Smartphones and tablets have become an essential part of the modern workplace. Employees use mobile devices to access email, Microsoft Teams, SharePoint, OneDrive, CRM platforms and business applications from almost anywhere. Remote and hybrid work, together with Bring Your Own Device (BYOD) arrangements, has made mobile access even more important.
But this convenience creates an important cybersecurity question:
How can businesses protect corporate information when employees are accessing it from mobile devices?
A lost smartphone, outdated operating system, malicious application or compromised device can potentially expose business information.
This is where Mobile Device Management (MDM) and Mobile Application Management (MAM) become important.
In simple terms:
MDM manages the device.
MAM protects business applications and data.
For organisations using Microsoft 365, Microsoft Intune provides capabilities for both MDM and MAM, allowing businesses to apply different security controls depending on whether a device is company-owned or personally owned.
What is Mobile Device Management?
Mobile Device Management, or MDM, allows an organisation to centrally manage and secure mobile devices.
These can include:
- iPhones and iPads
- Android smartphones and tablets
- Windows devices
- Company-owned laptops
With MDM, organisations can enforce security policies and configure devices according to business requirements.
For example, an organisation can require:
- Strong passwords or PINs
- Device encryption
- Automatic security updates
- Screen-lock policies
- Approved applications
- Wi-Fi configurations
- VPN settings
- Security certificates
- Compliance requirements
MDM can also allow IT teams to remotely lock, reset or wipe a company-owned device if it is lost, stolen or being retired. This helps organisations protect corporate data and reduce the risk of unauthorised access.
Examples of platforms that provide these device-management capabilities include Microsoft Intune, VMware Workspace ONE and IBM MaaS360.
Why MDM matters
Consider an employee issued with a company-owned iPhone.
The employee uses the device for:
- Outlook
- Microsoft Teams
- OneDrive
- SharePoint
- Business applications
Without central management, IT may have limited visibility over the security state of the device.
With MDM, the organisation can establish a consistent security baseline.
For example:
The device must have a passcode, use a supported operating-system version, meet security requirements and remain compliant before accessing corporate resources.
This gives IT teams greater control and visibility over company-owned endpoints.
What is Mobile Application Management?
Mobile Application Management, or MAM, takes a different approach.
Rather than managing the entire device, MAM focuses on protecting corporate applications and business data.
This is particularly useful for BYOD environments.
An employee may use their own iPhone or Android phone to access Outlook or Teams.
The business may want to protect corporate information without managing the employee’s personal photos, banking applications, social media or other private information.
MAM allows organisations to apply protection at the application level.
Microsoft Intune supports app protection policies that can protect organisational data within supported applications, including on devices that are not enrolled in MDM. This makes MAM particularly useful for organisations supporting BYOD.
MAM vs MDM: What’s the difference?
The simplest way to understand the difference is:
| MDM | MAM |
| Manages the device | Protects applications and corporate data |
| Best suited to managed devices | Particularly useful for BYOD |
| Controls device configuration | Controls how business data is used |
| Can deploy applications | Can protect data within applications |
| Can enforce device compliance | Can enforce application protection policies |
| Can remotely manage company devices | Can selectively remove corporate data |
Company-owned device
If a business purchases an iPhone for an employee, it can manage the entire device.
MDM is appropriate.
Personal device
If an employee uses their own iPhone to access Outlook, the business may not want to manage the entire phone.
MAM may be more appropriate.
Microsoft supports this distinction by allowing app protection policies to protect organisational data on devices that are not enrolled in MDM.
Why BYOD makes MAM Important
BYOD provides convenience for employees and can reduce hardware costs for businesses. However, it also creates security and privacy challenges.
A personal smartphone may contain:
- Personal email
- Photos
- Banking applications
- Social media
- Personal documents
- Corporate information
The business needs to protect its information without unnecessarily controlling the employee’s personal data.
MAM can help create a boundary around corporate information. For example, application protection policies can be configured to control whether corporate information can be copied from a managed application into an unmanaged personal application.
This allows employees to use their own devices while providing the organisation with greater control over its data.
Common Mobile Security risks
Lost or Stolen Devices
A smartphone can provide access to corporate email, documents and applications. If a device is lost and security controls are inadequate, corporate information could be exposed. MDM can allow organisations to remotely manage company-owned devices.
MAM can provide another layer by protecting corporate data within supported applications.
Unauthorised applications
Applications installed on mobile devices may request access to information or other device resources. Businesses should therefore consider which applications are permitted to access corporate information.
Copy and Paste
One of the simplest ways information can leave an organisation is through copy and paste. An employee could copy sensitive information from Outlook or Teams and paste it into a personal application. MAM policies can help restrict this type of data movement.
Outdated devices
Unsupported operating systems may contain known security vulnerabilities. Businesses should establish minimum operating-system and security requirements for devices accessing corporate systems.
The Australian Cybersecurity Perspective
Mobile security is not simply an IT management issue. It is a cybersecurity issue.
The Australian Cyber Security Centre (ACSC) warns that poorly secured mobile devices can become a potential access point into connected systems. Its enterprise mobility guidance also addresses privately owned devices and the separation of organisational and personal applications and data. (cyber.gov.au)
At TechnoFin Consultancy, we help businesses assess their current mobile and endpoint environment and develop practical security strategies that align with their business needs.
This can include:
- Microsoft Intune and endpoint management
- Mobile Device Management (MDM)
- Mobile Application Management (MAM)
- Microsoft 365 security and administration
- Conditional Access and device compliance
- BYOD security strategies
- Application and data protection
- Endpoint security and policy enforcement
- Device onboarding and offboarding
Whether your organisation provides company-owned devices or allows employees to use their own phones, the right combination of MDM, MAM, identity controls and security policies can help protect business data without unnecessarily restricting how employees work.
Need help securing your business devices and Microsoft 365 environment? TechnoFin Consultancy can help you assess your current setup and implement practical endpoint and mobile security solutions tailored to your business.
