Best Mobile Device Management Software for 2026: 12 tools compared for buyers
This page compares MDM software for IT teams that need to manage phones, tablets and laptops used for work. It covers the best options for different fleets, from Apple-only schools to mixed Windows, Android and kiosk deployments. The fourteen tools suit IT managers, MSPs and procurement teams, and the right pick depends mostly on which devices you run and which identity system you already use.
We compared the tools on operating system coverage, enrollment and policy features, ease of use and how clearly each vendor shows pricing. The page also lists what each vendor publishes on security, admin controls and contract terms, such as SSO, audit logs and licensing units, so IT and procurement can check requirements early.
Our shortlist at a glance
- Best for Entra ID conditional access
Microsoft IntuneMicrosoft Intune works natively with Entra ID, is included in Microsoft 365 E3 and E5 as Plan 1, and supports Autopilot and conditional access for Windows-heavy fleets.
$8.00 per user per month (Intune Plan 1 standalone) - Best for Mac admins who need same-day Apple support
Jamf ProJamf Pro is built for mid-size and large Apple fleets with a dedicated Mac admin, supports same-day Apple OS features and offers SAML and OIDC admin SSO.
Contact sales - Best for kiosk and rugged fleets across several operating systems
ScalefusionScalefusion covers Windows, macOS, iOS, Android, Linux and ChromeOS, has strong kiosk controls, and lists per-device prices with a 14-day trial.
$2 per device per month (Essential, billed annually) - Best when directory, SSO and MDM come from one vendor
JumpCloudJumpCloud bundles a cloud directory, SSO and device management, with public per-user module prices, for small and mid-size IT teams.
$9 per user per month billed annually (Device Management package) - Best for large mixed fleets that want tiered editions
IBM MaaS360IBM MaaS360 sells six per-device tiers, from Fast Start to Enterprise, with published list prices, multi-OS management and a 30-day free trial.
From $1.50 per device per month (Fast Start); from $4.24 (Essentials) list - Best for adding features step by step
HexnodeHexnode has four public tiers, with Apple Business Manager and Android Enterprise enrollment in Pro and directory integrations from Enterprise, plus a 14-day trial.
$2.20 per device per month (Pro)
What is mobile device management software?
MDM stands for mobile device management. The software gives IT a central console to enroll devices, apply settings, install apps and enforce security rules on phones, tablets and laptops. Admins use it to require passcodes and encryption, push Wi-Fi and email profiles, and lock or wipe a device that is lost or stolen. Schools, retailers, logistics firms and office teams all use it, for company-owned and personal devices. Many products now also manage desktops and are sold as UEM. The core capabilities are enrollment, policy enforcement, app management and remote actions.
Mobile Device Management Software side by side
| Tool | Best for | Starting price | Free plan or trial |
|---|---|---|---|
| Microsoft Intune | Best for Entra ID conditional access. | $8.00 per user per month (Intune Plan 1 standalone) | No |
| Jamf Pro | Best for Mac admins who need same-day Apple support. | Contact sales | Free trial |
| Scalefusion | Best for kiosk and rugged fleets across several operating systems. | $2 per device per month (Essential, billed annually) | Free trial |
| JumpCloud | Best when directory, SSO and MDM come from one vendor. | $9 per user per month billed annually (Device Management package) | Free trial |
| IBM MaaS360 | Best for large mixed fleets that want tiered editions. | From $1.50 per device per month (Fast Start); from $4.24 (Essentials) list | Free trial |
| Hexnode | Best for adding features step by step. | $2.20 per device per month (Pro) | Free trial |
 42Gears SureMDM | Android and rugged or kiosk device fleets. | $3.99 per device per month (Standard, third-party listing) | Free trial |
 ManageEngine MDM Plus | Small teams with up to 25 devices that need a free full-featured MDM. | Free up to 25 devices; Cloud Standard $645 per year for 50 devices | Free plan, Free trial |
 NinjaOne | MSPs and IT teams managing mostly Windows/Mac endpoints that want RMM plus MDM. | Contact sales (rates cited from $3.75 per endpoint at 50 or fewer down to $1.50 at 10,000) | Free trial |
 Miradore | Very small fleets via the free tier (third-party sources say up to 50 devices) | Free (per third-party sources); paid from about $2.30 to $2.75 per device per month | Free plan, Free trial |
 Mosyle | Schools and small businesses managing only Apple devices. | Free up to 30 devices; $1.00 per device per month (Business Premium) | Free plan, Free trial |
 Omnissa Workspace One | Large enterprises with mixed fleets including Windows, macOS, iOS, Android, ChromeOS and Linux. | Contact sales | No |
Prices as published by each vendor on October 24, 2026. "Contact sales" means the vendor publishes no price.
The 12 mobile device management software tools in detail
Best for Entra ID conditional access
Microsoft Intune
Microsoft's cloud endpoint manager for Windows, macOS, iOS, Android, Linux and ChromeOS, sold standalone or bundled in Microsoft 365 E3 and E5.
Organizations holding Microsoft 365 E3 or E5 already own Plan 1, so the first check is whether current licensing covers you. Windows Autopilot, Apple automated enrollment and Entra conditional access are supported. Remote Help costs extra, and reviewers find licensing across plans confusing.
- Best for
- Companies already on Microsoft 365 E3 or E5, where Intune Plan 1 is already included.
- Company size
- Any size; strongest fit for Microsoft 365 organizations.
Key features
- OS and device coverage
- Windows, macOS, iOS/iPadOS, Android (Enterprise and AOSP), Linux (Ubuntu 24.04/26.04, RHEL 9/10), ChromeOS.
- Zero-touch enrollment
- Apple automated device enrollment, Android Enterprise, Windows Autopilot, Samsung Knox Mobile Enrollment (per Microsoft docs)
- Security policy and compliance enforcement
- Compliance policies and conditional access with Entra ID; app protection policies not supported on ChromeOS.
- App distribution and management
- App deployment; Enterprise Application Management add-on ($2.00/user/month) adds a hosted app catalog.
Pros
- Tight fit with Microsoft 365, Entra and conditional access.
- Strong requirements coverage and app protection features.
Cons
- Admin console and licensing can be confusing across plans and add-ons.
- Support rated lower than product features on G2 sub-scores (8.4 of 10)
Pricing: $8.00 per user per month (Intune Plan 1 standalone)
Best for Mac admins who need same-day Apple support
Jamf Pro
Apple-focused device management for Mac, iPhone, iPad and Apple TV, sold by Jamf under quote-based pricing.
Mid-size and large organizations with a dedicated Mac admin and an Apple-centric fleet are the core audience, and the vendor tracks new Apple OS features quickly. Pricing is by quote, and smaller firms under 25 staff are pointed to Jamf Now. Budget time for the learning curve.
- Best for
- Mid-size and large Apple-centric fleets with a dedicated Mac admin.
- Company size
- Jamf Now under 25 employees; Jamf for Mac/Mobile for mid-size and enterprise.
Key features
- OS and device coverage
- MacOS, iOS, iPadOS, visionOS, watchOS, tvOS; Android via Jamf for Mobile.
- Zero-touch enrollment
- Apple Business Manager / automated enrollment (standard for Jamf; not itemized on pricing page)
- Security policy and compliance enforcement
- Endpoint protection and mobile threat defense bundled in plans.
- App distribution and management
- App distribution included in Jamf Now; broader catalog not confirmed by the vendor.
Pros
- Widely seen as the long-standing standard for Apple management.
- Good documentation and community support.
Cons
- Steep learning curve.
- Price can be high, especially for education.
Pricing: Contact sales · Free trial
Best for kiosk and rugged fleets across several operating systems
Scalefusion
Device management platform with public per-device pricing, extended with identity and security add-on products.
Small IT teams that like seeing prices up front can start at $2 per device monthly, billed yearly with a 10-device minimum. It handles Windows, macOS, iOS, Android, Linux and ChromeOS, and kiosk deployments are a strength. Identity and security are separate add-ons, so total the full stack.
- Best for
- Small and mid-size IT teams that want published per-device prices.
- Company size
- SMB to enterprise.
Key features
- OS and device coverage
- Windows, macOS, iOS, Android, Linux, ChromeOS, Android TV, Apple TV.
- Security policy and compliance enforcement
- Veltar security add-on (from $3 per device per month)
- Identity and Microsoft 365 integration
- OneIdP (Access Core $4, Access Pro $5 per device per month; Pro adds conditional SSO)
Pros
- Responsive support.
- Easy setup and use.
- Strong kiosk and data-separation controls.
Cons
- Learning curve and unclear documentation for complex setups.
- Limited Linux, ChromeOS and mobile app management per G2 summary.
Pricing: $2 per device per month (Essential, billed annually) · Free trial
Best when directory, SSO and MDM come from one vendor
JumpCloud
Cloud directory and identity platform that bundles MDM, SSO and device management, priced per user per month with public module prices.
IT teams who want directory, SSO and device management from a single vendor can buy modules at published per-user prices, with Device Management from $9 monthly. Platform Essentials stops at 300 users. Anyone expecting endpoint protection or DLP will need another product, as reviewers note.
- Best for
- Small and mid-size IT teams that want directory, SSO and MDM from one vendor.
- Company size
- Small to mid-size; Platform Essentials limited to 300 users.
Key features
- Security policy and compliance enforcement
- Conditional access / zero trust module $3 per user.
- App distribution and management
- Software management not priced on page.
- Remote lock, wipe and support
- Remote Access module $3 per user.
- Identity and Microsoft 365 integration
- Native directory and SSO; core product.
Pros
- Easy setup and centralized management.
Cons
- Pricing for education buyers.
- No DLP or endpoint protection.
Pricing: $9 per user per month billed annually (Device Management package) · Free trial
Best for large mixed fleets that want tiered editions
IBM MaaS360
Cloud UEM and MDM platform from IBM, sold per device per month in tiered editions from basic to enterprise.
Mid-size and large fleets mixing several operating systems can compare six per-device tiers, with list prices from $1.50 monthly at Fast Start and $4.24 at Essentials. A 30-day trial is available. Give admins real tasks in it, since reviewers describe a dated console and a steep learning curve.
- Best for
- Mid-size and large fleets that want tiered per-device editions with published list prices.
- Company size
- SMB (Fast Start) to enterprise.
Key features
- OS and device coverage
- Multi-OS (phones, tablets, laptops); specific OS list not on pricing page.
- Security policy and compliance enforcement
- Automated compliance; Premier adds app security.
- App distribution and management
- Mobile app management from Fast Start; patching in Enterprise.
- Remote lock, wipe and support
- TeamViewer remote support is a paid add-on on Essentials to Enterprise.
Pros
- Easy to use once set up.
- Centralized multi-platform management.
- Strong security controls.
Cons
- Steep learning curve and dated interface.
- Cost higher than some alternatives.
- Some performance slowness.
Pricing: From $1.50 per device per month (Fast Start); from $4.24 (Essentials) list · Free trial
Best for adding features step by step
Hexnode
Per-device UEM from Mitsogo with four public tiers from $2.20 per device per month and a 14-day trial.
Teams of 15 devices or more that want public per-device rates, from $2.20 monthly, can try it for 14 days. Kiosk mode comes in the entry plan, which helps frontline rollouts. Windows and macOS management starts in higher tiers, and patching appears only in Ultra. An MSP edition exists.
- Best for
- Small and mid-size mixed-OS fleets that want public per-device pricing.
- Company size
- Small to mid-size (starts at 15 devices); MSP edition available.
Key features
- OS and device coverage
- Mobile in all tiers; Windows and macOS management arrives in Enterprise (basic) and Ultimate/Ultra.
- Zero-touch enrollment
- Apple Business Manager, Android Enterprise, ZTE Knox in Pro; Windows Autopilot in Ultimate.
- Security policy and compliance enforcement
- BitLocker only in Ultra; FileVault in Ultimate.
- App distribution and management
- Mobile app management in Pro; Windows/Mac app management in Ultimate.
Pros
- Strong device management and support sub-scores on G2 (9.3 and 9.2 of 10)
- Public per-device pricing.
Pricing: $2.20 per device per month (Pro) · Free trial
42Gears SureMDM
Multi-OS MDM/UEM from Indian vendor 42Gears with strong Android and rugged device focus, sold per device per month.
Fleets of Android handhelds, rugged devices and kiosks, or mixed systems including Linux, Wear OS and VR, are where this product fits. On-premise licensing is possible. Remote access and identity cost extra as add-ons, and the $3.99 starting figure comes from third-party listings, so get the vendor to confirm.
- Best for
- Android and rugged or kiosk device fleets.
- Company size
- SMB to enterprise.
Key features
- OS and device coverage
- Android, iOS, Windows, macOS, Linux, Chrome, Wear OS, VR, IoT (KuppingerCole)
- Remote lock, wipe and support
- SureAccess remote access add-on, $1.99 per device per month (third-party)
- Identity and Microsoft 365 integration
- SureIdP add-on, $3.49 per user per month (third-party)
Pros
- User-friendly console and easy enrollment.
- Strong Android support.
- Responsive support.
Cons
- Some summaries note less depth in overall device management.
- Remote wipe less intuitive per one comparison.
Pricing: $3.99 per device per month (Standard, third-party listing) · Free trial
ManageEngine MDM Plus
Zoho's ManageEngine MDM product (Mobile Device Manager Plus) sold per device band in cloud or on-premises editions with a free tier for 25 devices.
IT admins with up to 25 devices can run it at no cost, then move to device-count bands in cloud or on-premises form. OS support spans iOS, Android, Windows, macOS, tvOS and ChromeOS. Apple-first shops should test depth carefully, since some G2 reviewers found Apple coverage limited.
- Best for
- Small teams with up to 25 devices that need a free full-featured MDM.
- Company size
- Small to mid-size; free for 25 devices, bands up to 10,000.
Key features
- OS and device coverage
- IOS, iPadOS, Android, Windows, macOS, tvOS, ChromeOS (FAQ)
- Zero-touch enrollment
- Apple Business Manager and Android Zero Touch Enrollment (FAQ)
- Identity and Microsoft 365 integration
- Active Directory integration via Zoho Directory Sync connector (cloud)
Pros
- Easy to use and administer.
- Strong Android support and setup ease (G2 awards claim, vendor page)
Cons
- Apple device support seen as limited by some reviewers (G2 summary)
Pricing: Free up to 25 devices; Cloud Standard $645 per year for 50 devices · Free plan, Free trial
NinjaOne
RMM and endpoint management platform for MSPs and IT teams, quote-based per-endpoint pricing with MDM as a selectable product.
MSPs and internal IT teams that already want remote monitoring and management can add mobile management as an optional product, priced per endpoint on a quote. Rates quoted range from $3.75 down to $1.50 by volume. Mobile-heavy buyers should test the mobile side, which reviewers call limited.
- Best for
- MSPs and IT teams managing mostly Windows/Mac endpoints that want RMM plus MDM.
- Company size
- Small to enterprise, strong MSP base.
Pros
- Clean dashboard and navigation.
- Automated updates, alerts and customer support.
Cons
- Limited mobile app and mobile device management.
- Weak search and missing client portal features.
Pricing: Contact sales (rates cited from $3.75 per endpoint at 50 or fewer down to $1.50 at 10,000) · Free trial
Miradore
Cloud MDM for Android, iOS, Windows and macOS with a free tier for small fleets, owned by GoTo.
Very small fleets, and MSPs looking after iPads next to Android tablets, can start on the free tier, which third-party sources cap at 50 devices. A 14-day Premium+ trial is offered. Prices from outside sources conflict, so ask for current rates, and let admins judge the older-feeling interface.
- Best for
- Very small fleets via the free tier (third-party sources say up to 50 devices)
- Company size
- SMB and MSPs.
Key features
- OS and device coverage
- Android, iOS, Windows, macOS.
Pros
- Manages iPads and Android tablets together.
- Free tier for small fleets.
Cons
- Learning curve.
- Outdated interface.
- Apple BYOD mode complaint.
Pricing: Free (per third-party sources); paid from about $2.30 to $2.75 per device per month · Free plan, Free trial
Mosyle
Apple-only device management with a free tier for 30 devices and paid plans from $1 per device per month.
Schools and small businesses that run only Apple hardware can manage 30 devices free, with paid plans from $1 per device monthly. Switchers get a 6-month side-by-side trial. Windows and Android are out of scope, and data sits in US Azure, which matters if you need EU hosting.
- Best for
- Schools and small businesses managing only Apple devices.
- Company size
- Small business and education.
Key features
- OS and device coverage
- MacOS, iOS, iPadOS, visionOS, tvOS, watchOS (Apple only)
- Security policy and compliance enforcement
- Endpoint security in Fuse (feature mapping not confirmed by the vendor)
- App distribution and management
- Apps and patch management listed on pricing page.
- Identity and Microsoft 365 integration
- Okta and Ping SSO on admin portals (2021 report); macOS identity and SSO in Fuse.
Pros
- Exceptional customer support.
- Strong requirements coverage.
Cons
- Setup can be difficult.
- Weak multi-system support (Apple only)
Pricing: Free up to 30 devices; $1.00 per device per month (Business Premium) · Free plan, Free trial
Omnissa Workspace One
Enterprise unified endpoint management suite, formerly VMware Workspace ONE, covering mobile, desktop and virtual endpoints.
Rebranded: Workspace ONE was VMware's product; the End-User Computing unit was sold by Broadcom to KKR (about $4B) and relaunched as Omnissa on 2024-07-01.
Large enterprises running Windows, macOS, mobile, rugged and kiosk devices side by side, often with Horizon virtual desktops, are the target. Licensing goes through resellers on quotes. Since the move from VMware to Omnissa, reviewers say support slipped, so ask for references and a support SLA.
- Best for
- Large enterprises with mixed fleets including Windows, macOS, iOS, Android, ChromeOS and Linux.
- Company size
- Enterprise.
Key features
- OS and device coverage
- Windows, macOS, iOS, Android, ChromeOS, Linux; also rugged, IoT/XR, kiosks, printers.
- Zero-touch enrollment
- Vendor mentions zero-touch onboarding in automated lifecycle workflows.
- Security policy and compliance enforcement
- Automated compliance workflows with conditional access signals.
- Identity and Microsoft 365 integration
- Microsoft Entra integration not described on the UEM page.
Pros
- Broad device and OS management.
- Automation tooling.
Cons
- Support and documentation reportedly declined after the VMware to Omnissa move.
- Clumsy interface.
- Opaque, reseller-driven pricing.
Pricing: Contact sales
What to look for in mobile device management software
Start with your device mix, because Apple-only, Android-heavy and mixed fleets lean on different tools. Next, decide how devices should be enrolled and which identity system controls access, since both shape daily admin work. Then check the policy, app and remote action features you need against each edition, as many tools gate them by tier. Finally, compare what the vendor publishes about SSO, audit logs and licensing units. The criteria below follow that order.
OS and device coverage
Coverage tells you which devices the tool can really manage. Apple-only tools go deepest on iPhones and Macs, Android-focused tools handle rugged scanners and kiosks, and broad UEM suites cover Windows, macOS, Linux and ChromeOS as well. Check which operating systems are included in the edition you are pricing and how current the Apple and Android support is.
- Microsoft Intune: Windows, macOS, iOS/iPadOS, Android (Enterprise and AOSP), Linux (Ubuntu 24.04/26.04, RHEL 9/10), ChromeOS.
- Jamf Pro: MacOS, iOS, iPadOS, visionOS, watchOS, tvOS; Android via Jamf for Mobile.
- Scalefusion: Windows, macOS, iOS, Android, Linux, ChromeOS, Android TV, Apple TV.
- IBM MaaS360: Multi-OS (phones, tablets, laptops); specific OS list not on pricing page.
- Hexnode: Mobile in all tiers; Windows and macOS management arrives in Enterprise (basic) and Ultimate/Ultra.
Zero-touch enrollment
Zero-touch enrollment lets a new device arrive configured, with no manual setup by IT. Look for Apple Business Manager, Android Enterprise, Samsung Knox and Windows Autopilot support, and confirm which plan unlocks each. In a demo, enroll a new device from the box and time how long it takes.
- Microsoft Intune: Apple automated device enrollment, Android Enterprise, Windows Autopilot, Samsung Knox Mobile Enrollment (per Microsoft docs)
- Jamf Pro: Apple Business Manager / automated enrollment (standard for Jamf; not itemized on pricing page)
- Hexnode: Apple Business Manager, Android Enterprise, ZTE Knox in Pro; Windows Autopilot in Ultimate.
- ManageEngine MDM Plus: Apple Business Manager and Android Zero Touch Enrollment (FAQ)
- Omnissa Workspace One: Vendor mentions zero-touch onboarding in automated lifecycle workflows.
Security policy and compliance enforcement
Security policies enforce passcodes, encryption and compliance rules, and reduce data loss risk when a device is stolen. Strong tools apply policies by group, report non-compliant devices and tie compliance to access decisions, for example through conditional access. Check whether disk encryption and app protection are available for each operating system you run.
- Microsoft Intune: Compliance policies and conditional access with Entra ID; app protection policies not supported on ChromeOS.
- Jamf Pro: Endpoint protection and mobile threat defense bundled in plans.
- Scalefusion: Veltar security add-on (from $3 per device per month)
- JumpCloud: Conditional access / zero trust module $3 per user.
- IBM MaaS360: Automated compliance; Premier adds app security.
App distribution and management
App management pushes required apps, blocks unwanted ones and keeps software up to date. Strong tools cover public store apps, internal apps, app catalogs and patching, and treat work and personal data separately on personal devices. Check whether desktop apps and patching are in the plan or only in a higher tier.
- Microsoft Intune: App deployment; Enterprise Application Management add-on ($2.00/user/month) adds a hosted app catalog.
- Jamf Pro: App distribution included in Jamf Now; broader catalog not confirmed by the vendor.
- JumpCloud: Software management not priced on page.
- IBM MaaS360: Mobile app management from Fast Start; patching in Enterprise.
- Hexnode: Mobile app management in Pro; Windows/Mac app management in Ultimate.
Remote lock, wipe and support
Remote actions limit the damage from lost or stolen devices and let IT help users without a visit. The basics are lock, wipe and locate, while remote view and remote control help with support cases. Several vendors sell remote support as an add-on, so confirm it is included in your plan.
- Microsoft Intune: Remote Help is a paid add-on ($3.50/user/month); standard remote lock/wipe not confirmed by the vendor.
- JumpCloud: Remote Access module $3 per user.
- IBM MaaS360: TeamViewer remote support is a paid add-on on Essentials to Enterprise.
- Hexnode: Remote view from Enterprise (mobile) and Ultimate (desktop); remote control from Ultimate (mobile) and Ultra (desktop)
- 42Gears SureMDM: SureAccess remote access add-on, $1.99 per device per month (third-party)
Identity and Microsoft 365 integration
Identity integration ties device status to who can access company data. In Microsoft environments, this means Entra ID and conditional access, and in others it means Active Directory, Google Workspace, Okta or a directory built into the tool. Check which directories each plan supports and whether SSO and SCIM are included.
- Microsoft Intune: Native with Microsoft Entra ID; Entra is an implicit dependency.
- Jamf Pro: SAML and OIDC admin SSO; Jamf Connect for identity (separate)
- Scalefusion: OneIdP (Access Core $4, Access Pro $5 per device per month; Pro adds conditional SSO)
- JumpCloud: Native directory and SSO; core product.
- IBM MaaS360: Identity management included from Essentials; Microsoft 365 integration not stated on page.
Pricing model and real cost
MDM tools charge per device, per user, per endpoint or in device bands, and extras such as remote access, identity or security modules can add noticeably to the base price. Compare total cost at your device count, including minimums, annual billing and add-ons. Also ask how licensing handles users with several devices.
- Microsoft Intune: Per user per month; standalone Plan 1 $8.00; most buyers get it inside M365 E3/E5.
- Jamf Pro: Per device, quote-based; Jamf Now for orgs under 25 employees.
- Scalefusion: Per device per month, annual billing, 10 device minimum.
- JumpCloud: Per user per month, modular.
- IBM MaaS360: Per client device per month, 6 tiers.
Target company size
A tool built for a 10-person team differs from one built for 1,000 employees in admin controls, support and pricing tiers. Small-team products offer quick setup and free tiers, while enterprise suites add governance and reseller-led contracts. Check device minimums and whether the vendor offers MSP options if you manage devices for clients.
- Microsoft Intune: Any size; strongest fit for Microsoft 365 organizations.
- Jamf Pro: Jamf Now under 25 employees; Jamf for Mac/Mobile for mid-size and enterprise.
- Scalefusion: SMB to enterprise.
- JumpCloud: Small to mid-size; Platform Essentials limited to 300 users.
- IBM MaaS360: SMB (Fast Start) to enterprise.
Buying mobile device management software: security, admin and vendor checks
Once a tool fits the team, the purchase depends on what the vendor commits to in writing: single sign-on, user provisioning, audit logs, where data lives and the contract. The checks below use each vendor's public pages, so a blank means "ask", not "no".
- Try before you buy
- 10 of 12
- Publish SAML SSO
- 2 of 12
- Publish SCIM provisioning
- 0 of 12
- Publish a DPA
- 1 of 12
7 free trials, 3 free plans
Scalefusion and JumpCloud
ask every vendor in writing
NinjaOne
Must-haves and what each vendor publishes
A blank is not a no, but it is work for your security review. JumpCloud publishes the most (1 of 5); 42Gears SureMDM, IBM MaaS360, Jamf Pro and ManageEngine MDM Plus and 3 more publish none of these controls, so every question goes to their sales team. Tick what your team requires; vendors that drop out show why, and the budget check prices the plan that actually includes single sign-on when you require it.
All 12 vendors shown. Tick a must-have to filter. ● published with the plan, ◐ mentioned without plan or details, ○ not on the vendor's public pages.
| Vendor | SAML SSO | SCIM | Audit logs | Data residency | DPA |
|---|---|---|---|---|---|
| JumpCloud1 of 5 published | ● PublishedSSO | ○ Not published | ◐ Mentioned | ○ Not published | ○ Not published |
| Mosyle1 of 5 published | ○ Not published | ○ Not published | ○ Not published | ● PublishedUS only (Azure) | ○ Not published |
| NinjaOne1 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ● Published |
| Scalefusion1 of 5 published | ● PublishedVia OneIdP add-on; conditional SSO in Access Pro | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| Hexnode0 of 5 published | ◐ MentionedAdmin login via Google, Entra ID, Okta; Ultimate lists basic… | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| 42Gears SureMDM0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| IBM MaaS3600 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| Jamf Pro0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| ManageEngine MDM Plus0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| Microsoft Intune0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| Miradore0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
| Omnissa Workspace One0 of 5 published | ○ Not published | ○ Not published | ○ Not published | ○ Not published | ○ Not published |
MDM evaluation criteria and how to test them
Treat these criteria as a trial script. For each, the notes below describe what to test on real devices, how strong and weak tools differ and what to ask the vendor in writing. Enroll at least one device of every type you own, run a policy change and a wipe, and check how the admin console handles it. The goal is to find fit and risk before the contract, not after.
OS and device coverage
List every OS and device type you manage, including shared and kiosk devices, and enroll one of each during the trial. Apple-first and Android-first tools differ sharply in depth. Ask which features are missing on each OS and how fast the vendor supports new OS releases.
Zero-touch enrollment
Test the full path from unboxing: Apple Business Manager, Android Enterprise or Windows Autopilot. Time how long a device takes to reach a usable state without IT touching it. Ask what happens when enrollment fails and whether the vendor supports your reseller or carrier setup.
Security policy and compliance enforcement
Create a baseline with passcode, encryption and OS version rules, then check how the console reports non-compliant devices. Look for conditional access and clear audit trails. Ask for the compliance frameworks the vendor maintains and whether threat defense is included or sold separately.
App distribution and management
Push a required app, an optional app and a configuration to a test group. Check update handling, managed app config and what the user sees. Ask how app licenses are bought and distributed, and whether patch management for OS and third-party apps is included.
Remote lock, wipe and support
Run a remote lock, a selective wipe and a full wipe on test devices, and note delay and confirmation. Check whether remote support or screen sharing is included or an add-on, as in SureMDM's SureAccess. Ask about lost mode, location tracking and privacy limits for personal devices.
Identity and Microsoft 365 integration
Connect the tool to your identity provider and confirm that device compliance can gate access. Test with Entra ID, Okta or your own setup. Ask which plan includes SSO and SCIM, because plan mapping is often unclear on public pages, and ask how user and group sync handles departures.
Pricing model and real cost
Ask for a written quote based on devices and users, with all modules listed. Check billing terms, minimum commitments and what happens if the fleet shrinks. Some tools in this list publish prices, while others quote only through sales or resellers. Confirm which add-ons your use case needs.
Target company size
Ask for customer references with a similar fleet size and OS mix. A tool designed for large enterprises may need a dedicated admin, while a tool designed for small teams may lack roles and delegated administration. Check support hours, onboarding help and whether your size fits plan minimums.
Questions to ask MDM vendors
The sales call is where you learn what the website leaves out. These questions concentrate on data location, access control, enrollment risk and contract terms, which determine how painful an MDM rollout or exit will be. Ask for answers in writing, compare them across vendors and make sure anything important appears in the order form, the security documentation or the data processing agreement.
Where is our device and user data stored?
Hosting region matters for GDPR and internal policy. Mosyle's data is stored in US Azure, per this list, which is a dealbreaker for some EU buyers. Ask for hosting options and the subprocessor list.
Which admin roles and audit logs do you offer?
You need to know who changed a policy or wiped a device. Ask whether role-based access and audit logs are included on the plan you are quoted, and how long logs are kept.
What happens to enrolled devices if we leave?
Ask how devices are released from management, how profiles are removed and whether Apple Business Manager assignments transfer cleanly. Exit friction is a real lock-in risk.
What is included in support and onboarding?
Ask about support hours, response times and whether onboarding is a paid package. Reviewers cite support quality as a concern for some vendors, so check references.
How quickly do you support new OS releases?
New iOS, Android and Windows versions can break policies. Ask for the vendor's track record on day-one support and how they communicate known issues.
Which features need other products or licenses?
Identity, remote access and threat defense are sometimes sold separately. Ask for a complete list of what your use case requires and what each item costs.
How to run the decision
Run the decision as a pilot. Define your device mix, identity provider and compliance needs first, shortlist three tools and enroll real devices of every type with the same policy set. Involve IT, security and finance, get SSO, audit log and data location answers in writing, and check the exit process before you sign.
Our recommendation
Pick by device mix and identity system first, then compare enrollment, policy and remote features by edition. Apple fleets, Microsoft 365 shops and Android kiosk deployments each have a clear starting point. Shortlist two or three tools, enroll a few real devices in each trial, and ask every vendor for a total price at your device count along with its SSO, audit log and contract terms. Name one owner for the rollout.
Mobile Device Management Software: frequently asked questions
What is MDM software?
MDM, or mobile device management, software lets IT enroll, configure, secure and monitor company and employee devices such as phones, tablets and laptops. It enforces policies, distributes apps and can lock or wipe lost devices. Many products now cover all endpoints and are called UEM.
What is the best MDM software for small business?
Pick by fleet type. Apple-only shops can use Mosyle, free up to 30 devices. Mixed fleets might use ManageEngine MDM Plus, free to 25 devices, or Hexnode and Scalefusion, which both show per-device prices. Companies already holding Microsoft 365 should look at Intune first.
Is there a free MDM for a small number of devices?
Yes, three options stand out. ManageEngine MDM Plus covers 25 devices, Mosyle covers 30 Apple devices, and Miradore offers a free tier for small fleets. Expect trimmed features or support on free plans, so compare them with your enrollment and policy needs before relying on one.
What features should MDM software have?
Look for support for your operating systems, zero-touch enrollment, security and compliance policies, app distribution, remote lock and wipe, and identity integration. Also check the console, reporting and what the vendor publishes about SSO and audit logs.
Do I need MDM if I have Microsoft 365?
Possibly not. Microsoft 365 E3 and E5 already include Intune Plan 1, which covers many device management needs for Windows-heavy fleets. You may still want another tool for deep Apple management or kiosk and rugged devices, so compare it with your device mix.
Which mobile device management software include SSO below the enterprise plan?
Microsoft Intune (Via Microsoft Entra ID; plan mapping not confirmed by the vendor); Scalefusion (Via OneIdP add-on; conditional SSO in Access Pro); JumpCloud (SSO package $11, or SSO module $3 per user; platform tiers quote only); Hexnode (Admin login via Google, Entra ID, Okta; Ultimate lists basic Okta SSO; generic SAML not supported per forum); Mosyle (Okta and Ping Identity supported for admin portals (9to5Mac, 2021); plan mapping not confirmed by the vendor). The other tools either reserve SAML SSO for their top tier or do not say on their public pages.