mdm-device-management

When to Use

- Provisioning, hardening, or operating the infrastructure described in this skill within an authorized environment.

# Mobile Device Management (MDM) for Startups & Small Teams

A practical guide to enrolling, securing, and managing company devices across

macOS, Windows, iOS, and Android — from zero-touch onboarding to remote wipe.

---

1. When to Use MDM

MDM becomes essential when any of the following apply:

- **Team size crosses ~10 people** — manual laptop setup no longer scales.

- **Compliance requirements** — SOC 2, HIPAA, ISO 27001, or customer security

questionnaires demand proof that endpoints are encrypted and patched.

- **Remote / hybrid workforce** — you cannot walk over to someone's desk to

fix a configuration or verify disk encryption.

- **Contractor or BYOD devices** — you need a way to separate corporate data

from personal data and revoke access on offboarding.

- **Insurance or investor due diligence** — cyber-insurance carriers and VCs

increasingly ask for evidence of endpoint management.

If you are still under 10 people and everyone is in-office, a simple checklist

plus a configuration management tool (Ansible) may suffice — but plan for MDM

early so enrollment is painless when you scale.

---

2. MDM Platform Comparison

| Platform | Best For | Pricing Model | Open Source | Key Strength |

|----------|----------|---------------|-------------|--------------|

| **Jamf Pro** | macOS / iOS fleets | Per-device/yr | No | Deepest Apple integration, DEP/ADE native |

| **Microsoft Intune** | Windows + M365 shops | Bundled w/ M365 E3/E5 | No | Seamless Azure AD + Autopilot |

| **Kandji** | macOS-first startups | Per-device/yr | No | Pre-built compliance templates, fast setup |

| **Mosyle** | Education & SMB Apple | Per-device/yr | No | Apple School/Business Manager integration |

| **Fleet** | Cross-platform, eng-led | Free (OSS) / paid cloud | Yes | osquery-powered, GitOps-friendly, API-first |

| **SimpleMDM** | Small Apple-only teams | Per-device/mo | No | Simple UI, quick onboarding |

Decision heuristic

if (team < 50 AND engineering-led AND multi-OS):
    consider Fleet (open-source, osquery-native)
elif (team is macOS-dominant AND compliance-heavy):
    consider Kandji or Jamf
elif (team is Windows-dominant AND already on M365):
    consider Intune (likely already licensed)
else:
    evaluate Fleet or Kandji based on OS mix

---

3. Fleet (Open Source MDM) — Self-Hosted Deployment

Fleet is the leading open-source MDM. It uses osquery under the hood and

supports macOS, Windows, Linux, iOS, and Android.

3.1 Docker Compose deployment

# docker-compose.yml
version: "3.8"

services:
  mysql:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: "${FLEET_MYSQL_ROOT_PASSWORD}"
      MYSQL_DATABASE: fleet
      MYSQL_USER: fleet
      MYSQL_PASSWORD: "${FLEET_MYSQL_PASSWORD}"
    volumes:
      - mysql-data:/var/lib/mysql
    ports:
      - "3306:3306"
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      retries: 5

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

  fleet:
    image: fleetdm/fleet:v4.47.0
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      FLEET_MYSQL_ADDRESS: mysql:3306
      FLEET_MYSQL_DATABASE: fleet
      FLEET_MYSQL_USERNAME: fleet
      FLEET_MYSQL_PASSWORD: "${FLEET_MYSQL_PASSWORD}"
      FLEET_REDIS_ADDRESS: redis:6379
      FLEET_SERVER_TLS: "true"
      FLEET_SERVER_TLS_COMPATIBILITY: modern
      FLEET_SERVER_CERT: /tls/fleet.crt
      FLEET_SERVER_KEY: /tls/fleet.key
      FLEET_LOGGING_JSON: "true"
    volumes:
      - ./tls:/tls:ro
    ports:
      - "8080:8080"

volumes:
  mysql-data:

3.2 Initial setup

# Generate TLS certs (use real certs in production)
mkdir -p tls
openssl req -x509 -newkey rsa:4096 -sha256 -days 365 \
  -nodes -keyout tls/flee