Mobile Device Management (MDM) is the enterprise software category that lets an organization centrally configure, monitor, and (often) wipe employee devices. Implemented via Apple Business Manager and Apple Configurator on iOS, via Android Enterprise on Android. Vendors include Jamf, Microsoft Intune, VMware Workspace ONE, Kandji, Mosyle, Hexnode. Standard practice in any organization with more than around 50 employees and any meaningful security posture.
What it means in practice
MDM enrollment grants the organization significant control over the enrolled device: install required apps, push configuration profiles (Wi-Fi, VPN, certificates), enforce passcode policies, restrict features (camera, AirDrop, certain apps), wipe the device remotely. The visibility scope depends on the deployment mode. Corporate-owned device: full control, including app list, location (for some configurations), web browsing on managed apps, sometimes the ability to install monitoring software. BYOD enrolled in user-mode: limited to managed apps and configurations, the personal portion of the device should remain private (in theory; the line varies by vendor and deployment). The structural concern: an MDM profile installed on a personal device, especially via a non-Apple-Business-Manager enrollment flow, can grant permissions the user did not realize they were granting.
Who uses it, and against whom
Operators: every modern enterprise IT department, plus an emerging consumer market for “family management” (Apple’s Family Sharing, Google Family Link, plus stalkerware-adjacent products that use MDM-style enrollment to monitor partners or children). Against whom: enrolled employees (whose personal browsing on a corporate device is the company’s business), enrolled family members (who may not understand what was installed), and (in adversarial divorce scenarios) ex-partners whose devices were enrolled in the marriage and not revoked. The common operator-side risk: leaving a job and forgetting to verify the MDM profile was removed, then noticing months later that the former employer can still wipe the device.
What you can change today
Audit MDM enrollment on every device. iPhone: Settings, General, VPN and Device Management. If anything is listed and you do not currently work for the organization that installed it, remove it (Tap, Remove Management). Android: Settings, Accounts, Work profiles. Same logic. For BYOD use: never enroll a personal device in an organization’s MDM if the alternative is a separate work device; the leverage you trade for convenience is significant. For shared family devices in a divorce or custody scenario: the controlling parent’s MDM enrollment is one of the first things to audit and document for the lawyer.