MDM policy

How it works

A policy is written once in the console and applied to a group of devices. The MDM translates it into what each OS understands: a restrictions payload on iOS, a set of managed policies through Android Device Policy, configuration service providers on Windows. The device applies it and reports whether it succeeded.

Policies fall into a few families. Security rules cover the passcode (minimum six digits, no simple sequences, auto-lock after two minutes), encryption, and jailbreak or root detection. Restriction rules disable features: camera, screenshots, AirDrop, USB file transfer, factory reset by the user. Configuration rules push Wi-Fi, VPN, certificates and email accounts. Update rules set a deadline for the next OS version, with Apple enforcing them through Declarative Device Management since iOS 17.

Not every rule works on every device. Many iOS restrictions need a supervised device. Android restrictions differ between a work profile, where the company controls only the work side, and a fully managed device, where it controls everything. A policy that disables the camera on a personal phone's work profile disables it for work apps only, which is exactly what you want.

A compliance policy is the sibling that doesn't enforce but evaluates: is the OS version recent enough, is the passcode set, has the device checked in this week. Its result feeds conditional access decisions.

Why it matters for a fleet

Without a policy, security is a memo. With one, a lost phone in a taxi is an encrypted, passcode-locked object that you can wipe remotely, and you can prove it was.

Policies are also where fleets go wrong. Too strict, and users fight the device (or find the cheap Android in the drawer that isn't managed). Too loose, and the policy exists only to satisfy an audit. The pragmatic approach: a baseline everyone gets (encryption, passcode, screen lock, OS floor), then stricter groups for shared devices, kiosks and anything holding health or payment data.

Write down why each rule exists. Six months later, when someone asks why the sales team can't use AirDrop, nobody remembers.

How Appaloosa handles it

Appaloosa applies policies per device group on iOS, iPadOS, Android, Windows and macOS: passcode and encryption rules, restrictions, Wi-Fi and certificate configuration, kiosk mode, plus compliance policies evaluated continuously on OS version, passcode, required apps and last check-in. A device that falls out of compliance can be notified, lose its managed apps or be wiped. The policy catalog per platform is on the mobile device management page.