unified endpoint management tools
  • August 2018: Android 9 deprecates device admin for enterprise use
  • 2018: Apple Business Manager merges DEP and the Volume Purchase Program
  • June 2019: Apple announces User Enrollment for iOS 13 and macOS Catalina
  • 2019: Android 10 removes deprecated device admin policies
  • January 14, 2021: Apple's legacy deployment portal retired, according to Scalefusion
  • April 26, 2021: App Tracking Transparency arrives with iOS 14.5
  • June 2021: Apple introduces Declarative Device Management at WWDC
  • June 2022: Apple extends Declarative Device Management to all enrolment types, effective with iOS 16 and macOS Ventura
  • March 31, 2025: French competition authority fines Apple 150 million euros over ATT
  • October 17, 2025: Google retires the Attribution Reporting API on Android
  • March 24, 2026: Apple announces Apple Business with built-in MDM
  • April 14, 2026: Apple Business replaces Business Connect, Business Essentials and Business Manager
  • July 28, 2026: Revised Apple Advertising Services terms take effect
  • August 14, 2026: Apple opens Maps ad campaign creation in the United States and Canada
  • September 16, 2026: Snap opens SPECS pre-orders and cites work with MDM vendors

Summary

Who: Platform owners Apple, Google and Microsoft define the management protocols; vendors such as Microsoft Intune, Jamf, Workspace ONE and Hexnode build the servers; corporate IT and security teams operate them. Advertisers, agencies and measurement firms are affected when managed settings suppress tracking prompts or identifiers.

What: A system for remotely enrolling, configuring, restricting, updating, locking and erasing devices. Apple's version wakes devices through APNs and delivers plist configuration profiles, with Declarative Device Management layered on top; Android uses fully managed and work profile modes; Windows uses OMA DM and configuration service providers. On managed iPhones, the forceLimitAdTracking key disables app tracking and the ATT prompt.

When: Enterprise mobile control dates to BlackBerry in 1999 and OMA DM in the early 2000s. Apple, Google and Microsoft all shipped management frameworks in 2010, Gartner reframed the category as UEM in July 2018, Apple added declarative management in June 2021, and Apple Business launched on April 14, 2026.

Where: On company-owned and employee-owned phones, tablets, computers and new device classes such as smart glasses, administered through cloud consoles, with Apple Business available in more than 200 countries and regions.

Why: Organisations need to protect data on devices they cannot physically control. For marketers the term matters because the management layer can override consent-based tracking, because Apple now sells Maps advertising from the same console that manages devices, and because account security rules are moving credentials onto the managed hardware agencies use every day.