The Ultimate Guide to Mobile Device Management

The Stages of Device Lifecycle Management

While it is essential to understand the general concepts underlying MDM, this is only the first step towards actually implementing it for your business. You will need to plan for the entire device lifecycle, which can be analyzed as a sequence of five steps. These include:

• Enrollment: Bringing newly-acquired devices into your business network.
• Provisioning: Setting up initial configuration, security settings, apps, and content for employees and users to get started.
• Deployment: Getting provisioned devices in workers’ hands.
• Management: Monitor devices for compliance, push app updates, troubleshoot application and performance issues.
• Retirement: Removing devices from the system once they reach end-of-life (EOL).

Of course, some of these steps are more involved than others; deployment will likely be a quick process, while management is an ongoing process over several years. Yet each step has its own challenges and potential pitfalls, so it is worth addressing them in sequence.

Enrollment

The process of enrolling devices into a management framework is a daunting task, but it is essential. Depending on the tools available, this process may be almost fully automated, or it may require substantial effort on your business’ behalf.

If you are enrolling Android devices, you can rely on Android Enterprise to help with some steps of the enrollment process. If you are enrolling newly-released devices from select suppliers, you will be able to partake in Zero-Touch Enrollment (ZTE), This will allow you to set up and enroll devices before even turning them on.

If this is not supported, however, MDM solutions like SureMDM present a wide array of enrollment methods on Android, giving your business flexibility in how it begins the lifecycle management process. These include fast and easy techniques like scanning a QR code with each device to instantly enroll it. 

If you are enrolling Apple devices, you can streamline enrollment by purchasing devices from Apple Authorized Resellers. They will be able to help you register and enroll devices into Apple Business Manager (ABM) before you turn them on for the first time. Of course, you can also manually enroll devices into ABM via Apple Configurator. 

For Windows devices, you can use the Windows Autopilot program if you purchase devices through select resellers. Otherwise, you will need to enroll devices manually. You can accomplish this by downloading an MDM agent directly onto a given device, and connecting it to the MDM console. Alternatively, you can use Windows’ device management capabilities to enroll devices through Windows, provided you connect an associated MDM solution.  

For any other device type not covered above, you will mostly need to use manual enrollment methods. This means you (or an employee) will need to download an on-device agent, and then connect the device to the central console by hand. Some of the steps can be automated, but it’s often a time-consuming method. 

It’s worth noting that you may also wish to enroll employee-owned devices, in addition to business-owned devices. For these so-called BYO (“bring-your-own”) devices, or BYOD, enrollment depends on the operating system. Android and Apple devices allow employers to register employee-owned devices through Android work profiles and the Apple User Enrollment program, For Mac, Windows, and Linux devices, you will need to ask employees to download the on-device agent instead. 

If you are a veteran to the use of MDM, you may actually be looking to switch MDMs, rather than enrolling from scratch. In that case, it’s very important to talk with the company behind the MDM you are migrating towards, to ensure that a smooth transition is possible. You’ll also need to make sure that every device is unenrolled from the existing MDM and then enrolled into the new solution. 

This may seem obvious, but inventory-keeping between MDM solutions is quite difficult; you will save yourself an enormous headache by double-checking inventory at every step. On another note, different MDMs allow admins to assign device hierarchies in different ways; this may require manually mapping the hierarchies of one MDM solution onto another.

Provisioning

Now you have connected all your devices. It’s time to set them up with the apps and content they need, while preventing them from accessing irrelevant apps and content. This is tedious to do by hand for a small organization, and effectively impossible for larger ones; thankfully, you can rely on MDM to speed up the process substantially.

Different operating systems offer different ways to provision apps and content. On Apple devices, like iPhones and iPads, you can do this through ABM (Apple Business Manager). ABM has now subsumed the Volume Purchase Program (VPP) functionality that admins once needed to make this possible. For Android devices, on the other hand, admins will need to use the Managed Google Play Store for Android devices. 

On these and other platforms, you can use MDM functionality to create an Enterprise App Store. This is a private storage space for the apps that your employees and users can access at will. Rather than forcibly downloading the apps to the devices, an Enterprise App Store allows employees to access and download apps on their own time and when they need them. You can also implement an Enterprise File Store that follows the same logic, providing a safe space for employees to download essential files and documents.

Device Lockdown

If the devices you are provisioning will serve a dedicated purpose, you should consider locking the devices down. This means you are restricting the device from performing any activities you haven’t approved beforehand. Admins can choose either between single-app mode or multi-app mode, based on the needs of their employees. 

Device manufacturers often provide simple lockdown mechanisms of their own, but they typically require manual interaction with each device, which is infeasible at scale. This is another circumstance in which MDM can help you get a grip on many devices at once. 

On Windows devices, you can choose between using an MDM to set up a Kiosk Profile, or using a dedicated device lockdown solution like SureLock for Windows. For its part, Android offers a default Screen Pinning option, but this is very limited and requires manual setup and deactivation on each device. For this reason, most businesses use a device lockdown tool like SureLock instead. 

For iPhones and iPads, you can use Guided Access, a built-in feature, but its functionality is quite limited. It’s generally wiser to activate single-app mode, either through Apple Configurator or an MDM solution. Using an MDM solution provides you with the most management capabilities. 

You can extend device lockdown to Internet usage as well, if you need to keep users on specific websites. Some MDM solutions come with their own internet browsers, like SureFox by 42Gears. This way, you can prevent users from accessing suspicious websites and downloading any kind of malware that can jeopardize user and organizational data safety.

Deployment

Once you have provisioned devices, you can now begin the deployment process, sending devices out to the employees or users who will be using them. While this is a relatively straightforward process, there are a number of things that can go wrong. It’s worth reviewing what those things are, so you can make sure to avoid them and have a successful deployment. 

One important aspect of deployment that sometimes goes overlooked is making sure that every device has the appropriate security certificates installed. If there is any error in this regard, employees may be locked out of essential functions on the devices you provide them. As a result, it’s important to ensure users can report issues immediately, and get them fixed right away. Particularly for frontline workers using devices to stay safe in tough environments, security certificate issues could put users at serious risk. 

Another concern related to deployment is ensuring that network connectivity is always available. If a user gets a device with improperly configured Wi-Fi or data consumption settings, there should always be a way to configure a connection again. This can be a challenge many businesses face when devices are locked down and do not allow access to settings menus. With 42Gears’ lockdown software, you can choose to have connectivity settings menus automatically open when a device no longer senses a connection, making sure employees won’t be locked out of resources they need. Be aware that you must turn on these options before you deploy the devices.

In some instances, deployment may also see device users enrolling their new devices into an MDM solution. If admins don’t rely on resellers, and don’t want to manually set up each device, users can enroll devices themselves. Those users will need to follow on-screen instructions, but those instructions should be fairly straightforward. For example, they may need to scan a QR code to enroll devices. 

You should make sure that devices can complete authentication while being enrolled, especially if employees are enrolling devices themselves. Whether you choose Active Directory or another method, you should complete a proof-of-concept in advance to make sure it will work for your employees.

Management

Once employees have properly-provisioned devices in their hands, it is time to manage those devices. This is (ideally) by far the longest phase of lifecycle management, as most devices have a lifespan of at least a few years. 

It’s a daunting task to keep devices compliant, up-to-date, and functional for several years, but it’s made substantially easier through the use of mobile device management software. MDM software allows you to automate many aspects of management, and even when automation isn’t feasible, an MDM solution helps to resolve issues faster. 

Oftentimes, a single device needs access to a given resource at one time of day or location, but not at others. In these cases, an admin can create contextual rules known as fences. If devices are within the fence, a certain policy activates, but once the criterion for the fence is no longer fulfilled, the policy deactivates. Location-based geofencing, time-based time-fencing, and network security-based network-fencing can all go a long way towards ensuring responsible device use. 

You can also rely on the MDM console to update apps on devices remotely without the need for employees to take any action. This can take place as a silent update on devices employees are actively using, or you can choose to wait for periods of time when employees are not actively using devices. Remotely updating apps also confers a range of benefits, such as reducing device downtime and raising employee productivity. 

That said, it’s not always ideal to update every app as soon as updates become available. Sometimes updates have major issues that need to be resolved before it’s safe to download them. In these cases, admins can use MDM software to keep every device from updating that app, ensuring everyone stays on the same version of any given app. Without an MDM solution, keeping devices up to date is effectively impossible, requiring admins to manually inspect each device. 

One of the greatest challenges associated with any enterprise deployment is troubleshooting devices. If software stops working properly, this normally requires a technician to come fix a device in-person, or for employees to ship the device to the technician. Both possibilities are very expensive. Thankfully, in many instances, you can use an MDM solution’s remote control features to take control of devices remotely, and repair them remotely. This makes repairs faster and easier.

Another challenge tied to device management is the possibility of users consuming too much data. If the company is forced to pay for excess data consumption, it can be prohibitively costly to cover these costs at scale. With an MDM solution, you can monitor each device’s data consumption, send messages to users consuming too much data, and if necessary block data consumption altogether. The same goes for battery consumption; whether through irresponsible device use or failing device health, excessive battery use is a major problem. By tracking and notifying users when device battery levels decline, an MDM solution can keep devices from losing charge for longer.