Mobile device management glossary

Devices

• MDM

  MDM (Mobile Device Management) is the software an IT team uses to enroll, configure, secure and monitor smartphones, tablets and laptops from one console.

• Mobile Device Management

  Mobile Device Management is the discipline of controlling a company's phones, tablets and laptops centrally: enrolling them, configuring settings, deploying apps, enforcing security rules and wiping…

• UEM

  UEM (Unified Endpoint Management) extends mobile device management to every endpoint a company owns: smartphones, tablets, laptops, desktops, rugged devices and sometimes IoT.

• EMM

  EMM (Enterprise Mobility Management) is the umbrella category that groups device management (MDM), application management (MAM), content management and identity controls for mobile devices.

• BYOD

  BYOD (Bring Your Own Device) is the practice of letting employees use their personal phone or tablet for work.

• COPE

  COPE (Corporate-Owned, Personally Enabled) is a device ownership model where the company buys and fully manages the phone but explicitly allows personal use.

• COBO

  COBO (Corporate-Owned, Business-Only) is the strictest device ownership model: the company buys the device, manages it entirely and forbids any personal use.

• CYOD

  CYOD (Choose Your Own Device) is an ownership model where employees pick their work device from a short list approved by IT.

• Declarative Device Management (DDM)

  Declarative Device Management (DDM) is Apple's newer management model, introduced at WWDC 2021 with iOS 15.

• Device enrollment

  Device enrollment is the step that places a phone, tablet or computer under MDM management.

• Zero-touch enrollment

  Zero-touch enrollment is automated MDM enrollment that happens the first time a device boots, with no action from IT and almost none from the user.

• Remote wipe

  Remote wipe is an MDM command that erases a device or its corporate data over the network, without physical access.

• Kiosk mode

  Kiosk mode locks a device to a single app or a small set of approved apps, hiding the rest of the operating system.

• Supervised mode

  Supervised mode is a level of management on iPhone, iPad and Apple TV that gives the MDM more control than a standard enrollment: silent app installs, Single App Mode, web content filtering, blocking…

• Mobile fleet management

  Mobile fleet management is the end-to-end administration of a company's phones, tablets and rugged devices: purchasing, enrollment, configuration, security, app distribution, support, replacement and…

Applications

• MAM

  MAM stands for Mobile Application Management.

• Mobile Application Management

  Mobile Application Management is the practice of controlling the apps on a fleet of phones and tablets across their whole life: sourcing, installing, configuring, updating and finally removing them.

• Enterprise app store

  An enterprise app store is a private catalogue where a company publishes the apps its teams need, public ones and internal ones alike.

• Managed Google Play

  Managed Google Play is the business version of the Play Store used by Android Enterprise.

• Sideloading

  Sideloading means installing an app on a phone or tablet from outside the official store, usually from an APK file or a download link.

• App configuration

  App configuration, often called managed app configuration, is the ability to send settings to an app from the management server before anyone opens it.

• Managed app

  A managed app is an app installed and controlled by the management platform rather than by the user.

Enrollment

Security & compliance

• Jailbreak

  A jailbreak removes the security restrictions Apple builds into iOS so the user can install unsigned apps and modify the system.

• Mobile Threat Defense

  Mobile Threat Defense (MTD) is a category of security software that detects attacks on smartphones and tablets: malicious apps, phishing links, rogue Wi-Fi networks and OS exploits.

• Compliance policy

  A compliance policy is a set of conditions a managed device must meet to be considered trustworthy: minimum OS version, passcode enabled, encryption on, no jailbreak, required apps installed.

• SCEP

  SCEP (Simple Certificate Enrollment Protocol) is a protocol that lets a device request and receive an X.509 certificate from a certificate authority without a human copying files around.

• FileVault

  FileVault is the full-disk encryption built into macOS.

• Data Loss Prevention (DLP)

  Data Loss Prevention (DLP) is the set of controls that stop company data from leaving the places it's supposed to stay.

• NIS2

  NIS2 is the European directive (EU) 2022/2555 on the security of network and information systems, transposed into national law by 17 October 2024.

• GDPR

  The GDPR is regulation (EU) 2016/679, the European text on personal data protection that has applied since 25 May 2018.

• SecNumCloud

  SecNumCloud is the qualification that ANSSI, the French cybersecurity agency, grants to cloud service providers after an audit against its own framework.

Apple

• Apple Business Manager

  Apple Business Manager (ABM) is Apple's free web portal where a company registers the iPhones, iPads and Macs it owns, links them to an MDM server and buys apps in volume.

• Apple School Manager

  Apple School Manager (ASM) is the education version of Apple Business Manager: a free portal where a school or district registers its iPads and Macs, assigns them to an MDM, buys apps in volume and…

• Automated Device Enrollment

  Automated Device Enrollment (ADE) is Apple's mechanism for enrolling an iPhone, iPad or Mac into MDM during first boot, with no action from IT.

• APNs

  APNs, the Apple Push Notification service, is the channel every Apple MDM uses to wake up a managed device.

• VPP (Apps and Books)

  VPP, now called Apps and Books in Apple Business Manager, is Apple's volume licensing system.

• Apple Configurator

  Apple Configurator is Apple's tool for configuring iPhones, iPads and Apple TVs by hand, over USB from a Mac or by scanning from an iPhone.

• Activation Lock

  Activation Lock is the Apple anti-theft feature that ties an iPhone, iPad or Mac to an Apple Account when Find My is enabled.

• Apple Developer Program

  The Apple Developer Program is the paid membership (99 US dollars per year) that lets an organization sign iOS and macOS apps and distribute them, on the public App Store or privately through Apple…

Android

• Android Enterprise

  Android Enterprise is Google's program and set of APIs that make Android devices manageable by an MDM in a standard way.

• Work profile

  A work profile is a separate, encrypted container that Android Enterprise creates on a device to hold company apps and data apart from personal ones.

• Fully managed device

  A fully managed device is an Android Enterprise mode in which the company owns the device and the MDM controls all of it: apps, settings, updates, security and the option to wipe it entirely.

• Dedicated device

  A dedicated device is an Android Enterprise mode for company-owned hardware locked to a single purpose: a scanner, a point-of-sale terminal, a check-in tablet or a digital sign.

• Samsung Knox

  Samsung Knox is the security platform built into Samsung Galaxy phones, tablets and rugged devices, combining hardware-backed protection with management services for businesses.

• Factory Reset Protection

  Factory Reset Protection (FRP) is an Android anti-theft feature that keeps a device locked after a factory reset until someone signs in with an account that was on it before the wipe.

• OEMConfig

  OEMConfig is an Android Enterprise standard that lets a device manufacturer expose its proprietary settings to any MDM through a dedicated app published on Managed Google Play.

Windows

• Windows Autopilot

  Windows Autopilot is Microsoft's provisioning service that turns a new PC into a configured, managed machine the first time it boots.

• Microsoft Intune

  Microsoft Intune is Microsoft's cloud MDM and UEM service, used to enroll, configure and secure Windows PCs, phones and tablets from the Microsoft 365 admin experience.

• BitLocker

  BitLocker is the full disk encryption built into Windows.

• Microsoft Entra ID

  Microsoft Entra ID is Microsoft's cloud identity service, renamed from Azure Active Directory in 2023.

• Conditional access

  Conditional access is the practice of granting or refusing access to company resources based on conditions evaluated at sign-in: who the user is, whether the device is compliant, where the request…

Network & identity