Mobile Device Management (MDM) is software that enrolls mobile and desktop endpoints into a central console, applies configuration and security policies, and reports on device compliance – encryption status, OS version, jailbreak or root detection – so other systems can verify a device meets requirements before granting it access to corporate resources.
Key takeaways
- MDM enrolls devices and enforces configuration and compliance policy.
- Compliance state feeds device-posture checks at network access time.
- Microsoft Intune and Ivanti Neurons are common MDM/UEM platforms.
- Attributes include encryption status, device ownership, and threat state.
- Versa gateways query MDM data to enforce Zero Trust access decisions.
On this page: Why it mattersHow it worksTypesMDM & VersaFAQ
Why is MDM important?
Remote and hybrid work put corporate data on endpoints IT never issues or fully controls – company laptops, personal phones, and BYOD tablets connecting from home networks and public Wi-Fi. Without a way to verify device state, security teams cannot tell whether a connecting endpoint is patched, encrypted, and free of known threats before it reaches internal applications.
MDM matters because it turns device posture from a blind spot into a checkable fact. By enrolling endpoints and evaluating them against policy – OS version, encryption, firewall, threat status – an MDM platform produces a compliance verdict other systems can consume. That verdict is what makes device-aware Zero Trust access possible: access decisions can require the device itself be managed and compliant, not just valid credentials.
What is MDM?
An MDM platform such as Microsoft Intune enrolls a device – through a management profile, certificate, or company-portal app – and from then on can push configuration, query hardware and software attributes, and issue remote commands. Once enrolled, the platform evaluates the device against compliance policies (for example, “firewall must be enabled”) and assigns a state: Compliant, Non-compliant, or Unknown/not evaluated.
Other systems read that compliance state through an API rather than reimplementing device checks themselves. Microsoft Intune exposes device records – enrollment status, compliance state, ownership, encryption status, jailbreak/root detection – through the Microsoft Graph API, authenticated with a tenant ID, client ID, and client secret. A relying system queries the Graph API with the device’s identifier and gets back its current posture to use in an access decision.
Types of MDM
MDM sits within a broader family of endpoint-management categories distinguished by scope. MDM narrowly covers device-level enrollment, configuration profiles, and remote actions such as wipe or lock. Enterprise Mobility Management (EMM) extends MDM with application and content management. Unified Endpoint Management (UEM) is the broadest tier: one console managing mobile, desktop, and sometimes IoT endpoints together, unifying MDM/EMM with traditional client management. Microsoft Intune and Ivanti Neurons now market themselves as UEM platforms, though “MDM” remains the common shorthand.
Deployment also varies by device ownership. Corporate-owned devices are typically fully managed and strictly enforced, while BYOD enrollment applies a lighter profile – often just a work container or certificate – that verifies compliance without controlling the entire device. Versa’s device-fingerprint data tracks this as device ownership: Corporate or Personal.
MDM & Versa
Versa does not build its own MDM system. Instead, Versa Secure Access integrates with external MDM/UEM platforms – Microsoft Intune and Ivanti Neurons – to enrich device-posture-based access decisions. An MDM profile on a Versa gateway or portal stores the tenant ID, client ID, and client secret needed to query the Intune Graph API.
When a device registers through the Versa SASE client, the Secure Access Portal – and afterward the Gateway, on every tunnel – queries the linked MDM profile to confirm it is enrolled and compliant; policy can then require a managed, compliant device before granting access. The MDM integration guide walks through a full Microsoft Intune setup, from Entra app registration through compliance policies. This data also feeds device fingerprinting: compliance state, ownership, and encryption status join client and gateway telemetry for posture-based access decisions.
Frequently asked questions
What is the difference between MDM and UEM?
MDM narrowly covers enrolling and configuring mobile and desktop devices. UEM (Unified Endpoint Management) is the broader category – one console managing mobile, desktop, and IoT endpoints together. Platforms like Microsoft Intune now market themselves as UEM, but MDM remains the common shorthand.
Does Versa provide its own MDM platform?
No. Versa Secure Access integrates with external MDM/UEM platforms, primarily Microsoft Intune and Ivanti Neurons, rather than shipping its own device-management system. Versa gateways and portals query those platforms through APIs like Microsoft Graph to retrieve device compliance data for access decisions.
What compliance states does MDM report?
Most MDM platforms report a small set of compliance states, typically Compliant, Non-compliant, or Unknown/not evaluated. Versa’s secure access policies read this state directly, along with attributes like device ownership and encryption status, to gate access for every connecting device.
What happens if a device becomes non-compliant after connecting?
Versa re-evaluates device posture continuously, not just at initial registration. Each time a device forms a tunnel, the gateway triggers a new MDM query; if compliance state has changed to non-compliant, gateway policy can restrict or deny access rather than waiting for the next session.
Is MDM required for BYOD devices?
MDM still applies to BYOD, but typically with a lighter management profile than a corporate-owned device – often limited to a work container, certificate, or app-level policy rather than full device control. Versa’s device-fingerprint data distinguishes ownership as Corporate or Personal so policy can differ accordingly.
More on MDM
If you want to learn more, these are sources we trust.
| NIST SP 800-124 Rev. 2 |
|---|
| NIST’s guidelines for managing mobile device security in the enterprise, including the compliance controls MDM platforms implement. |
Related terms
If you’re reading about MDM, these are worth looking at next.
| Secure Access Service Edge | Security Service Edge | Identity Provider |
|---|---|---|
| The converged SD-WAN and cloud-security architecture that consumes MDM-reported device compliance in its access decisions. | The cloud-delivered security services, including ZTNA, that enforce access policy using MDM-reported compliance state. | The service that verifies who a user is; access decisions combine identity with the device posture MDM supplies. |