Mobile device management

View as Markdown Open in ChatGPT Open in Claude

Mobile device management (MDM) lets you manage phones, tablets, TVs, and computers through the management protocol built into their operating system, without installing the Outpost agent. It is for IT departments and MSPs who manage company phones, personal devices that access company data, and Macs and PCs that need settings only the operating system’s own management channel can apply. You manage MDM devices in the same console, with the same profiles, as your endpoints.

Providers

Outpost supports three MDM providers. Each one uses the vendor’s own protocol.

Provider	Devices
Apple	iPhone (iOS), iPad (iPadOS), Mac (macOS), and Apple TV (tvOS)
Android Enterprise	Android phones and tablets
Windows	Windows PCs, through the MDM client built into Windows

ChromeOS is not supported.

Outpost turns each provider on separately, and providers become available as Outpost enables them. While a provider is not available for your account, new enrollments and commands for it are refused with the message “Device management is not available for this account yet.” Devices already enrolled keep checking in, and nothing is erased or unenrolled because a provider is unavailable.

How it works

Outpost brokers the vendor credentials

Apple and Google each require an MDM vendor to hold credentials of its own: Apple’s MDM vendor certificate, and Google’s Android Management service account. Outpost holds these and brokers every request that needs them. Your Outpost never holds them, including a self-hosted one. What you hold are the credentials that belong to your organization or your client, such as an Apple push certificate or an Apple Business Manager token.

One device record

A device enrolled in MDM appears as one device record. A Mac or PC that runs the Outpost agent and is also enrolled in MDM stays one record, with agent tools and MDM actions together. Outpost joins the two only when the device’s serial number and hardware UUID both match exactly. When only one of them matches, or several records match, Outpost holds the enrollment for a technician to accept or reject, and nothing merges on its own.

On a device with no agent, agent actions such as scripts and remote desktop are not available.

Profiles drive MDM settings

MDM settings come from the same profiles that configure your endpoints. Outpost translates the resolved policy for each device into the form its provider expects: Apple declarations and configuration profiles, an Android Management policy, or Windows configuration service provider settings. When MDM can deliver a setting on a Mac or PC, MDM delivers it and the agent does not apply it as well.

Secrets in an MDM setting, such as a Wi-Fi password, are references to a stored credential. A profile never holds the secret itself.

Delivery you can follow

Each setting and command a device receives has a delivery timeline. It shows each stage, from queued and sent to the device, through acknowledged or failed, to the status the device reports back. A failure carries a plain explanation and a suggested fix alongside the raw code from the device.

Lost mode and locate

A device’s Device management tab shows where it was last found:

Apple and Android devices. While lost mode is on, the Lost mode card shows when it was Turned on, the Message on screen, the Phone on screen, the Ticket, and the Last location with its accuracy and time. Until a locate answers, it reads No location yet. Use Locate in the actions menu to ask the device.
Windows PCs. Windows has no lost mode. After a Locate, the Last located card shows the position the PC reported from Windows location services, with its accuracy and time. If location is off on the PC, or apps may not use location, the PC answers without a position, and its delivery timeline says which setting to turn on.

Every locate is recorded in the audit log.

Ownership

Every enrollment is either corporate or personal (BYOD), and the enrollment method decides which. Corporate devices are fully managed. On a personal device, Outpost manages only the work side, and actions that reach into the person’s own data, such as locating the device or erasing all of it, are refused. See Enrollment methods and What IT can see on enrolled devices.

Sensitive actions need two people

By default, erasing a device, clearing Activation Lock, and locking many devices at once use a two-person rule: one technician requests the action and a second approves it. By default, an owner can also override and approve alone after a step-up verification. The two-person rule does not apply on Home Lab.

Plans

MDM is planned for every plan. The planned counting is:

Phones, tablets, and TVs do not count as billable endpoints.
A Mac or PC counts once, whether it has the agent, MDM, or both.
Home Lab is planned to allow up to 15 mobile devices.

See Plans and limits for the plans as released.

Permissions

Permission	Lets a technician
`mdm:read`	View MDM enrollments, device status, delivery timelines, and approvals.
`mdm:enroll`	Create enrollment links and tokens, and accept or reject device merges.
`mdm:command`	Send commands such as sync, restart, lock, locate, and lost mode.
`mdm:wipe`	Request a wipe, Activation Lock clear, passcode clear, bulk lock, or unenroll.
`mdm:approve`	Approve, reject, or override requests for those actions.
`mdm:manage`	Manage MDM credentials, identity providers, compliance rules, imports, and settings.

Owner, Support Manager, Field Technician, and Support Rep hold mdm:read. Owner, Support Manager, and Field Technician also hold mdm:enroll, mdm:command, and mdm:wipe. Owner and Support Manager hold mdm:approve and mdm:manage. See Roles and permissions.

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.