---
title: "Mobile device management"
description: "Manage Apple, Android, and Windows devices through their native management protocols, alongside the Outpost agent. This feature is in preview."
url: "https://support.outpostplatform.com/mdm/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Outpost MDM (preview) manages Apple (iOS, iPadOS, macOS, tvOS), Android Enterprise, and Windows devices through their native protocols. No ChromeOS. Outpost brokers Apple and Google vendor credentials. Corporate and BYOD ownership. Profiles drive MDM settings. A Mac or PC with agent and MDM is one record. Destructive actions use a two-person rule."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "mdm:read"
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/mdm/index.md"
license: "CC BY 4.0"
---

# Mobile device management

Mobile device management (MDM) lets you manage phones, tablets, TVs, and
computers through the management protocol built into their operating system,
without installing the Outpost agent. It is for IT departments and MSPs who
manage company phones, personal devices that access company data, and Macs and
PCs that need settings only the operating system's own management channel can
apply. You manage MDM devices in the same console, with the same profiles, as
your [endpoints](/endpoints/).

## Providers

Outpost supports three MDM providers. Each one uses the vendor's own protocol.

| Provider | Devices |
| --- | --- |
| Apple | iPhone (iOS), iPad (iPadOS), Mac (macOS), and Apple TV (tvOS) |
| Android Enterprise | Android phones and tablets |
| Windows | Windows PCs, through the MDM client built into Windows |

ChromeOS is not supported.

Outpost turns each provider on separately, and providers become available as
Outpost enables them. While a provider is not available for your account, new
enrollments and commands for it are refused with the message "Device
management is not available for this account yet." Devices already enrolled
keep checking in, and nothing is erased or unenrolled because a provider is
unavailable.

## How it works

### Outpost brokers the vendor credentials

Apple and Google each require an MDM vendor to hold credentials of its own:
Apple's MDM vendor certificate, and Google's Android Management service
account. Outpost holds these and brokers every request that needs them. Your
Outpost never holds them, including a self-hosted one. What you hold are the
credentials that belong to your organization or your client, such as an Apple
push certificate or an Apple Business Manager token.

### One device record

A device enrolled in MDM appears as one device record. A Mac or PC that runs
the Outpost agent and is also enrolled in MDM stays one record, with agent
tools and MDM actions together. Outpost joins the two only when the device's
serial number and hardware UUID both match exactly. When only one of them
matches, or several records match, Outpost holds the enrollment for a
technician to accept or reject, and nothing merges on its own.

On a device with no agent, agent actions such as scripts and remote desktop
are not available.

### Profiles drive MDM settings

MDM settings come from the same [profiles](/automation/profiles/) that
configure your endpoints. Outpost translates the resolved policy for each
device into the form its provider expects: Apple declarations and
configuration profiles, an Android Management policy, or Windows
configuration service provider settings. When MDM can deliver a setting on a
Mac or PC, MDM delivers it and the agent does not apply it as well.

Secrets in an MDM setting, such as a Wi-Fi password, are references to a
stored credential. A profile never holds the secret itself.

### Delivery you can follow

Each setting and command a device receives has a delivery timeline. It shows
each stage, from queued and sent to the device, through acknowledged or
failed, to the status the device reports back. A failure carries a plain
explanation and a suggested fix alongside the raw code from the device.

### Lost mode and locate

A device's **Device management** tab shows where it was last found:

- **Apple and Android devices.** While lost mode is on, the **Lost mode** card
  shows when it was **Turned on**, the **Message on screen**, the **Phone on
  screen**, the **Ticket**, and the **Last location** with its accuracy and
  time. Until a locate answers, it reads **No location yet. Use Locate in the
  actions menu to ask the device.**
- **Windows PCs.** Windows has no lost mode. After a **Locate**, the **Last
  located** card shows the position the PC reported from Windows location
  services, with its accuracy and time. If location is off on the PC, or apps
  may not use location, the PC answers without a position, and its delivery
  timeline says which setting to turn on.

Every locate is recorded in the audit log.

## Ownership

Every enrollment is either corporate or personal (BYOD), and the enrollment
method decides which. Corporate devices are fully managed. On a personal
device, Outpost manages only the work side, and actions that reach into the
person's own data, such as locating the device or erasing all of it, are
refused. See [Enrollment methods](/mdm/enrollment/) and
[What IT can see on enrolled devices](/mdm/privacy/).

## Sensitive actions need two people

By default, erasing a device, clearing Activation Lock, and locking many
devices at once use a two-person rule: one technician requests the action and
a second approves it. By default, an owner can also override and approve alone
after a step-up verification. The two-person rule does not apply on Home Lab.

## Plans

MDM is planned for every plan. The planned counting is:

- Phones, tablets, and TVs do not count as billable endpoints.
- A Mac or PC counts once, whether it has the agent, MDM, or both.
- Home Lab is planned to allow up to 15 mobile devices.

See [Plans and limits](/account/plans-and-limits/) for the plans as released.

## Permissions

| Permission | Lets a technician |
| --- | --- |
| `mdm:read` | View MDM enrollments, device status, delivery timelines, and approvals. |
| `mdm:enroll` | Create enrollment links and tokens, and accept or reject device merges. |
| `mdm:command` | Send commands such as sync, restart, lock, locate, and lost mode. |
| `mdm:wipe` | Request a wipe, Activation Lock clear, passcode clear, bulk lock, or unenroll. |
| `mdm:approve` | Approve, reject, or override requests for those actions. |
| `mdm:manage` | Manage MDM credentials, identity providers, compliance rules, imports, and settings. |

Owner, Support Manager, Field Technician, and Support Rep hold `mdm:read`.
Owner, Support Manager, and Field Technician also hold `mdm:enroll`,
`mdm:command`, and `mdm:wipe`. Owner and Support Manager hold `mdm:approve`
and `mdm:manage`. See [Roles and permissions](/depot/roles-and-permissions/).

## Related

- [Enrollment methods](/mdm/enrollment/)
- [Apple devices](/mdm/apple/)
- [Android Enterprise](/mdm/android/)
- [Windows MDM enrollment](/mdm/windows/)
- [Deploy apps to mobile devices](/mdm/apps/)
- [What IT can see on enrolled devices](/mdm/privacy/)