Mobile device management glossary

Devices

• MDM

  MDM (Mobile Device Management) is the software an IT team uses to enroll, configure, secure and monitor smartphones, tablets and laptops from one console.

• Mobile Device Management

  Mobile Device Management is the discipline of controlling a company's phones, tablets and laptops centrally: enrolling them, configuring settings, deploying apps, enforcing security rules and wiping…

• UEM

  UEM (Unified Endpoint Management) extends mobile device management to every endpoint a company owns: smartphones, tablets, laptops, desktops, rugged devices and sometimes IoT.

• EMM

  EMM (Enterprise Mobility Management) is the umbrella category that groups device management (MDM), application management (MAM), content management and identity controls for mobile devices.

• BYOD

  BYOD (Bring Your Own Device) is the practice of letting employees use their personal phone or tablet for work.

• COPE

  COPE (Corporate-Owned, Personally Enabled) is a device ownership model where the company buys and fully manages the phone but explicitly allows personal use.

• COBO

  COBO (Corporate-Owned, Business-Only) is the strictest device ownership model: the company buys the device, manages it entirely and forbids any personal use.

• CYOD

  CYOD (Choose Your Own Device) is an ownership model where employees pick their work device from a short list approved by IT.

• Declarative Device Management (DDM)

  Declarative Device Management (DDM) is Apple's newer management model, introduced at WWDC 2021 with iOS 15.

• Device enrollment

  Device enrollment is the step that places a phone, tablet or computer under MDM management.

• Zero-touch enrollment

  Zero-touch enrollment is automated MDM enrollment that happens the first time a device boots, with no action from IT and almost none from the user.

• Remote wipe

  Remote wipe is an MDM command that erases a device or its corporate data over the network, without physical access.

• Kiosk mode

  Kiosk mode locks a device to a single app or a small set of approved apps, hiding the rest of the operating system.

• Supervised mode

  Supervised mode is a level of management on iPhone, iPad and Apple TV that gives the MDM more control than a standard enrollment: silent app installs, Single App Mode, web content filtering, blocking…

• Mobile fleet management

  Mobile fleet management is the end-to-end administration of a company's phones, tablets and rugged devices: purchasing, enrollment, configuration, security, app distribution, support, replacement and…

• Remote control

  Remote control means an IT technician taking input on a user's device from a support console, as opposed to screen sharing, where the technician only watches what the user does.

• Lost mode

  Lost mode is an MDM command that locks a company device, replaces its lock screen with a message and a callback number, and lets the admin request its location and make it play a sound.

• Endpoint management

  Endpoint management is the discipline of enrolling, configuring, securing and keeping up to date every device that touches company data, from smartphones and tablets to laptops, desktops and rugged…

• Device management

  Device management is the general term for enrolling, configuring, securing and tracking the computers, phones and tablets an organization uses, usually from a central console.

• MDM server

  An MDM server is the backend that enrolled devices talk to: it stores your policies and app assignments, sends commands to iPhones, Android devices, Windows PCs and Macs through each platform's push…

• MDM profile

  An MDM profile is the configuration file installed on a device during enrollment that ties it to a management server and carries the settings and restrictions that server pushes afterward.

• Shared device

  A shared device is a phone or tablet used by several people in turn, typically across shifts, rather than assigned to one employee: a handheld in a warehouse, a tablet on a hospital ward, a scanner…

Applications

• MAM

  MAM stands for Mobile Application Management.

• Mobile Application Management

  Mobile Application Management is the practice of controlling the apps on a fleet of phones and tablets across their whole life: sourcing, installing, configuring, updating and finally removing them.

• Enterprise app store

  An enterprise app store is a private catalogue where a company publishes the apps its teams need, public ones and internal ones alike.

• Managed Google Play

  Managed Google Play is the business version of the Play Store used by Android Enterprise.

• Sideloading

  Sideloading means installing an app on a phone or tablet from outside the official store, usually from an APK file or a download link.

• App configuration

  App configuration, often called managed app configuration, is the ability to send settings to an app from the management server before anyone opens it.

• Managed app

  A managed app is an app installed and controlled by the management platform rather than by the user.

• APK

  An APK (Android Package Kit) is the archive format Android uses to install an app: compiled code, resources, a manifest and a cryptographic signature inside a single zip file.

• PWA (progressive web app)

  A progressive web app (PWA) is a website engineered to behave like an installed app: it runs on the browser engine, caches itself through a service worker, and can be added to the home screen with…

• App catalog

  An app catalog is the curated list of apps a given group of users is allowed to see and install, published by IT from the management console instead of left to the public stores.

• App wrapping

  App wrapping is the practice of injecting a management layer into an already compiled app, by repackaging and re-signing the binary so it gains policies such as encryption, a local passcode or…

• App deployment

  App deployment is the process of getting an application installed, configured and kept up to date on a fleet of devices from a central console, without anyone touching each handset.

• Private app

  A private app is an application built for one organization and distributed only to its devices, never listed on the public Google Play or App Store catalog.

• Application management

  Application management is the part of device management that deals with the software rather than the hardware: which apps reach a device, how they're configured, how they're updated, and what happens…

• Enterprise application

  An enterprise application is software built or licensed for use inside one organization, as opposed to a consumer app anyone can download from a public store.

• Managed app configuration

  Managed app configuration is the mechanism by which a management server delivers settings to an app it installed, so the app opens already configured with its server address, tenant, account and…

Enrollment

Security & compliance

• Jailbreak

  A jailbreak removes the security restrictions Apple builds into iOS so the user can install unsigned apps and modify the system.

• Mobile Threat Defense

  Mobile Threat Defense (MTD) is a category of security software that detects attacks on smartphones and tablets: malicious apps, phishing links, rogue Wi-Fi networks and OS exploits.

• Compliance policy

  A compliance policy is a set of conditions a managed device must meet to be considered trustworthy: minimum OS version, passcode enabled, encryption on, no jailbreak, required apps installed.

• SCEP

  SCEP (Simple Certificate Enrollment Protocol) is a protocol that lets a device request and receive an X.509 certificate from a certificate authority without a human copying files around.

• FileVault

  FileVault is the full-disk encryption built into macOS.

• Data Loss Prevention (DLP)

  Data Loss Prevention (DLP) is the set of controls that stop company data from leaving the places it's supposed to stay.

• NIS2

  NIS2 is the European directive (EU) 2022/2555 on the security of network and information systems, transposed into national law by 17 October 2024.

• GDPR

  The GDPR is regulation (EU) 2016/679, the European text on personal data protection that has applied since 25 May 2018.

• SecNumCloud

  SecNumCloud is the qualification that ANSSI, the French cybersecurity agency, grants to cloud service providers after an audit against its own framework.

• MFA (multi-factor authentication)

  MFA (multi-factor authentication) requires at least two independent proofs of identity before an account is unlocked, typically a password plus something the user holds or something they are.

• Geofencing

  Geofencing is a policy triggered by a device's position: cross a virtual boundary drawn around a site, and a rule applies or lifts, such as unlocking a kiosk app inside a warehouse or raising an…

• Zero trust

  Zero trust is a security model that stops treating the corporate network as a trusted zone and instead verifies every request individually, on the strength of the user's identity, the state of the…

• SSO (single sign-on)

  SSO (single sign-on) lets a user authenticate once with an identity provider and then reach every connected application without typing credentials again.

• Endpoint security

  Endpoint security is the set of controls protecting the devices that access company data: laptops, desktops, and now the phones and tablets that carry the same mail and the same documents.

• Shadow IT

  Shadow IT is any app, SaaS account or device used for work without IT's knowledge or approval.

• ISO 27001

  ISO/IEC 27001 is the international standard for an information security management system (ISMS): a documented way of assessing risk, selecting controls, and proving the whole thing gets reviewed and…

• Device compliance

  Device compliance is the continuous evaluation of an enrolled device against the rules an IT team has defined, producing a compliant or non-compliant verdict and, in most cases, an automatic…

• Certificate-based authentication

  Certificate-based authentication proves identity with an X.509 client certificate and the private key that belongs to it, instead of a secret the user types.

• Per-app VPN

  Per-app VPN routes the traffic of selected applications through a corporate tunnel while everything else on the device goes straight out to the internet.

• MDM policy

  An MDM policy is a set of rules the management server enforces on enrolled devices: passcode strength, encryption, allowed apps, network settings, restrictions on cameras or app stores, update…

• Mobile security

  Mobile security covers the protection of smartphones and tablets, and the data on them, against loss, theft, malicious apps, phishing and network attacks.

• Acceptable use policy

  An acceptable use policy (AUP) is the document that tells employees what they may and may not do with company devices, company data and, under BYOD, the work side of their personal phone, and what…

Apple

• Apple Business Manager

  Apple Business Manager (ABM) is Apple's free web portal where a company registers the iPhones, iPads and Macs it owns, links them to an MDM server and buys apps in volume.

• Apple School Manager

  Apple School Manager (ASM) is the education version of Apple Business Manager: a free portal where a school or district registers its iPads and Macs, assigns them to an MDM, buys apps in volume and…

• Automated Device Enrollment

  Automated Device Enrollment (ADE) is Apple's mechanism for enrolling an iPhone, iPad or Mac into MDM during first boot, with no action from IT.

• APNs

  APNs, the Apple Push Notification service, is the channel every Apple MDM uses to wake up a managed device.

• VPP (Apps and Books)

  VPP, now called Apps and Books in Apple Business Manager, is Apple's volume licensing system.

• Apple Configurator

  Apple Configurator is Apple's tool for configuring iPhones, iPads and Apple TVs by hand, over USB from a Mac or by scanning from an iPhone.

• Activation Lock

  Activation Lock is the Apple anti-theft feature that ties an iPhone, iPad or Mac to an Apple Account when Find My is enabled.

• Apple Developer Program

  The Apple Developer Program is the paid membership (99 US dollars per year) that lets an organization sign iOS and macOS apps and distribute them, on the public App Store or privately through Apple…

• DEP (Device Enrollment Program)

  DEP, the Device Enrollment Program, was Apple's original service for enrolling company-owned iPhones, iPads and Macs into an MDM automatically at first boot.

• TestFlight

  TestFlight is Apple's official beta distribution service, part of the Apple Developer Program, used to hand pre-release builds of an iOS, iPadOS, macOS, tvOS, watchOS or visionOS app to testers…

• Managed Apple ID

  A Managed Apple ID is a work account that your organization creates and owns in Apple Business Manager or Apple School Manager, instead of an account the employee signs up for with Apple directly.

• Shared iPad

  Shared iPad is an Apple deployment mode where one iPad serves several people, each signing in with their own Managed Apple ID and getting their own data partition on the device.

• macOS MDM

  macOS MDM is the management of Mac desktops and laptops through Apple's native management protocol, the same channel used for iPhone and iPad but with its own payloads, consent rules and escrow…

• IPA file

  An IPA file (iOS App Store Package) is the installable archive of an iOS or iPadOS app: a ZIP container holding the compiled binary, its resources, its Info.plist and its code signature.

• User Enrollment

  User Enrollment is Apple's BYOD management mode, available since iOS 13 and iPadOS 13.1, where an employee's own iPhone gets work apps and work accounts without the company taking control of the…

• Mac MDM

  Mac MDM is the everyday name for managing Apple's desktops and laptops through the MDM protocol built into macOS, the same channel used for iPhone and iPad with its own payloads and consent rules.

• ADE (Automated Device Enrollment)

  ADE stands for Automated Device Enrollment, Apple's mechanism for enrolling an iPhone, iPad, Mac or Apple TV into MDM during the first boot, with the enrollment profile installed before the user…

• ABM (Apple Business Manager)

  ABM stands for Apple Business Manager, the free web portal where an organization registers the Apple devices it owns, assigns them to an MDM server for automated enrollment, buys apps in volume and…

Android

• Android Enterprise

  Android Enterprise is Google's program and set of APIs that make Android devices manageable by an MDM in a standard way.

• Work profile

  A work profile is a separate, encrypted container that Android Enterprise creates on a device to hold company apps and data apart from personal ones.

• Fully managed device

  A fully managed device is an Android Enterprise mode in which the company owns the device and the MDM controls all of it: apps, settings, updates, security and the option to wipe it entirely.

• Dedicated device

  A dedicated device is an Android Enterprise mode for company-owned hardware locked to a single purpose: a scanner, a point-of-sale terminal, a check-in tablet or a digital sign.

• Samsung Knox

  Samsung Knox is the security platform built into Samsung Galaxy phones, tablets and rugged devices, combining hardware-backed protection with management services for businesses.

• Factory Reset Protection

  Factory Reset Protection (FRP) is an Android anti-theft feature that keeps a device locked after a factory reset until someone signs in with an account that was on it before the wipe.

• OEMConfig

  OEMConfig is an Android Enterprise standard that lets a device manufacturer expose its proprietary settings to any MDM through a dedicated app published on Managed Google Play.

• Google Play Protect

  Google Play Protect is the malware defense built into Google Play services: it scans apps before and after install, on the device and in Google's cloud, and warns or blocks when something looks…

• Knox Mobile Enrollment (KME)

  Knox Mobile Enrollment is Samsung's free service for pushing company-owned Galaxy devices into an MDM automatically at first boot, without a QR code, an NFC tap or anyone touching a setup wizard.

• Android device management

  Android device management is the control of Android phones, tablets and rugged terminals through Android Enterprise, the management framework Google builds into every certified device, with a mode…

• Android Enterprise Recommended

  Android Enterprise Recommended is Google's validation program, launched in February 2018, that lists devices and management solutions meeting a published set of enterprise requirements: hardware…

• Device owner mode

  Device owner mode is the Android Enterprise provisioning mode in which the management app owns the whole device, from the lock screen to the app list, with no personal space left for the user.

Windows

• Windows Autopilot

  Windows Autopilot is Microsoft's provisioning service that turns a new PC into a configured, managed machine the first time it boots.

• Microsoft Intune

  Microsoft Intune is Microsoft's cloud MDM and UEM service, used to enroll, configure and secure Windows PCs, phones and tablets from the Microsoft 365 admin experience.

• BitLocker

  BitLocker is the full disk encryption built into Windows.

• Microsoft Entra ID

  Microsoft Entra ID is Microsoft's cloud identity service, renamed from Azure Active Directory in 2023.

• Conditional access

  Conditional access is the practice of granting or refusing access to company resources based on conditions evaluated at sign-in: who the user is, whether the device is compliant, where the request…

• BitLocker recovery key

  A BitLocker recovery key is a 48-digit numerical password that unlocks an encrypted Windows volume when the normal unlock path fails, usually because the TPM no longer recognizes the machine it is…

• Group Policy (GPO)

  Group Policy is the Active Directory mechanism that pushes thousands of Windows settings to domain-joined machines and users through policy objects linked to organizational units.

• Windows Hello for Business

  Windows Hello for Business replaces a password with an asymmetric key pair whose private half is generated inside the device's TPM and released only by a PIN or a biometric gesture.

• Windows MDM

  Windows MDM is the management of Windows 10 and Windows 11 PCs through the MDM client built into the operating system, which enrolls the device with a server and applies settings through…

Network & identity